mirror of
git://git.yoctoproject.org/poky
synced 2026-10-02 16:42:04 +00:00
58f6a400d1
Fixes a denial of service in BIND. An error in the parsing of incoming responses allows some records with an incorrect class to be accepted by BIND instead of being rejected as malformed. This can trigger a REQUIRE assertion failure when those records are subsequently cached. [YOCTO #8838] References: http://www.openwall.com/lists/oss-security/2015/12/15/14 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8000 https://bugzilla.redhat.com/attachment.cgi?id=1105581 (From OE-Core rev: 5e1c3942a02564904ee2b2e24004b9679d649b4e) Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Joshua Lock <joshua.lock@collabora.co.uk> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
111 lines
4.0 KiB
BlitzBasic
111 lines
4.0 KiB
BlitzBasic
SUMMARY = "ISC Internet Domain Name Server"
|
|
HOMEPAGE = "http://www.isc.org/sw/bind/"
|
|
SECTION = "console/network"
|
|
|
|
LICENSE = "ISC & BSD"
|
|
LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=a3df5f651469919a0e6cb42f84fb6ff1"
|
|
|
|
DEPENDS = "openssl libcap"
|
|
|
|
SRC_URI = "ftp://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.gz \
|
|
file://conf.patch \
|
|
file://cross-build-fix.patch \
|
|
file://make-etc-initd-bind-stop-work.patch \
|
|
file://mips1-not-support-opcode.diff \
|
|
file://dont-test-on-host.patch \
|
|
file://generate-rndc-key.sh \
|
|
file://named.service \
|
|
file://bind9 \
|
|
file://init.d-add-support-for-read-only-rootfs.patch \
|
|
file://bind9_9_5-CVE-2014-8500.patch \
|
|
file://bind-add-crosscripts-search-path-for-xml2-config.patch \
|
|
file://bind-subdirs-run-serially.patch \
|
|
file://bind-confgen-build-unix.o-once.patch \
|
|
file://cve-2015-5477.patch \
|
|
file://CVE-2015-1349.patch \
|
|
file://CVE-2015-4620.patch \
|
|
file://CVE-2015-5722.patch \
|
|
file://CVE-2015-8000.patch \
|
|
"
|
|
|
|
SRC_URI[md5sum] = "e676c65cad5234617ee22f48e328c24e"
|
|
SRC_URI[sha256sum] = "d4b64c1dde442145a316679acff2df4008aa117ae52dfa3a6bc69efecc7840d1"
|
|
|
|
# --enable-exportlib is necessary for building dhcp
|
|
ENABLE_IPV6 = "--enable-ipv6=${@bb.utils.contains('DISTRO_FEATURES', 'ipv6', 'yes', 'no', d)}"
|
|
EXTRA_OECONF = " ${ENABLE_IPV6} --with-randomdev=/dev/random --disable-threads \
|
|
--disable-devpoll --disable-epoll --with-gost=no \
|
|
--with-gssapi=no --with-ecdsa=yes \
|
|
--sysconfdir=${sysconfdir}/bind \
|
|
--with-openssl=${STAGING_LIBDIR}/.. \
|
|
--enable-exportlib --with-export-includedir=${includedir} --with-export-libdir=${libdir} \
|
|
"
|
|
inherit autotools-brokensep update-rc.d systemd useradd pkgconfig
|
|
|
|
PACKAGECONFIG ?= "libxml2"
|
|
|
|
PACKAGECONFIG[libxml2] = "--with-libxml2=${STAGING_LIBDIR}/..,--with-libxml2=no,libxml2"
|
|
|
|
USERADD_PACKAGES = "${PN}"
|
|
USERADD_PARAM_${PN} = "--system --home /var/cache/bind --no-create-home \
|
|
--user-group bind"
|
|
|
|
INITSCRIPT_NAME = "bind"
|
|
INITSCRIPT_PARAMS = "defaults"
|
|
|
|
SYSTEMD_SERVICE_${PN} = "named.service"
|
|
|
|
PARALLEL_MAKE = ""
|
|
|
|
RDEPENDS_${PN} = "python-core"
|
|
|
|
PACKAGE_BEFORE_PN += "${PN}-utils"
|
|
FILES_${PN}-utils = "${bindir}/host ${bindir}/dig"
|
|
FILES_${PN}-dev += "${bindir}/isc-config.h"
|
|
FILES_${PN} += "${sbindir}/generate-rndc-key.sh"
|
|
|
|
do_install_prepend() {
|
|
# clean host path in isc-config.sh before the hardlink created
|
|
# by "make install":
|
|
# bind9-config -> isc-config.sh
|
|
sed -i -e "s,${STAGING_LIBDIR},${libdir}," ${S}/isc-config.sh
|
|
}
|
|
|
|
do_install_append() {
|
|
rm "${D}${bindir}/nslookup"
|
|
rm "${D}${mandir}/man1/nslookup.1"
|
|
rmdir "${D}${localstatedir}/run"
|
|
rmdir --ignore-fail-on-non-empty "${D}${localstatedir}"
|
|
install -d "${D}${localstatedir}/cache/bind"
|
|
install -d "${D}${sysconfdir}/bind"
|
|
install -d "${D}${sysconfdir}/init.d"
|
|
install -m 644 ${S}/conf/* "${D}${sysconfdir}/bind/"
|
|
install -m 755 "${S}/init.d" "${D}${sysconfdir}/init.d/bind"
|
|
sed -i -e '1s,#!.*python,#! /usr/bin/env python,' ${D}${sbindir}/dnssec-coverage ${D}${sbindir}/dnssec-checkds
|
|
|
|
# Install systemd related files
|
|
install -d ${D}${localstatedir}/cache/bind
|
|
install -d ${D}${sbindir}
|
|
install -m 755 ${WORKDIR}/generate-rndc-key.sh ${D}${sbindir}
|
|
install -d ${D}${systemd_unitdir}/system
|
|
install -m 0644 ${WORKDIR}/named.service ${D}${systemd_unitdir}/system
|
|
sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \
|
|
-e 's,@SBINDIR@,${sbindir},g' \
|
|
${D}${systemd_unitdir}/system/named.service
|
|
|
|
install -d ${D}${sysconfdir}/default
|
|
install -m 0644 ${WORKDIR}/bind9 ${D}${sysconfdir}/default
|
|
}
|
|
|
|
CONFFILES_${PN} = " \
|
|
${sysconfdir}/bind/named.conf \
|
|
${sysconfdir}/bind/named.conf.local \
|
|
${sysconfdir}/bind/named.conf.options \
|
|
${sysconfdir}/bind/db.0 \
|
|
${sysconfdir}/bind/db.127 \
|
|
${sysconfdir}/bind/db.empty \
|
|
${sysconfdir}/bind/db.local \
|
|
${sysconfdir}/bind/db.root \
|
|
"
|
|
|