Files
poky/meta/recipes-connectivity/bind/bind_9.18.3.bb
wangmy b55297c679 bind: upgrade 9.18.2 -> 9.18.3
Changelog:
==========
[security]
 Fix a crash in DNS-over-HTTPS (DoH) code caused by
 premature TLS stream socket object deletion.
 (CVE-2022-1183) [GL #3216]

[bug]
 RPZ NSIP and NSDNAME rule processing didn't handle stub
 and static-stub zones at or above the query name.  This
 has now been addressed. [GL #3232]
 Fixed a deadlock that could occur if an rndc
 connection arrived during the shutdown of network
 interfaces. [GL #3272]

 Refactor the fctx_done() function to set fctx to
 NULL after detaching, so that reference counting
 errors will be easier to avoid. [GL #2969]

 udp_recv() in dispatch could trigger an INSIST when the
 callback's result indicated success but the response
 was canceled in the meantime. [GL #3300]

 Work around a jemalloc quirk which could trigger an
 out-of-memory condition in named over time. [GL #3287]

 If there was a pending negative cache DS entry,
 validations depending upon it could fail. [GL #3279]

 dig returned a 0 exit status on UDP connection failure.
 [GL #3235]

 Fix an assertion failure when using dig with +nssearch
 and +tcp options by starting the next query in the
 send_done() callback (like in the UDP mode) instead
 of doing that recursively in start_tcp(). Also
 ensure that queries interrupted while connecting
 are detached properly. [GL #3144]

 Don't remove CDS/CDNSKEY DELETE records on zone sign
 when using 'auto-dnssec maintain;'. [GL #2931]

[contrib]
 Avoid name space collision in dlz modules by prefixing
 functions with 'dlz_'. [GL !5778]

 dlz: Add FALLTHROUGH and UNREACHABLE macros. [GL #3306]

[func]
 Add new named command-line option -C to print built-in
 defaults. [GL #1326]

 Introduce the concept of broken catalog zones described
 in the DNS catalog zones draft version 5 document.
 [GL #3224]

 Add DNS Extended Errors when stale answers are returned
 from cache. [GL #2267]

 Implement support for catalog zones change of ownership
 (coo) mechanism described in the DNS catalog zones draft
 version 5 document. [GL #3223]

 Implement support for catalog zones options new syntax
 based on catalog zones custom properties with "ext"
 suffix described in the DNS catalog zones draft version
 5 document. [GL #3222]

 Implement reference counting for TLS contexts and
 allow reloading of TLS certificates on reconfiguration
 without destroying the underlying TCP listener sockets
 for TLS-based DNS transports. [GL #3122]
 Add support for remote TLS certificates
 verification, both to BIND and dig, making it possible
 to implement Strict and Mutual TLS authentication,
 as described in RFC 9103, Section 9.3. [GL #3163]

[cleanup]
 Remove use of exclusive mode in ns_interfacemgr in
 favor of rwlocked access to localhost and localnets
 members of dns_aclenv_t structure. [GL #3229]

 Remove the task exclusive mode use in ns_clientmgr.
 [GL #3230]

(From OE-Core rev: d2ae8b85c71be2e9e332b1ef0a2d3083b30c63e6)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-27 23:50:47 +01:00

128 lines
4.8 KiB
BlitzBasic

SUMMARY = "ISC Internet Domain Name Server"
HOMEPAGE = "https://www.isc.org/bind/"
DESCRIPTION = "BIND 9 provides a full-featured Domain Name Server system"
SECTION = "console/network"
LICENSE = "MPL-2.0"
LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=9a4a897f202c0710e07f2f2836bc2b62"
DEPENDS = "openssl libcap zlib libuv"
SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \
file://conf.patch \
file://named.service \
file://bind9 \
file://generate-rndc-key.sh \
file://make-etc-initd-bind-stop-work.patch \
file://init.d-add-support-for-read-only-rootfs.patch \
file://bind-ensure-searching-for-json-headers-searches-sysr.patch \
file://0001-named-lwresd-V-and-start-log-hide-build-options.patch \
file://0001-avoid-start-failure-with-bind-user.patch \
"
SRC_URI[sha256sum] = "0ad8da773bd93cba0ef66cc81999698ebdf9c3e51faed5e5c8c1eb75cad2ae6f"
UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/"
# follow the ESV versions divisible by 2
UPSTREAM_CHECK_REGEX = "(?P<pver>9.(\d*[02468])+(\.\d+)+(-P\d+)*)/"
# Issue only affects dhcpd with recent bind versions. We don't ship dhcpd anymore
# so the issue doesn't affect us.
CVE_CHECK_IGNORE += "CVE-2019-6470"
inherit autotools update-rc.d systemd useradd pkgconfig multilib_header update-alternatives
# PACKAGECONFIGs readline and libedit should NOT be set at same time
PACKAGECONFIG ?= "readline"
PACKAGECONFIG[httpstats] = "--with-libxml2=${STAGING_DIR_HOST}${prefix},--without-libxml2,libxml2"
PACKAGECONFIG[readline] = "--with-readline=readline,,readline"
PACKAGECONFIG[libedit] = "--with-readline=libedit,,libedit"
PACKAGECONFIG[dns-over-http] = "--enable-doh,--disable-doh,nghttp2"
EXTRA_OECONF = " --disable-devpoll --disable-auto-validation --enable-epoll \
--with-gssapi=no --with-lmdb=no --with-zlib \
--sysconfdir=${sysconfdir}/bind \
--with-openssl=${STAGING_DIR_HOST}${prefix} \
"
LDFLAGS:append = " -lz"
inherit ${@bb.utils.contains('PACKAGECONFIG', 'python3', 'python3native setuptools3-base', '', d)}
# dhcp needs .la so keep them
REMOVE_LIBTOOL_LA = "0"
USERADD_PACKAGES = "${PN}"
USERADD_PARAM:${PN} = "--system --home ${localstatedir}/cache/bind --no-create-home \
--user-group bind"
INITSCRIPT_NAME = "bind"
INITSCRIPT_PARAMS = "defaults"
SYSTEMD_SERVICE:${PN} = "named.service"
do_install:append() {
install -d -o bind "${D}${localstatedir}/cache/bind"
install -d "${D}${sysconfdir}/bind"
install -d "${D}${sysconfdir}/init.d"
install -m 644 ${S}/conf/* "${D}${sysconfdir}/bind/"
install -m 755 "${S}/init.d" "${D}${sysconfdir}/init.d/bind"
if ${@bb.utils.contains('PACKAGECONFIG', 'python3', 'true', 'false', d)}; then
sed -i -e '1s,#!.*python3,#! /usr/bin/python3,' \
${D}${sbindir}/dnssec-coverage \
${D}${sbindir}/dnssec-checkds \
${D}${sbindir}/dnssec-keymgr
fi
# Install systemd related files
install -d ${D}${sbindir}
install -m 755 ${WORKDIR}/generate-rndc-key.sh ${D}${sbindir}
install -d ${D}${systemd_system_unitdir}
install -m 0644 ${WORKDIR}/named.service ${D}${systemd_system_unitdir}
sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \
-e 's,@SBINDIR@,${sbindir},g' \
${D}${systemd_system_unitdir}/named.service
install -d ${D}${sysconfdir}/default
install -m 0644 ${WORKDIR}/bind9 ${D}${sysconfdir}/default
if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
install -d ${D}${sysconfdir}/tmpfiles.d
echo "d /run/named 0755 bind bind - -" > ${D}${sysconfdir}/tmpfiles.d/bind.conf
fi
}
CONFFILES:${PN} = " \
${sysconfdir}/bind/named.conf \
${sysconfdir}/bind/named.conf.local \
${sysconfdir}/bind/named.conf.options \
${sysconfdir}/bind/db.0 \
${sysconfdir}/bind/db.127 \
${sysconfdir}/bind/db.empty \
${sysconfdir}/bind/db.local \
${sysconfdir}/bind/db.root \
"
ALTERNATIVE:${PN}-utils = "nslookup"
ALTERNATIVE_LINK_NAME[nslookup] = "${bindir}/nslookup"
ALTERNATIVE_PRIORITY = "100"
PACKAGE_BEFORE_PN += "${PN}-utils"
FILES:${PN}-utils = "${bindir}/host ${bindir}/dig ${bindir}/mdig ${bindir}/nslookup ${bindir}/nsupdate"
FILES:${PN}-dev += "${bindir}/isc-config.h"
FILES:${PN} += "${sbindir}/generate-rndc-key.sh"
PACKAGE_BEFORE_PN += "${PN}-libs"
# special arrangement below due to
# https://github.com/isc-projects/bind9/commit/0e25af628cd776f98c04fc4cc59048f5448f6c88
FILES_SOLIBSDEV = "${libdir}/*[!0-9].so ${libdir}/libbind9.so"
FILES:${PN}-libs = "${libdir}/named/*.so* ${libdir}/*-${PV}.so"
FILES:${PN}-staticdev += "${libdir}/*.la"
PACKAGE_BEFORE_PN += "${@bb.utils.contains('PACKAGECONFIG', 'python3', 'python3-bind', '', d)}"
FILES:python3-bind = "${sbindir}/dnssec-coverage ${sbindir}/dnssec-checkds \
${sbindir}/dnssec-keymgr ${PYTHON_SITEPACKAGES_DIR}"
RDEPENDS:${PN}-dev = ""
RDEPENDS:python3-bind = "python3-core python3-ply"