mirror of
https://git.yoctoproject.org/poky
synced 2026-07-16 15:57:04 +00:00
Sona Sarmadi
a8ff4c8f42
CVE-2016-1285 bind: malformed packet sent to rndc can trigger assertion failure CVE-2016-1286 bind: malformed signature records for DNAME records can trigger assertion failure [YOCTO #9400] External References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1285 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1286 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1285 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1286 References to the Upstream commits and Security Advisories: CVE-2016-1285: https://kb.isc.org/article/AA-01352 https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch; h=31e4657cf246e41d4c5c890315cb6cf89a0db25a CVE-2016-1286_1: https://kb.isc.org/article/AA-01353 https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch; h=76c3c9fe9f3f1353b47214b8f98b3d7f53e10bc7 CVE-2016-1286_2: https://kb.isc.org/article/AA-01353 https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch; h=ce3cd91caee698cb144e1350c6c78292c6be6339 (From OE-Core rev: e289df4daa4b90fb95ae3602c244cba9d56a8c2f) Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Tudor Florea <tudor.florea@enea.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
117 lines
4.2 KiB
BlitzBasic
117 lines
4.2 KiB
BlitzBasic
SUMMARY = "ISC Internet Domain Name Server"
|
|
HOMEPAGE = "http://www.isc.org/sw/bind/"
|
|
SECTION = "console/network"
|
|
|
|
LICENSE = "ISC & BSD"
|
|
LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=a3df5f651469919a0e6cb42f84fb6ff1"
|
|
|
|
DEPENDS = "openssl libcap"
|
|
|
|
SRC_URI = "ftp://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.gz \
|
|
file://conf.patch \
|
|
file://cross-build-fix.patch \
|
|
file://make-etc-initd-bind-stop-work.patch \
|
|
file://mips1-not-support-opcode.diff \
|
|
file://dont-test-on-host.patch \
|
|
file://generate-rndc-key.sh \
|
|
file://named.service \
|
|
file://bind9 \
|
|
file://init.d-add-support-for-read-only-rootfs.patch \
|
|
file://bind9_9_5-CVE-2014-8500.patch \
|
|
file://bind-add-crosscripts-search-path-for-xml2-config.patch \
|
|
file://bind-subdirs-run-serially.patch \
|
|
file://bind-confgen-build-unix.o-once.patch \
|
|
file://cve-2015-5477.patch \
|
|
file://CVE-2015-1349.patch \
|
|
file://CVE-2015-4620.patch \
|
|
file://CVE-2015-5722.patch \
|
|
file://CVE-2015-8000.patch \
|
|
file://CVE-2015-8704.patch \
|
|
file://CVE-2015-8461.patch \
|
|
file://CVE-2016-1285.patch \
|
|
file://fix-typo-in-CVE-2016-1285.patch \
|
|
file://CVE-2016-1286_1.patch \
|
|
file://CVE-2016-1286_2.patch \
|
|
"
|
|
|
|
SRC_URI[md5sum] = "e676c65cad5234617ee22f48e328c24e"
|
|
SRC_URI[sha256sum] = "d4b64c1dde442145a316679acff2df4008aa117ae52dfa3a6bc69efecc7840d1"
|
|
|
|
# --enable-exportlib is necessary for building dhcp
|
|
ENABLE_IPV6 = "--enable-ipv6=${@bb.utils.contains('DISTRO_FEATURES', 'ipv6', 'yes', 'no', d)}"
|
|
EXTRA_OECONF = " ${ENABLE_IPV6} --with-randomdev=/dev/random --disable-threads \
|
|
--disable-devpoll --disable-epoll --with-gost=no \
|
|
--with-gssapi=no --with-ecdsa=yes \
|
|
--sysconfdir=${sysconfdir}/bind \
|
|
--with-openssl=${STAGING_LIBDIR}/.. \
|
|
--enable-exportlib --with-export-includedir=${includedir} --with-export-libdir=${libdir} \
|
|
"
|
|
inherit autotools-brokensep update-rc.d systemd useradd pkgconfig
|
|
|
|
PACKAGECONFIG ?= "libxml2"
|
|
|
|
PACKAGECONFIG[libxml2] = "--with-libxml2=${STAGING_LIBDIR}/..,--with-libxml2=no,libxml2"
|
|
|
|
USERADD_PACKAGES = "${PN}"
|
|
USERADD_PARAM_${PN} = "--system --home /var/cache/bind --no-create-home \
|
|
--user-group bind"
|
|
|
|
INITSCRIPT_NAME = "bind"
|
|
INITSCRIPT_PARAMS = "defaults"
|
|
|
|
SYSTEMD_SERVICE_${PN} = "named.service"
|
|
|
|
PARALLEL_MAKE = ""
|
|
|
|
RDEPENDS_${PN} = "python-core"
|
|
|
|
PACKAGE_BEFORE_PN += "${PN}-utils"
|
|
FILES_${PN}-utils = "${bindir}/host ${bindir}/dig"
|
|
FILES_${PN}-dev += "${bindir}/isc-config.h"
|
|
FILES_${PN} += "${sbindir}/generate-rndc-key.sh"
|
|
|
|
do_install_prepend() {
|
|
# clean host path in isc-config.sh before the hardlink created
|
|
# by "make install":
|
|
# bind9-config -> isc-config.sh
|
|
sed -i -e "s,${STAGING_LIBDIR},${libdir}," ${S}/isc-config.sh
|
|
}
|
|
|
|
do_install_append() {
|
|
rm "${D}${bindir}/nslookup"
|
|
rm "${D}${mandir}/man1/nslookup.1"
|
|
rmdir "${D}${localstatedir}/run"
|
|
rmdir --ignore-fail-on-non-empty "${D}${localstatedir}"
|
|
install -d "${D}${localstatedir}/cache/bind"
|
|
install -d "${D}${sysconfdir}/bind"
|
|
install -d "${D}${sysconfdir}/init.d"
|
|
install -m 644 ${S}/conf/* "${D}${sysconfdir}/bind/"
|
|
install -m 755 "${S}/init.d" "${D}${sysconfdir}/init.d/bind"
|
|
sed -i -e '1s,#!.*python,#! /usr/bin/env python,' ${D}${sbindir}/dnssec-coverage ${D}${sbindir}/dnssec-checkds
|
|
|
|
# Install systemd related files
|
|
install -d ${D}${localstatedir}/cache/bind
|
|
install -d ${D}${sbindir}
|
|
install -m 755 ${WORKDIR}/generate-rndc-key.sh ${D}${sbindir}
|
|
install -d ${D}${systemd_unitdir}/system
|
|
install -m 0644 ${WORKDIR}/named.service ${D}${systemd_unitdir}/system
|
|
sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \
|
|
-e 's,@SBINDIR@,${sbindir},g' \
|
|
${D}${systemd_unitdir}/system/named.service
|
|
|
|
install -d ${D}${sysconfdir}/default
|
|
install -m 0644 ${WORKDIR}/bind9 ${D}${sysconfdir}/default
|
|
}
|
|
|
|
CONFFILES_${PN} = " \
|
|
${sysconfdir}/bind/named.conf \
|
|
${sysconfdir}/bind/named.conf.local \
|
|
${sysconfdir}/bind/named.conf.options \
|
|
${sysconfdir}/bind/db.0 \
|
|
${sysconfdir}/bind/db.127 \
|
|
${sysconfdir}/bind/db.empty \
|
|
${sysconfdir}/bind/db.local \
|
|
${sysconfdir}/bind/db.root \
|
|
"
|
|
|