From b5d7143a464824953d181a54aab6c67873965f6e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 16 Nov 2023 17:05:24 +0100 Subject: [PATCH 1/8] Update to 9.19.18 (#2249833) https://downloads.isc.org/isc/bind9/9.19.18/doc/arm/html/notes.html#notes-for-bind-9-19-18 --- .gitignore | 2 ++ bind9-next.spec | 2 +- sources | 4 ++-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index acae600..145a6c0 100644 --- a/.gitignore +++ b/.gitignore @@ -214,3 +214,5 @@ bind-9.7.2b1.tar.gz /bind-9.19.16.tar.xz.asc /bind-9.19.17.tar.xz /bind-9.19.17.tar.xz.asc +/bind-9.19.18.tar.xz +/bind-9.19.18.tar.xz.asc diff --git a/bind9-next.spec b/bind9-next.spec index 4b0ea51..1d48d46 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -58,7 +58,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.19.17 +Version: 9.19.18 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index 5d6d0ef..c895e43 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.19.17.tar.xz) = 59e1d900594ad3730319a4e0707e31eb4ecafc47089a577241eb6f76028b30879c067517ce8e6b41847fb43feb3ece56bac0b73b1f9d4d156cb7452ba82e871e -SHA512 (bind-9.19.17.tar.xz.asc) = 1808e9897e6fda6185447578b8bece5d40afdf72f61737e890bcc89a4cf81a176c961f8d2cd8dc0e170735cadfee6503de0abc1d2233bfefdec0d2050164a76a +SHA512 (bind-9.19.18.tar.xz) = 8cb081b64a3dd0928ceb65c7d272f79f1fa3447a37d3796a11e0e278e2e9c72ece5fc12eb64f0c1ff328c65af94b563626220b9e117733fe707dd1e3d898a6db +SHA512 (bind-9.19.18.tar.xz.asc) = 39363d01fd9164c5c2b26d8c2bb7164883ed877ee272604f2f9e8072db6db4efa9d953cdaa6eedfba31428c8d2ef66a1565a5c26ce07b742051f5e7851eb6eb7 From 6eaef8126b9ef27f57eb40f8176e4525ede674e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 16 Nov 2023 17:58:35 +0100 Subject: [PATCH 2/8] Disable PDF building and enable epub inclusion Ship built epub ARM in doc subpackage. But disable latex pdf building, since it is not built anymore and does not even exist. --- bind9-next.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/bind9-next.spec b/bind9-next.spec index 1d48d46..feb58fd 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -24,7 +24,7 @@ # Current error: unable top find isc-logo.pdf %if 0%{?fedora} # RHEL and ELN do not have all required packages -%bcond_without DOCPDF +%bcond_with DOCPDF %endif %bcond_with TSAN %bcond_without DTRACE @@ -637,6 +637,7 @@ do ln -s "$DIR" "$BINDTHEMEDIR" fi done +cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir} %endif %if %{with DOCPDF} cp -p build/doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir} @@ -962,6 +963,7 @@ fi; %dir %{_pkgdocdir} %doc %{_pkgdocdir}/html %doc %{_pkgdocdir}/Bv9ARM.html +%doc %{_pkgdocdir}/Bv9ARM.epub %endif %if %{with DOCPDF} %doc %{_pkgdocdir}/Bv9ARM.pdf From d1d29058a626a0296fe77e854b7c1757d71c6cc5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 16 Nov 2023 18:14:51 +0100 Subject: [PATCH 3/8] Fully remove PDF building support Upstream has discontinued and remove support for local PDF building in commit 561a83a29182b00bda9237ae30343d76a68dcdf4. Just remove remaining bits, it is not likely to return. --- bind9-next.spec | 24 ------------------------ 1 file changed, 24 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index feb58fd..1c3d8ec 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -20,12 +20,6 @@ %bcond_without DNSTAP %bcond_without LMDB %bcond_without DOC -# Because of issues with PDF rebuild, include only HTML pages -# Current error: unable top find isc-logo.pdf -%if 0%{?fedora} -# RHEL and ELN do not have all required packages -%bcond_with DOCPDF -%endif %bcond_with TSAN %bcond_without DTRACE @@ -166,10 +160,6 @@ BuildRequires: fstrm-devel protobuf-c-devel BuildRequires: python3-sphinx python3-sphinx_rtd_theme BuildRequires: doxygen %endif -%if %{with DOCPDF} -# Because remaining issues with COPR, allow turning off PDF (re)generation -BuildRequires: python3-sphinx-latex latexmk texlive-xetex texlive-xindy -%endif %if %{with TSAN} BuildRequires: libtsan %endif @@ -426,14 +416,6 @@ export LIBDIR_SUFFIX popd %endif -%if %{with DOCPDF} -# avoid using home for pdf latex files -export TEXMFVAR="`pwd`" -export TEXMFCONFIG="`pwd`" -fmtutil-user --listcfg || : -fmtutil-user --missing || : -%endif - %make_build SPHINX_W='' %if %{with DOC} @@ -639,9 +621,6 @@ do done cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir} %endif -%if %{with DOCPDF} -cp -p build/doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir} -%endif # Ghost config files: touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log @@ -965,9 +944,6 @@ fi; %doc %{_pkgdocdir}/Bv9ARM.html %doc %{_pkgdocdir}/Bv9ARM.epub %endif -%if %{with DOCPDF} -%doc %{_pkgdocdir}/Bv9ARM.pdf -%endif %changelog %autochangelog From c1c7621d7157fd40828e84e8ed386d577cd66341 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 15 Jan 2024 18:46:50 +0100 Subject: [PATCH 4/8] Update to 9.19.19 (#2255406) https://downloads.isc.org/isc/bind9/9.19.19/doc/arm/html/notes.html#notes-for-bind-9-19-19 New Features - Initial support for the PROXYv2 protocol was added. named can now accept PROXYv2 headers over all currently implemented DNS transports and dig can insert these headers into the queries it sends. Please consult the related documentation (allow-proxy, allow-proxy-on, listen-on, and listen-on-v6 for named, dig +proxy and dig +proxy-plain for dig) for additional details. [GL #4388] Removed Features - Support for using AES as the DNS COOKIE algorithm (cookie-algorithm aes;) has been removed. The only supported DNS COOKIE algorithm is now the current default, SipHash-2-4. [GL #4421] - The resolver-nonbackoff-tries and resolver-retry-interval statements have been removed. Using them is now a fatal error. [GL #4405] Feature Changes - The maximum number of NSEC3 iterations allowed for validation purposes has been lowered from 150 to 50. DNSSEC responses containing NSEC3 records with iteration counts greater than 50 are now treated as insecure. [GL #4363] - Following RFC 9276 recommendations, dnssec-policy now only allows an NSEC3 iteration count of 0 for the DNSSEC-signed zones using NSEC3 that the policy manages. [GL #4363] --- .gitignore | 2 ++ bind9-next.spec | 2 +- sources | 4 ++-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 145a6c0..7908c20 100644 --- a/.gitignore +++ b/.gitignore @@ -216,3 +216,5 @@ bind-9.7.2b1.tar.gz /bind-9.19.17.tar.xz.asc /bind-9.19.18.tar.xz /bind-9.19.18.tar.xz.asc +/bind-9.19.19.tar.xz +/bind-9.19.19.tar.xz.asc diff --git a/bind9-next.spec b/bind9-next.spec index 1c3d8ec..f9697e5 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -52,7 +52,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.19.18 +Version: 9.19.19 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index c895e43..0bd72f0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.19.18.tar.xz) = 8cb081b64a3dd0928ceb65c7d272f79f1fa3447a37d3796a11e0e278e2e9c72ece5fc12eb64f0c1ff328c65af94b563626220b9e117733fe707dd1e3d898a6db -SHA512 (bind-9.19.18.tar.xz.asc) = 39363d01fd9164c5c2b26d8c2bb7164883ed877ee272604f2f9e8072db6db4efa9d953cdaa6eedfba31428c8d2ef66a1565a5c26ce07b742051f5e7851eb6eb7 +SHA512 (bind-9.19.19.tar.xz) = 51ce55bade3a9b239d0ab21d19a0870b91aba1e4c93050f89f1940d322319521631b3b0389eaf5f03e3fc110852e11549365b0efa92536bf5d835510d73c1aa6 +SHA512 (bind-9.19.19.tar.xz.asc) = 3217a33be6a885bb42ca972e57c21bfe3000b7cfeaede72aa302750ce9643d4820372f4b147e85ce97409bbc500b40d9b8bc82c12fb13c5c0a2d21fad86712f8 From 06cb24cfdce2b24b2e0ff6d04deeaaadc7cf526d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 15 Jan 2024 18:51:38 +0100 Subject: [PATCH 5/8] Remove i686 compatibility changes It should now work with upstream changes included, thanks to: https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8516 --- bind-9.19-rbtdb-i686.patch | 178 --------------------------- bind-9.19-tests-dns-rbtdb-i386.patch | 50 -------- bind9-next.spec | 3 - 3 files changed, 231 deletions(-) delete mode 100644 bind-9.19-rbtdb-i686.patch delete mode 100644 bind-9.19-tests-dns-rbtdb-i386.patch diff --git a/bind-9.19-rbtdb-i686.patch b/bind-9.19-rbtdb-i686.patch deleted file mode 100644 index 4128eee..0000000 --- a/bind-9.19-rbtdb-i686.patch +++ /dev/null @@ -1,178 +0,0 @@ -From 0a423df93aa9b4a6391c0483518f2b2961b547e1 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Wed, 13 Sep 2023 15:37:57 +0200 -Subject: [PATCH] Try to release cache size of complete slab - -node used to store new header might be significantly bigger that -expired node from the cache. Count into freed size also node size used -to hold the cache. Mark it released only if it is the last reference. ---- - lib/dns/include/dns/rbt.h | 5 +++++ - lib/dns/rbt-cachedb.c | 34 ++++++++++++++++++---------------- - lib/dns/rbt.c | 5 +++++ - lib/dns/rbtdb.c | 2 +- - lib/dns/rbtdb_p.h | 3 ++- - 5 files changed, 31 insertions(+), 18 deletions(-) - -diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h -index 08b4803ab99..79ab496842d 100644 ---- a/lib/dns/include/dns/rbt.h -+++ b/lib/dns/include/dns/rbt.h -@@ -778,6 +778,11 @@ dns__rbtnode_getdistance(dns_rbtnode_t *node); - * has a distance of 2. - */ - -+size_t -+dns__rbtnode_getsize(dns_rbtnode_t *node); -+/*%< -+ * Return allocated size for a node. -+ */ - /***** - ***** Chain Functions - *****/ -diff --git a/lib/dns/rbt-cachedb.c b/lib/dns/rbt-cachedb.c -index d57eb2a6cc7..db3c09c9323 100644 ---- a/lib/dns/rbt-cachedb.c -+++ b/lib/dns/rbt-cachedb.c -@@ -1534,7 +1534,7 @@ expiredata(dns_db_t *db, dns_dbnode_t *node, void *data) { - isc_rwlocktype_t tlocktype = isc_rwlocktype_none; - - NODE_WRLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype); -- dns__cachedb_expireheader(header, &tlocktype, -+ (void)dns__cachedb_expireheader(header, &tlocktype, - dns_expire_flush DNS__DB_FLARG_PASS); - NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype); - INSIST(tlocktype == isc_rwlocktype_none); -@@ -1573,13 +1573,24 @@ dns_dbmethods_t dns__rbtdb_cachemethods = { - .deletedata = dns__rbtdb_deletedata, - }; - -+static size_t -+rdataset_size(dns_slabheader_t *header) { -+ if (!NONEXISTENT(header)) { -+ return (dns_rdataslab_size((unsigned char *)header, -+ sizeof(*header))); -+ } -+ -+ return (sizeof(*header)); -+} -+ - /* - * Caller must hold the node (write) lock. - */ --void -+size_t - dns__cachedb_expireheader(dns_slabheader_t *header, - isc_rwlocktype_t *tlocktypep, - dns_expire_t reason DNS__DB_FLARG) { -+ size_t freed = rdataset_size(header); - dns__rbtdb_setttl(header, 0); - dns__rbtdb_mark(header, DNS_SLABHEADERATTR_ANCIENT); - HEADER_NODE(header)->dirty = 1; -@@ -1593,13 +1604,14 @@ dns__cachedb_expireheader(dns_slabheader_t *header, - * We first need to gain a new reference to the node to meet a - * requirement of dns__rbtdb_decref(). - */ -+ freed += dns__rbtnode_getsize(HEADER_NODE(header)); - dns__rbtdb_newref(rbtdb, HEADER_NODE(header), - nlocktype DNS__DB_FLARG_PASS); - dns__rbtdb_decref(rbtdb, HEADER_NODE(header), 0, &nlocktype, - tlocktypep, true, false DNS__DB_FLARG_PASS); - - if (rbtdb->cachestats == NULL) { -- return; -+ return freed; - } - - switch (reason) { -@@ -1615,16 +1627,7 @@ dns__cachedb_expireheader(dns_slabheader_t *header, - break; - } - } --} -- --static size_t --rdataset_size(dns_slabheader_t *header) { -- if (!NONEXISTENT(header)) { -- return (dns_rdataslab_size((unsigned char *)header, -- sizeof(*header))); -- } -- -- return (sizeof(*header)); -+ return freed; - } - - static size_t -@@ -1637,7 +1640,6 @@ expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, - for (header = ISC_LIST_TAIL(rbtdb->lru[locknum]); - header != NULL && purged <= purgesize; header = header_prev) - { -- size_t header_size = rdataset_size(header); - header_prev = ISC_LIST_PREV(header, link); - - /* -@@ -1648,9 +1650,8 @@ expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, - * TTL was reset to 0. - */ - ISC_LIST_UNLINK(rbtdb->lru[locknum], header, link); -- dns__cachedb_expireheader(header, tlocktypep, -+ purged += dns__cachedb_expireheader(header, tlocktypep, - dns_expire_lru DNS__DB_FLARG_PASS); -- purged += header_size; - } - - return (purged); -@@ -1676,6 +1677,7 @@ dns__cachedb_overmem(dns_rbtdb_t *rbtdb, dns_slabheader_t *newheader, - unsigned int locknum; - size_t purgesize = rdataset_size(newheader); - size_t purged = 0; -+ purgesize += dns__rbtnode_getsize(HEADER_NODE(newheader)); - - for (locknum = (locknum_start + 1) % rbtdb->node_lock_count; - locknum != locknum_start && purged <= purgesize; -diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c -index 32e1c2cc3d4..fc47be84444 100644 ---- a/lib/dns/rbt.c -+++ b/lib/dns/rbt.c -@@ -176,6 +176,11 @@ dns__rbtnode_getdistance(dns_rbtnode_t *node) { - return (nodes); - } - -+size_t -+dns__rbtnode_getsize(dns_rbtnode_t *node) { -+ return (NODE_SIZE(node)); -+} -+ - /* - * Forward declarations. - */ -diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c -index 78464170b06..344dd17bf42 100644 ---- a/lib/dns/rbtdb.c -+++ b/lib/dns/rbtdb.c -@@ -3286,7 +3286,7 @@ dns__rbtdb_addrdataset(dns_db_t *db, dns_dbnode_t *node, - if (header != NULL && header->ttl + STALE_TTL(header, rbtdb) < - now - RBTDB_VIRTUAL) - { -- dns__cachedb_expireheader( -+ (void)dns__cachedb_expireheader( - header, &tlocktype, - dns_expire_ttl DNS__DB_FLARG_PASS); - } -diff --git a/lib/dns/rbtdb_p.h b/lib/dns/rbtdb_p.h -index ddc98fe7f2e..f9c711a966c 100644 ---- a/lib/dns/rbtdb_p.h -+++ b/lib/dns/rbtdb_p.h -@@ -601,7 +601,8 @@ dns__zonedb_addwildcards(dns_rbtdb_t *rbtdb, const dns_name_t *name, bool lock); - /* - * Cache-specific functions that are called from rbtdb.c - */ --void -+/* Returns number of released bytes. */ -+size_t - dns__cachedb_expireheader(dns_slabheader_t *header, - isc_rwlocktype_t *tlocktypep, - dns_expire_t reason DNS__DB_FLARG); --- -2.41.0 - diff --git a/bind-9.19-tests-dns-rbtdb-i386.patch b/bind-9.19-tests-dns-rbtdb-i386.patch deleted file mode 100644 index 03f6fe4..0000000 --- a/bind-9.19-tests-dns-rbtdb-i386.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 2514f8d77d52da0e95af4256f9ae9905b890e69e Mon Sep 17 00:00:00 2001 -From: Petr Mensik -Date: Wed, 6 Sep 2023 20:20:53 +0200 -Subject: [PATCH] Use range to show value for rbtdb overmempurge_ tests - -overmempurge_longname is failing reliably on i686 builds. If that -happens, make displaying failing values part of the output. - -FIXME: Includes debug tests ---- - tests/dns/rbtdb_test.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - -diff --git a/tests/dns/rbtdb_test.c b/tests/dns/rbtdb_test.c -index 6f2ab3c..f1046b9 100644 ---- a/tests/dns/rbtdb_test.c -+++ b/tests/dns/rbtdb_test.c -@@ -328,7 +328,7 @@ ISC_RUN_TEST_IMPL(overmempurge_bigrdata) { - */ - while (i-- > 0) { - overmempurge_addrdataset(db, now, i, 50054, 65535, false); -- assert_true(isc_mem_inuse(mctx2) < maxcache); -+ assert_in_range(isc_mem_inuse(mctx2), 0, maxcache-1); - } - - dns_db_detach(&db); -@@ -360,6 +360,8 @@ ISC_RUN_TEST_IMPL(overmempurge_longname) { - * iteration to avoid an infinite loop in case something gets wrong. - */ - for (i = 0; !isc_mem_isovermem(mctx2) && i < (maxcache / 10); i++) { -+ printf("Mem in use #%zu: %zu\n", i, isc_mem_inuse(mctx2)); -+ assert_in_range(isc_mem_inuse(mctx2), 0, maxcache-1); - overmempurge_addrdataset(db, now, i, 50053, 0, false); - } - assert_true(isc_mem_isovermem(mctx2)); -@@ -371,8 +373,10 @@ ISC_RUN_TEST_IMPL(overmempurge_longname) { - * size doesn't reach the "max". - */ - while (i-- > 0) { -+ printf("Mem in use before #%zu: %zu\n", i, isc_mem_inuse(mctx2)); - overmempurge_addrdataset(db, now, i, 50054, 0, true); -- assert_true(isc_mem_inuse(mctx2) < maxcache); -+ printf("Mem in use after #%zu: %zu\n", i, isc_mem_inuse(mctx2)); -+ assert_in_range(isc_mem_inuse(mctx2), 0, maxcache-1); - } - - dns_db_detach(&db); --- -2.41.0 - diff --git a/bind9-next.spec b/bind9-next.spec index f9697e5..666db68 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -88,9 +88,6 @@ Source49: named-chroot.files # Common patches # Red Hat specific documentation is not relevant to upstream Patch1: bind-9.16-redhat_doc.patch -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8285 -Patch2: bind-9.19-tests-dns-rbtdb-i386.patch -Patch3: bind-9.19-rbtdb-i686.patch %{?systemd_ordering} Requires: coreutils From f17a7993348b373cbd3ff853b2928759c23d7ece Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 16 Jan 2024 11:18:43 +0100 Subject: [PATCH 6/8] Update changed b.root-servers.net address in hints (#2253463) --- named.root | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/named.root b/named.root index cd808e8..8b8a3b1 100644 --- a/named.root +++ b/named.root @@ -8,9 +8,9 @@ ; file /domain/named.cache ; on server FTP.INTERNIC.NET ; -OR- RS.INTERNIC.NET -; -; last update: June 24, 2021 -; related version of root zone: 2021062401 +; +; last update: December 20, 2023 +; related version of root zone: 2023122001 ; ; FORMERLY NS.INTERNIC.NET ; @@ -21,8 +21,8 @@ A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:ba3e::2:30 ; FORMERLY NS1.ISI.EDU ; . 3600000 NS B.ROOT-SERVERS.NET. -B.ROOT-SERVERS.NET. 3600000 A 199.9.14.201 -B.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:200::b +B.ROOT-SERVERS.NET. 3600000 A 170.247.170.2 +B.ROOT-SERVERS.NET. 3600000 AAAA 2801:1b8:10::b ; ; FORMERLY C.PSI.NET ; From 46841be61182ca8f81b1529c00cf0772fcaac81f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 16 Feb 2024 22:21:11 +0100 Subject: [PATCH 7/8] Update to 9.19.21 (#2264048) https://downloads.isc.org/isc/bind9/9.19.21/RELEASE-NOTES-bind-9.19.21.html Security Fixes - Validating DNS messages containing a lot of DNSSEC signatures could cause excessive CPU load, leading to a denial-of-service condition. This has been fixed. (CVE-2023-50387) ISC would like to thank Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner from the German National Research Center for Applied Cybersecurity ATHENE for bringing this vulnerability to our attention. [GL #4424] - Parsing DNS messages with many different names could cause excessive CPU load. This has been fixed. (CVE-2023-4408) ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr from Tel-Aviv University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt from Tel-Aviv University for bringing this vulnerability to our attention. [GL #4234] - Specific queries could cause named to crash with an assertion failure when nxdomain-redirect was enabled. This has been fixed. (CVE-2023-5517) [GL #4281] - A bad interaction between DNS64 and serve-stale could cause named to crash with an assertion failure, when both of these features were enabled. This has been fixed. (CVE-2023-5679) [GL #4334] Resolves: CVE-2023-50387 CVE-2023-4408 CVE-2023-5517 CVE-2023-5679 --- .gitignore | 2 ++ bind9-next.spec | 2 +- sources | 4 ++-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 7908c20..76f5ce8 100644 --- a/.gitignore +++ b/.gitignore @@ -218,3 +218,5 @@ bind-9.7.2b1.tar.gz /bind-9.19.18.tar.xz.asc /bind-9.19.19.tar.xz /bind-9.19.19.tar.xz.asc +/bind-9.19.21.tar.xz +/bind-9.19.21.tar.xz.asc diff --git a/bind9-next.spec b/bind9-next.spec index 666db68..20f6bb3 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -52,7 +52,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.19.19 +Version: 9.19.21 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index 0bd72f0..b02d3ed 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.19.19.tar.xz) = 51ce55bade3a9b239d0ab21d19a0870b91aba1e4c93050f89f1940d322319521631b3b0389eaf5f03e3fc110852e11549365b0efa92536bf5d835510d73c1aa6 -SHA512 (bind-9.19.19.tar.xz.asc) = 3217a33be6a885bb42ca972e57c21bfe3000b7cfeaede72aa302750ce9643d4820372f4b147e85ce97409bbc500b40d9b8bc82c12fb13c5c0a2d21fad86712f8 +SHA512 (bind-9.19.21.tar.xz) = 8a5bae4619b0093f5c81376b65a143499d4942c7624ecd7770d62244d88d5a695c1edede59b5f06665fae8bef784f774b144822ac541ebe826d1b267f7c40236 +SHA512 (bind-9.19.21.tar.xz.asc) = 4cb12493197be5ff81bf76b6f0c5adb4369248beccbf3bb33d3d16e29082e7e6f8d761db8ae8f1c6754149434ff35a9e8cca80abc2aab63bfb059b023a34a215 From 7ffdde8fe18003d3d0604b4d71d4ad31079c9b6f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 15 Apr 2024 20:53:49 +0200 Subject: [PATCH 8/8] Update to 9.19.22 (rhbz#2270475) https://downloads.isc.org/isc/bind9/9.19.22/doc/arm/html/notes.html#notes-for-bind-9-19-22 --- .gitignore | 2 ++ bind9-next.spec | 2 +- sources | 4 ++-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 76f5ce8..306ff81 100644 --- a/.gitignore +++ b/.gitignore @@ -220,3 +220,5 @@ bind-9.7.2b1.tar.gz /bind-9.19.19.tar.xz.asc /bind-9.19.21.tar.xz /bind-9.19.21.tar.xz.asc +/bind-9.19.22.tar.xz +/bind-9.19.22.tar.xz.asc diff --git a/bind9-next.spec b/bind9-next.spec index 20f6bb3..3ba9159 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -52,7 +52,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.19.21 +Version: 9.19.22 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index b02d3ed..8aad670 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.19.21.tar.xz) = 8a5bae4619b0093f5c81376b65a143499d4942c7624ecd7770d62244d88d5a695c1edede59b5f06665fae8bef784f774b144822ac541ebe826d1b267f7c40236 -SHA512 (bind-9.19.21.tar.xz.asc) = 4cb12493197be5ff81bf76b6f0c5adb4369248beccbf3bb33d3d16e29082e7e6f8d761db8ae8f1c6754149434ff35a9e8cca80abc2aab63bfb059b023a34a215 +SHA512 (bind-9.19.22.tar.xz) = 609f73ab7e34e9ef0e5854a0bf150009c1ae34615c5f8c7fecf0352ea65ce0d92fecc02b918a0b3b90b3c303dad659e4981a97b1413d02724b20a5ed2d1d905f +SHA512 (bind-9.19.22.tar.xz.asc) = 4839365da593ab6b924372019bbb8b8212856116c563e4f9b6d0b03681234fb855b7f3c85766919fac400be7508f7b72bc9d2a3d8496ce9ee21c6b5fb4369cf3