linux/poky.git/meta/recipes-connectivity/bind, branch yocto-5.0.8

bind: Upgrade 9.18.28 -> 9.18.33

2025-02-28T14:45:14+00:00

Includes security fixes for CVE-2024-12705 CVE-2024-11187 and other bug fixes Release Notes: https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-33 https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-32 https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-31 https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-30 https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-29 (From OE-Core rev: 37f07393c6977e7765ebfd948a017dab9be6a367) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

bind: Fix build with the `httpstats` package config enabled

2024-09-25T12:07:47+00:00

------C65ED3E1A5DE826CA595746785F6AF6F To: openembedded-core@lists.openembedded.org CC: Alban Bedel Subject: [PATCH] bind: Fix build with the `httpstats` package config enabled Date: Wed, 11 Sep 2024 08:26:47 +0200 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain MIME-Version: 1.0 When the `httpstats` package config is enabled configure fails with the error: > configure: error: Specifying libxml2 installation path is not > supported, adjust PKG_CONFIG_PATH instead Drop the explicit path from `--with-libxml2` to solve this issue. (From OE-Core rev: b87811febbb1a33182d8a3eb8c0f671548ae999a) Signed-off-by: Alban Bedel Signed-off-by: Richard Purdie (cherry picked from commit 9b076fa51f5e6fd685066fb817c47239960778e6) Signed-off-by: Steve Sakoman

bind: Upgrade 9.18.25 -> 9.18.28

2024-08-10T13:34:25+00:00

Includes security fixes for: CVE-2024-1975 CVE-2024-1737 CVE-2024-0760 CVE-2024-4076 Changelog: ========= https://gitlab.isc.org/isc-projects/bind9/-/blob/v9.18.28/CHANGES (From OE-Core rev: 45fccf634a3ba0f60ee16522b7a767bb778dd984) Signed-off-by: Ashish Sharma Signed-off-by: Steve Sakoman

bind: upgrade 9.18.24 -> 9.18.25

2024-05-03T13:12:21+00:00

Changelog: ============ -Create the pruning task in the dns_cache_flush(), so the cache pruning still works after the flush. -Improve the TTL-based cleaning by removing the expired headers from the heap, so they don't block the next cleaning round and clean more than a single item for each new addition to the RBTDB. -Revert change 6319 and decrease lock contention during RBTDB tree pruning by not cleaning up nodes recursively within a single prune_tree() call. -Address use after free in expire_lru_headers. (From OE-Core rev: 5b3ba5f021f3bd532238dad57772c8416da61c14) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie (cherry picked from commit 17cecd0d9d0d734d408701d861692ca5987f4ad9) Signed-off-by: Steve Sakoman

bind: Upgrade 9.18.21 -> 9.18.24

2024-02-24T16:10:23+00:00

Changelog: ========= 9.18.24: - Fix case insensitive setting for isc_ht hashtable. [GL #4568] 9.18.23: - Specific DNS answers could cause a denial-of-service condition due to DNS validation taking a long time. (CVE-2023-50387) [GL #4424] - Change 6315 inadvertently introduced regressions that could cause named to crash. [GL #4234] - Under some circumstances, the DoT code in client mode could process more than one message at a time when that was not expected. That has been fixed. [GL #4487] 9.18.22: - Limit isc_task_send() overhead for RBTDB tree pruning. [GL #4383] - Restore DNS64 state when handling a serve-stale timeout. (CVE-2023-5679) [GL #4334] - Specific queries could trigger an assertion check with nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281] - Speed up parsing of DNS messages with many different names. (CVE-2023-4408) [GL #4234] - Address race conditions in dns_tsigkey_find(). [GL #4182] - Conversion from NSEC3 signed to NSEC signed could temporarily put the zone into a state where it was treated as unsigned until the NSEC chain was built. Additionally conversion from one set of NSEC3 parameters to another could also temporarily put the zone into a state where it was treated as unsigned until the new NSEC3 chain was built. [GL #1794] [GL #4495] - Memory leak in zone.c:sign_zone. When named signed a zone it could leak dst_keys due to a misplaced 'continue'. [GL #4488] - Log more details about the cause of "not exact" errors. [GL #4500] - The wrong time was being used to determine what RRSIGs where to be generated when dnssec-policy was in use. [GL #4494] - The "trust-anchor-telemetry" statement is no longer marked as experimental. This silences a relevant log message that was emitted even when the feature was explicitly disabled. [GL #4497] - Fix statistics export to use full 64 bit signed numbers instead of truncating values to unsigned 32 bits. [GL #4467] - NetBSD has added 'hmac' to libc which collides with our use of 'hmac'. [GL #4478] (From OE-Core rev: d7f31aba343948dbaadafc8c0c66f78e6ffb46e3) Signed-off-by: Soumya Sambu Signed-off-by: Richard Purdie

bind: upgrade 9.18.20 -> 9.18.21

2024-01-19T12:21:23+00:00

bind-ensure-searching-for-json-headers-searches-sysr.patch refreshed for 9.18.21 Changelog: ========== -Improve LRU cleaning behaviour. -The "resolver-nonbackoff-tries" and "resolver-retry-interval" options are deprecated; a warning will be logged if they are used. -BIND might sometimes crash after startup or re-configuration when one 'tls' entry is used multiple times to connect to remote servers due to initialisation attempts from contexts of multiple threads. That has been fixed. -Dig +yaml will now report "no servers could be reached" also for UDP setup failure when no other servers or tries are left. -Recognize escapes when reading the public key from file. -Dig +yaml will now report "no servers could be reached" on TCP connection failure as well as for UDP timeouts. -Deprecate AES-based DNS cookies. (From OE-Core rev: b750d54622a0fa0a35d83ddc59f07661e903360b) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

bind: upgrade 9.18.19 -> 9.18.20

2023-11-30T08:43:03+00:00

Changelog: ============ -Fix missing newlines in the output of "rndc nta -dump". -Take into account local authoritative zones when falling back to serve-stale. -Fix assertion failure when using lock-file configuration option together -X argument to named. -The 'lock-file' file was being removed when it shouldn't have been making it ineffective if named was started 3 or more times. -Fix a shutdown race in dns__catz_update_cb(). -B.ROOT-SERVERS.NET addresses are now 170.247.170.2 and 2801:1b8:10::b. -The timeouts for resending zone refresh queries over UDP were lowered to enable named to more quickly determine that a primary is down. -Don't schedule resign operations on the raw version of an inline-signing zone. -Fix a possible assertion failure on an error path in resolver.c:fctx_query(), when using an uninitialized link. -Add semantic patch to do an explicit cast from char to unsigned char in ctype.h class of functions. -Python system tests have to be executed by invoking pytest directly. Executing them with the legacy test runner is no longer supported. -The wrong covered value was being set by dns_ncache_current for RRSIG records in the returned rdataset structure. This resulted in TYPE0 being reported as the covered value of the RRSIG when dumping the cache contents. (From OE-Core rev: 9b34124561d926d9273c52163853161515e5666a) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

bind: update to 9.18.19

2023-09-26T09:35:28+00:00

release notes: https://downloads.isc.org/isc/bind9/9.18.19/doc/arm/html/notes.html#notes-for-bind-9-18-19 Security Fixes Previously, sending a specially crafted message over the control channel could cause the packet-parsing code to run out of available stack memory, causing named to terminate unexpectedly. This has been fixed. (CVE-2023-3341) ISC would like to thank Eric Sesterhenn from X41 D-Sec GmbH for bringing this vulnerability to our attention. [GL #4152] A flaw in the networking code handling DNS-over-TLS queries could cause named to terminate unexpectedly due to an assertion failure under significant DNS-over-TLS query load. This has been fixed. (CVE-2023-4236) ISC would like to thank Robert Story from USC/ISI Root Server Operations for bringing this vulnerability to our attention. [GL #4242] Removed Features The dnssec-must-be-secure option has been deprecated and will be removed in a future release. [GL #4263] Feature Changes If the server command is specified, nsupdate now honors the nsupdate -v option for SOA queries by sending both the UPDATE request and the initial query over TCP. [GL #1181] Bug Fixes The value of the If-Modified-Since header in the statistics channel was not being correctly validated for its length, potentially allowing an authorized user to trigger a buffer overflow. Ensuring the statistics channel is configured correctly to grant access exclusively to authorized users is essential (see the statistics-channels block definition and usage section). [GL #4124] This issue was reported independently by Eric Sesterhenn of X41 D-Sec GmbH and Cameron Whitehead. The Content-Length header in the statistics channel was lacking proper bounds checking. A negative or excessively large value could potentially trigger an integer overflow and result in an assertion failure. [GL This issue was reported by Eric Sesterhenn of X41 D-Sec GmbH. Several memory leaks caused by not clearing the OpenSSL error stack were fixed. [GL #4159] This issue was reported by Eric Sesterhenn of X41 D-Sec GmbH. The introduction of krb5-subdomain-self-rhs and ms-subdomain-self-rhs UPDATE policies accidentally caused named to return SERVFAIL responses to deletion requests for non-existent PTR and SRV records. This has been fixed. [GL #4280] The stale-refresh-time feature was mistakenly disabled when the server cache was flushed by rndc flush. This has been fixed. [GL #4278] BIND’s memory consumption has been improved by implementing dedicated jemalloc memory arenas for sending buffers. This optimization ensures that memory usage is more efficient and better manages the return of memory pages to the operating system. [GL #4038] Previously, partial writes in the TLS DNS code were not accounted for correctly, which could have led to DNS message corruption. This has been fixed. [GL #4255] Known Issues There are no new known issues with this release. See above for a list of all known issues affecting this BIND 9 branch. (From OE-Core rev: 29cc2203b06b12d4c93ffc1fb56f1754f6982e80) Signed-off-by: Lee Chee Yang Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

bind: upgrade 9.18.17 -> 9.18.18

2023-09-02T17:23:05+00:00

Changelog: ============ Deprecate the 'dialup' and 'heartbeat-interval' options. Ignore 'max-zone-ttl' on 'dnssec-policy insecure'. Return REFUSED to GSS-API TKEY requests if GSS-API support is not configured. Mark a primary server as temporarily unreachable if the TCP connection attempt times out. Don't process detach and close netmgr events when the netmgr has been paused. (From OE-Core rev: e78ec619beea6e541b2d83a5dc845ce57ff12564) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

bind: upgrade to v9.18.17

2023-08-10T08:18:54+00:00

Changes: Update license checksum: only whitespace change. Update sha256sum for new version. Additional change: Do not use version with the foldername, which will result in less diffstat with future upgrades. (From OE-Core rev: 1eda31b370ab4129ad149c45f1e43a44d6db9241) Signed-off-by: Sudip Mukherjee Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie