Re: [OE-core][master][PATCH] bind: Upgrade 9.18.15 -> 9.18.16

Yi Zhao
2023-08-03T02:24:45Z

Hi Steve,

On 6/27/23 14:32, Siddharth wrote:
> From: Siddharth Doshi <sdoshi@mvista.com>
>
> - Remove configure options no longer supported online.
>
> Changelog:
> =========
> [security] A query that prioritizes stale data over lookup
> triggers a fetch to refresh the stale data in cache.
> If the fetch is aborted for exceeding the recursion
> quota, it was possible for 'named' to enter an infinite
> callback loop and crash due to stack overflow. This has
> been fixed. (CVE-2023-2911) [GL #4089]
>
> [security] Improve the overmem cleaning process to prevent the
> cache going over the configured limit. (CVE-2023-2828)
> [GL #4055]

There are some CVE fixes in this minor update. Is there any plan to
backport it to mickledore ?

Thanks,

Yi

>
> [performance] Reduce memory consumption by allocating properly
> sized send buffers for stream-based transports.
> [GL #4038]
>
> [bug] Fix a 'clients-per-query' miscalculation bug. When the
> 'stale-answer-enable' options was enabled and the
> 'stale-answer-client-timeout' option was enabled and
> larger than 0, named was taking two places from the
> 'clients-per-query' limit for each client and was
> failing to gradually auto-tune its value, as configured.
> [GL #4074]
>
> [func] Add "ClientQuota" statistics channel counter, which
> indicates the number of the resolver's spilled queries
> due to reaching the clients per query quota. [GL !7978]
>
> [bug] Fix a serve-stale bug where a delegation from cache
> could be returned to the client. [GL #3950]
>
> [cleanup] Remove configure checks for epoll, kqueue and
> /dev/poll. [GL #4098]
>
> [func] The "tkey-dhkey" option has been deprecated; a
> warning will be logged when it is used. In a future
> release, Diffie-Hellman TKEY mode will be removed.
> [GL #3905]
>
> [bug] The session key object could be incorrectly added
> to multiple different views' keyrings. [GL #4079]
>
> [bug] Fix an interfacemgr use-after-free error in
> zoneconf.c:isself(). [GL #3765]
>
> [test] Add support for using pytest & pytest-xdist to
> execute the system test suite. [GL #3978]
>
> [bug] BIND could get stuck on reconfiguration when a
> 'listen' statement for HTTP is removed from the
> configuration. That has been fixed. [GL #4071]
>
> [bug] Properly process extra "nameserver" lines in
> resolv.conf otherwise the next line is not properly
> processed. [GL #4066]
>
> [bug] named could crash when deleting inline-signing zones
> with "rndc delzone". [GL #4054]
>
> [bug] Fix a logic error in dighost.c which could call the
> dighost_shutdown() callback twice and cause problems
> if the callback function was not idempotent. [GL #4039]
>
> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
> ---
> .../0001-avoid-start-failure-with-bind-user.patch | 0
> ...0001-named-lwresd-V-and-start-log-hide-build-options.patch | 0
> ...bind-ensure-searching-for-json-headers-searches-sysr.patch | 0
> .../bind/{bind-9.18.15 => bind-9.18.16}/bind9 | 0
> .../bind/{bind-9.18.15 => bind-9.18.16}/conf.patch | 0
> .../bind/{bind-9.18.15 => bind-9.18.16}/generate-rndc-key.sh | 0
> .../init.d-add-support-for-read-only-rootfs.patch | 0
> .../make-etc-initd-bind-stop-work.patch | 0
> .../bind/{bind-9.18.15 => bind-9.18.16}/named.service | 0
> .../bind/{bind_9.18.15.bb => bind_9.18.16.bb} | 4 ++--
> 10 files changed, 2 insertions(+), 2 deletions(-)
> rename meta/recipes-connectivity/bind/{bind-9.18.15 => bind-9.18.16}/0001-avoid-start-failure-with-bind-user.patch (100%)
> rename meta/recipes-connectivity/bind/{bind-9.18.15 => bind-9.18.16}/0001-named-lwresd-V-and-start-log-hide-build-options.patch (100%)
> rename meta/recipes-connectivity/bind/{bind-9.18.15 => bind-9.18.16}/bind-ensure-searching-for-json-headers-searches-sysr.patch (100%)
> rename meta/recipes-connectivity/bind/{bind-9.18.15 => bind-9.18.16}/bind9 (100%)
> rename meta/recipes-connectivity/bind/{bind-9.18.15 => bind-9.18.16}/conf.patch (100%)
> rename meta/recipes-connectivity/bind/{bind-9.18.15 => bind-9.18.16}/generate-rndc-key.sh (100%)
> rename meta/recipes-connectivity/bind/{bind-9.18.15 => bind-9.18.16}/init.d-add-support-for-read-only-rootfs.patch (100%)
> rename meta/recipes-connectivity/bind/{bind-9.18.15 => bind-9.18.16}/make-etc-initd-bind-stop-work.patch (100%)
> rename meta/recipes-connectivity/bind/{bind-9.18.15 => bind-9.18.16}/named.service (100%)
> rename meta/recipes-connectivity/bind/{bind_9.18.15.bb => bind_9.18.16.bb} (96%)
>
> diff --git a/meta/recipes-connectivity/bind/bind-9.18.15/0001-avoid-start-failure-with-bind-user.patch b/meta/recipes-connectivity/bind/bind-9.18.16/0001-avoid-start-failure-with-bind-user.patch
> similarity index 100%
> rename from meta/recipes-connectivity/bind/bind-9.18.15/0001-avoid-start-failure-with-bind-user.patch
> rename to meta/recipes-connectivity/bind/bind-9.18.16/0001-avoid-start-failure-with-bind-user.patch
> diff --git a/meta/recipes-connectivity/bind/bind-9.18.15/0001-named-lwresd-V-and-start-log-hide-build-options.patch b/meta/recipes-connectivity/bind/bind-9.18.16/0001-named-lwresd-V-and-start-log-hide-build-options.patch
> similarity index 100%
> rename from meta/recipes-connectivity/bind/bind-9.18.15/0001-named-lwresd-V-and-start-log-hide-build-options.patch
> rename to meta/recipes-connectivity/bind/bind-9.18.16/0001-named-lwresd-V-and-start-log-hide-build-options.patch
> diff --git a/meta/recipes-connectivity/bind/bind-9.18.15/bind-ensure-searching-for-json-headers-searches-sysr.patch b/meta/recipes-connectivity/bind/bind-9.18.16/bind-ensure-searching-for-json-headers-searches-sysr.patch
> similarity index 100%
> rename from meta/recipes-connectivity/bind/bind-9.18.15/bind-ensure-searching-for-json-headers-searches-sysr.patch
> rename to meta/recipes-connectivity/bind/bind-9.18.16/bind-ensure-searching-for-json-headers-searches-sysr.patch
> diff --git a/meta/recipes-connectivity/bind/bind-9.18.15/bind9 b/meta/recipes-connectivity/bind/bind-9.18.16/bind9
> similarity index 100%
> rename from meta/recipes-connectivity/bind/bind-9.18.15/bind9
> rename to meta/recipes-connectivity/bind/bind-9.18.16/bind9
> diff --git a/meta/recipes-connectivity/bind/bind-9.18.15/conf.patch b/meta/recipes-connectivity/bind/bind-9.18.16/conf.patch
> similarity index 100%
> rename from meta/recipes-connectivity/bind/bind-9.18.15/conf.patch
> rename to meta/recipes-connectivity/bind/bind-9.18.16/conf.patch
> diff --git a/meta/recipes-connectivity/bind/bind-9.18.15/generate-rndc-key.sh b/meta/recipes-connectivity/bind/bind-9.18.16/generate-rndc-key.sh
> similarity index 100%
> rename from meta/recipes-connectivity/bind/bind-9.18.15/generate-rndc-key.sh
> rename to meta/recipes-connectivity/bind/bind-9.18.16/generate-rndc-key.sh
> diff --git a/meta/recipes-connectivity/bind/bind-9.18.15/init.d-add-support-for-read-only-rootfs.patch b/meta/recipes-connectivity/bind/bind-9.18.16/init.d-add-support-for-read-only-rootfs.patch
> similarity index 100%
> rename from meta/recipes-connectivity/bind/bind-9.18.15/init.d-add-support-for-read-only-rootfs.patch
> rename to meta/recipes-connectivity/bind/bind-9.18.16/init.d-add-support-for-read-only-rootfs.patch
> diff --git a/meta/recipes-connectivity/bind/bind-9.18.15/make-etc-initd-bind-stop-work.patch b/meta/recipes-connectivity/bind/bind-9.18.16/make-etc-initd-bind-stop-work.patch
> similarity index 100%
> rename from meta/recipes-connectivity/bind/bind-9.18.15/make-etc-initd-bind-stop-work.patch
> rename to meta/recipes-connectivity/bind/bind-9.18.16/make-etc-initd-bind-stop-work.patch
> diff --git a/meta/recipes-connectivity/bind/bind-9.18.15/named.service b/meta/recipes-connectivity/bind/bind-9.18.16/named.service
> similarity index 100%
> rename from meta/recipes-connectivity/bind/bind-9.18.15/named.service
> rename to meta/recipes-connectivity/bind/bind-9.18.16/named.service
> diff --git a/meta/recipes-connectivity/bind/bind_9.18.15.bb b/meta/recipes-connectivity/bind/bind_9.18.16.bb
> similarity index 96%
> rename from meta/recipes-connectivity/bind/bind_9.18.15.bb
> rename to meta/recipes-connectivity/bind/bind_9.18.16.bb
> index 80164aad87..1b1649566a 100644
> --- a/meta/recipes-connectivity/bind/bind_9.18.15.bb
> +++ b/meta/recipes-connectivity/bind/bind_9.18.16.bb
> @@ -20,7 +20,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \
> file://0001-avoid-start-failure-with-bind-user.patch \
> "
>
> -SRC_URI[sha256sum] = "28ae8db14862801bc2bd4fd820db00667d3f1ff9ae9cc2d06a0ef7810fed7a4e"
> +SRC_URI[sha256sum] = "c88234fe07ee75c3c8a9e59152fee64b714643de8e22cf98da3db4d0b57e0775"
>
> UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/"
> # follow the ESV versions divisible by 2
> @@ -39,7 +39,7 @@ PACKAGECONFIG[readline] = "--with-readline=readline,,readline"
> PACKAGECONFIG[libedit] = "--with-readline=libedit,,libedit"
> PACKAGECONFIG[dns-over-http] = "--enable-doh,--disable-doh,nghttp2"
>
> -EXTRA_OECONF = " --disable-devpoll --disable-auto-validation --enable-epoll \
> +EXTRA_OECONF = " --disable-auto-validation \
> --with-gssapi=no --with-lmdb=no --with-zlib \
> --sysconfdir=${sysconfdir}/bind \
> --with-openssl=${STAGING_DIR_HOST}${prefix} \
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#183438): https://lists.openembedded.org/g/openembedded-core/message/183438
> Mute This Topic: https://lists.openembedded.org/mt/99804753/7283133
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [yi.zhao@eng.windriver.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>