mirror of
https://git.yoctoproject.org/poky
synced 2026-07-25 06:47:01 +00:00
Sona Sarmadi
aefcb6b115
Fixes a denial of service in BIND. An error in the parsing of incoming responses allows some records with an incorrect class to be accepted by BIND instead of being rejected as malformed. This can trigger a REQUIRE assertion failure when those records are subsequently cached. [YOCTO #8838] References: http://www.openwall.com/lists/oss-security/2015/12/15/14 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8000 https://bugzilla.redhat.com/attachment.cgi?id=1105581 (From OE-Core rev: c9c42b0ec2c7b9b3e613f68db06230ebc6e2711c) Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
104 lines
3.7 KiB
BlitzBasic
104 lines
3.7 KiB
BlitzBasic
SUMMARY = "ISC Internet Domain Name Server"
|
|
HOMEPAGE = "http://www.isc.org/sw/bind/"
|
|
SECTION = "console/network"
|
|
|
|
LICENSE = "ISC & BSD"
|
|
LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=a3df5f651469919a0e6cb42f84fb6ff1"
|
|
|
|
DEPENDS = "openssl libcap"
|
|
|
|
SRC_URI = "ftp://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.gz \
|
|
file://conf.patch \
|
|
file://cross-build-fix.patch \
|
|
file://make-etc-initd-bind-stop-work.patch \
|
|
file://mips1-not-support-opcode.diff \
|
|
file://dont-test-on-host.patch \
|
|
file://generate-rndc-key.sh \
|
|
file://named.service \
|
|
file://bind9 \
|
|
file://init.d-add-support-for-read-only-rootfs.patch \
|
|
file://bind9_9_5-CVE-2014-8500.patch \
|
|
file://bind9_9_5-CVE-2015-5477.patch \
|
|
file://CVE-2015-1349.patch \
|
|
file://CVE-2015-4620.patch \
|
|
file://CVE-2015-5722.patch \
|
|
file://CVE-2015-8000.patch \
|
|
"
|
|
|
|
SRC_URI[md5sum] = "e676c65cad5234617ee22f48e328c24e"
|
|
SRC_URI[sha256sum] = "d4b64c1dde442145a316679acff2df4008aa117ae52dfa3a6bc69efecc7840d1"
|
|
|
|
# --enable-exportlib is necessary for building dhcp
|
|
ENABLE_IPV6 = "--enable-ipv6=${@bb.utils.contains('DISTRO_FEATURES', 'ipv6', 'yes', 'no', d)}"
|
|
EXTRA_OECONF = " ${ENABLE_IPV6} --with-randomdev=/dev/random --disable-threads \
|
|
--disable-devpoll --disable-epoll --with-gost=no \
|
|
--with-gssapi=no --with-ecdsa=yes \
|
|
--sysconfdir=${sysconfdir}/bind \
|
|
--with-openssl=${STAGING_LIBDIR}/.. --with-libxml2=${STAGING_LIBDIR}/.. \
|
|
--enable-exportlib --with-export-includedir=${includedir} --with-export-libdir=${libdir} \
|
|
"
|
|
inherit autotools-brokensep update-rc.d systemd useradd
|
|
|
|
USERADD_PACKAGES = "${PN}"
|
|
USERADD_PARAM_${PN} = "--system --home /var/cache/bind --no-create-home \
|
|
--user-group bind"
|
|
|
|
INITSCRIPT_NAME = "bind"
|
|
INITSCRIPT_PARAMS = "defaults"
|
|
|
|
SYSTEMD_SERVICE_${PN} = "named.service"
|
|
|
|
PARALLEL_MAKE = ""
|
|
|
|
RDEPENDS_${PN} = "python-core"
|
|
|
|
PACKAGE_BEFORE_PN += "${PN}-utils"
|
|
FILES_${PN}-utils = "${bindir}/host ${bindir}/dig"
|
|
FILES_${PN}-dev += "${bindir}/isc-config.h"
|
|
FILES_${PN} += "${sbindir}/generate-rndc-key.sh"
|
|
|
|
do_install_prepend() {
|
|
# clean host path in isc-config.sh before the hardlink created
|
|
# by "make install":
|
|
# bind9-config -> isc-config.sh
|
|
sed -i -e "s,${STAGING_LIBDIR},${libdir}," ${S}/isc-config.sh
|
|
}
|
|
|
|
do_install_append() {
|
|
rm "${D}${bindir}/nslookup"
|
|
rm "${D}${mandir}/man1/nslookup.1"
|
|
rmdir "${D}${localstatedir}/run"
|
|
rmdir --ignore-fail-on-non-empty "${D}${localstatedir}"
|
|
install -d "${D}${localstatedir}/cache/bind"
|
|
install -d "${D}${sysconfdir}/bind"
|
|
install -d "${D}${sysconfdir}/init.d"
|
|
install -m 644 ${S}/conf/* "${D}${sysconfdir}/bind/"
|
|
install -m 755 "${S}/init.d" "${D}${sysconfdir}/init.d/bind"
|
|
sed -i -e '1s,#!.*python,#! /usr/bin/env python,' ${D}${sbindir}/dnssec-coverage ${D}${sbindir}/dnssec-checkds
|
|
|
|
# Install systemd related files
|
|
install -d ${D}${localstatedir}/cache/bind
|
|
install -d ${D}${sbindir}
|
|
install -m 755 ${WORKDIR}/generate-rndc-key.sh ${D}${sbindir}
|
|
install -d ${D}${systemd_unitdir}/system
|
|
install -m 0644 ${WORKDIR}/named.service ${D}${systemd_unitdir}/system
|
|
sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \
|
|
-e 's,@SBINDIR@,${sbindir},g' \
|
|
${D}${systemd_unitdir}/system/named.service
|
|
|
|
install -d ${D}${sysconfdir}/default
|
|
install -m 0644 ${WORKDIR}/bind9 ${D}${sysconfdir}/default
|
|
}
|
|
|
|
CONFFILES_${PN} = " \
|
|
${sysconfdir}/bind/named.conf \
|
|
${sysconfdir}/bind/named.conf.local \
|
|
${sysconfdir}/bind/named.conf.options \
|
|
${sysconfdir}/bind/db.0 \
|
|
${sysconfdir}/bind/db.127 \
|
|
${sysconfdir}/bind/db.empty \
|
|
${sysconfdir}/bind/db.local \
|
|
${sysconfdir}/bind/db.root \
|
|
"
|
|
|