linux/poky.git/meta/recipes-connectivity/bind, branch 5.0_M2

bind: upgrade 9.18.20 -> 9.18.21

2024-01-19T12:21:23+00:00

bind-ensure-searching-for-json-headers-searches-sysr.patch refreshed for 9.18.21 Changelog: ========== -Improve LRU cleaning behaviour. -The "resolver-nonbackoff-tries" and "resolver-retry-interval" options are deprecated; a warning will be logged if they are used. -BIND might sometimes crash after startup or re-configuration when one 'tls' entry is used multiple times to connect to remote servers due to initialisation attempts from contexts of multiple threads. That has been fixed. -Dig +yaml will now report "no servers could be reached" also for UDP setup failure when no other servers or tries are left. -Recognize escapes when reading the public key from file. -Dig +yaml will now report "no servers could be reached" on TCP connection failure as well as for UDP timeouts. -Deprecate AES-based DNS cookies. (From OE-Core rev: b750d54622a0fa0a35d83ddc59f07661e903360b) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

bind: upgrade 9.18.19 -> 9.18.20

2023-11-30T08:43:03+00:00

Changelog: ============ -Fix missing newlines in the output of "rndc nta -dump". -Take into account local authoritative zones when falling back to serve-stale. -Fix assertion failure when using lock-file configuration option together -X argument to named. -The 'lock-file' file was being removed when it shouldn't have been making it ineffective if named was started 3 or more times. -Fix a shutdown race in dns__catz_update_cb(). -B.ROOT-SERVERS.NET addresses are now 170.247.170.2 and 2801:1b8:10::b. -The timeouts for resending zone refresh queries over UDP were lowered to enable named to more quickly determine that a primary is down. -Don't schedule resign operations on the raw version of an inline-signing zone. -Fix a possible assertion failure on an error path in resolver.c:fctx_query(), when using an uninitialized link. -Add semantic patch to do an explicit cast from char to unsigned char in ctype.h class of functions. -Python system tests have to be executed by invoking pytest directly. Executing them with the legacy test runner is no longer supported. -The wrong covered value was being set by dns_ncache_current for RRSIG records in the returned rdataset structure. This resulted in TYPE0 being reported as the covered value of the RRSIG when dumping the cache contents. (From OE-Core rev: 9b34124561d926d9273c52163853161515e5666a) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

bind: update to 9.18.19

2023-09-26T09:35:28+00:00

release notes: https://downloads.isc.org/isc/bind9/9.18.19/doc/arm/html/notes.html#notes-for-bind-9-18-19 Security Fixes Previously, sending a specially crafted message over the control channel could cause the packet-parsing code to run out of available stack memory, causing named to terminate unexpectedly. This has been fixed. (CVE-2023-3341) ISC would like to thank Eric Sesterhenn from X41 D-Sec GmbH for bringing this vulnerability to our attention. [GL #4152] A flaw in the networking code handling DNS-over-TLS queries could cause named to terminate unexpectedly due to an assertion failure under significant DNS-over-TLS query load. This has been fixed. (CVE-2023-4236) ISC would like to thank Robert Story from USC/ISI Root Server Operations for bringing this vulnerability to our attention. [GL #4242] Removed Features The dnssec-must-be-secure option has been deprecated and will be removed in a future release. [GL #4263] Feature Changes If the server command is specified, nsupdate now honors the nsupdate -v option for SOA queries by sending both the UPDATE request and the initial query over TCP. [GL #1181] Bug Fixes The value of the If-Modified-Since header in the statistics channel was not being correctly validated for its length, potentially allowing an authorized user to trigger a buffer overflow. Ensuring the statistics channel is configured correctly to grant access exclusively to authorized users is essential (see the statistics-channels block definition and usage section). [GL #4124] This issue was reported independently by Eric Sesterhenn of X41 D-Sec GmbH and Cameron Whitehead. The Content-Length header in the statistics channel was lacking proper bounds checking. A negative or excessively large value could potentially trigger an integer overflow and result in an assertion failure. [GL This issue was reported by Eric Sesterhenn of X41 D-Sec GmbH. Several memory leaks caused by not clearing the OpenSSL error stack were fixed. [GL #4159] This issue was reported by Eric Sesterhenn of X41 D-Sec GmbH. The introduction of krb5-subdomain-self-rhs and ms-subdomain-self-rhs UPDATE policies accidentally caused named to return SERVFAIL responses to deletion requests for non-existent PTR and SRV records. This has been fixed. [GL #4280] The stale-refresh-time feature was mistakenly disabled when the server cache was flushed by rndc flush. This has been fixed. [GL #4278] BIND’s memory consumption has been improved by implementing dedicated jemalloc memory arenas for sending buffers. This optimization ensures that memory usage is more efficient and better manages the return of memory pages to the operating system. [GL #4038] Previously, partial writes in the TLS DNS code were not accounted for correctly, which could have led to DNS message corruption. This has been fixed. [GL #4255] Known Issues There are no new known issues with this release. See above for a list of all known issues affecting this BIND 9 branch. (From OE-Core rev: 29cc2203b06b12d4c93ffc1fb56f1754f6982e80) Signed-off-by: Lee Chee Yang Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

bind: upgrade 9.18.17 -> 9.18.18

2023-09-02T17:23:05+00:00

Changelog: ============ Deprecate the 'dialup' and 'heartbeat-interval' options. Ignore 'max-zone-ttl' on 'dnssec-policy insecure'. Return REFUSED to GSS-API TKEY requests if GSS-API support is not configured. Mark a primary server as temporarily unreachable if the TCP connection attempt times out. Don't process detach and close netmgr events when the netmgr has been paused. (From OE-Core rev: e78ec619beea6e541b2d83a5dc845ce57ff12564) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

bind: upgrade to v9.18.17

2023-08-10T08:18:54+00:00

Changes: Update license checksum: only whitespace change. Update sha256sum for new version. Additional change: Do not use version with the foldername, which will result in less diffstat with future upgrades. (From OE-Core rev: 1eda31b370ab4129ad149c45f1e43a44d6db9241) Signed-off-by: Sudip Mukherjee Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

cve_check: convert CVE_CHECK_IGNORE to CVE_STATUS

2023-07-21T10:52:26+00:00

- Try to add convert and apply statuses for old CVEs - Drop some obsolete ignores, while they are not relevant for current version (From OE-Core rev: 1634ed4048cf56788cd5c2c1bdc979b70afcdcd7) Signed-off-by: Andrej Valek Reviewed-by: Peter Marko Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

bind: Upgrade 9.18.15 -> 9.18.16

2023-06-28T06:56:33+00:00

- Remove configure options no longer supported online. Changelog: ========= [security] A query that prioritizes stale data over lookup triggers a fetch to refresh the stale data in cache. If the fetch is aborted for exceeding the recursion quota, it was possible for 'named' to enter an infinite callback loop and crash due to stack overflow. This has been fixed. (CVE-2023-2911) [GL #4089] [security] Improve the overmem cleaning process to prevent the cache going over the configured limit. (CVE-2023-2828) [GL #4055] [performance] Reduce memory consumption by allocating properly sized send buffers for stream-based transports. [GL #4038] [bug] Fix a 'clients-per-query' miscalculation bug. When the 'stale-answer-enable' options was enabled and the 'stale-answer-client-timeout' option was enabled and larger than 0, named was taking two places from the 'clients-per-query' limit for each client and was failing to gradually auto-tune its value, as configured. [GL #4074] [func] Add "ClientQuota" statistics channel counter, which indicates the number of the resolver's spilled queries due to reaching the clients per query quota. [GL !7978] [bug] Fix a serve-stale bug where a delegation from cache could be returned to the client. [GL #3950] [cleanup] Remove configure checks for epoll, kqueue and /dev/poll. [GL #4098] [func] The "tkey-dhkey" option has been deprecated; a warning will be logged when it is used. In a future release, Diffie-Hellman TKEY mode will be removed. [GL #3905] [bug] The session key object could be incorrectly added to multiple different views' keyrings. [GL #4079] [bug] Fix an interfacemgr use-after-free error in zoneconf.c:isself(). [GL #3765] [test] Add support for using pytest & pytest-xdist to execute the system test suite. [GL #3978] [bug] BIND could get stuck on reconfiguration when a 'listen' statement for HTTP is removed from the configuration. That has been fixed. [GL #4071] [bug] Properly process extra "nameserver" lines in resolv.conf otherwise the next line is not properly processed. [GL #4066] [bug] named could crash when deleting inline-signing zones with "rndc delzone". [GL #4054] [bug] Fix a logic error in dighost.c which could call the dighost_shutdown() callback twice and cause problems if the callback function was not idempotent. [GL #4039] (From OE-Core rev: 77d2fa5ac1f394fba2b8e24f2b6ded6ea6b691b4) Signed-off-by: Siddharth Doshi Signed-off-by: Richard Purdie

bind: upgrade 9.18.14 -> 9.18.15

2023-06-02T14:16:35+00:00

Changelog: ========= [bug] Set the rndc idle read timeout back to 60 seconds, from the netmgr default of 30 seconds, in order to match the behavior of 9.16 and earlier. [GL #4046] [bug] Fix log file rotation when using absolute path as file. [GL #3991] [bug] When removing delegations in an OPTOUT range empty-non-terminal NSEC3 records generated by those delegations were not removed. [GL #4027] [bug] Reimplement the maximum and idle timeouts for incoming zone tranfers. [GL #4004] [bug] Treat ISC_R_INVALIDPROTO as a networking error in the dispatch code to avoid retrying with the same server. [GL #4005] [bug] In dispatch, honour the configured source-port selection when UDP connection fails with address in use error. Also treat ISC_R_NOPERM same as ISC_R_ADDRINUSE. [GL #3986] [test] As a workaround, include an OpenSSL header file before including cmocka.h in the unit tests, because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a redefined malloc in cmocka.h. [GL #4000] (From OE-Core rev: 9d5f8062fc2c11bd6ff98a96caa03aac3984ae9c) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

bind: upgrade 9.18.13 -> 9.18.14

2023-05-31T15:53:04+00:00

(From OE-Core rev: 43c97c6e64c554f41a3a45241a7547bce21533e7) Signed-off-by: Trevor Gamblin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

bind: upgrade 9.18.12 -> 9.18.13

2023-04-13T10:56:07+00:00

Changelog: ========== [bug] Use two pairs of dns_db_t and dns_dbversion_t in a catalog zone structure to avoid a race between the dns__catz_update_cb() and dns_catz_dbupdate_callback() functions. [GL #3907] [bug] Make sure to revert the reconfigured zones to the previous version of the view, when the new view reconfiguration fails during the configuration of one of the configured zones. [GL #3911] [bug] Fix error path cleanup issues in dns_catz_new_zones() and dns_catz_new_zone() functions. [GL #3900] [bug] Unregister db update notify callback before detaching from the previous db inside the catz update notify callback. [GL #3777] [func Run the catalog zone update process on the offload threads. [GL #3881] [func Add shutdown signaling for catalog zones. [GL !7571] [func Add reference count tracing for dns_catz_zone_t and dns_catz_zones_t. [GL !7570] [bug] Detach 'rpzs' and 'catzs' from the previous view in configure_rpz() and configure_catz(), respectively, just after attaching it to the new view. [GL #3880] [test Don't test HMAC-MD5 when not supported by libcrypto. [GL #3871] [bug] Fix RPZ reference counting error on shutdown in dns__rpz_timer_cb(). [GL #3866] [test Test various 'islands of trust' configurations when using managed keys. [GL #3662] [bug] Building against (or running with) libuv versions 1.35.0 and 1.36.0 is now a fatal error. The rules for mixing and matching compile-time and run-time libuv versions have been tightened for libuv versions between 1.35.0 and 1.40.0. [GL #3840] [bug] dnssec-cds failed to cleanup properly. [GL #3831] [bug] Source ports configured for query-source, transfer-source, etc, were being ignored. (This feature is deprecated, but it is not yet removed, so the bug still needed fixing.) [GL #3790] (From OE-Core rev: 51ab191224aa1320d622bf79184940afa3910d60) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie