Commit Graph

762 Commits

Author SHA1 Message Date
Petr Menšík
43f4de9bf3 Include more Thread Sanitizer changes
Fix as much race conditions as possible.
2019-12-19 19:38:56 +01:00
Petr Menšík
23657868e6 Update to 9.11.14
Includes ThreadSanitizer fixes already included as downstream patches.
Adjusts serve-stale patch, one new statistics.
2019-12-19 18:43:23 +01:00
Petr Menšík
9406a85e89 Fix dnf builddep when python3-devel is not installed
Build requirements fetch fail on clean system with just basic utils.
2019-12-19 18:42:50 +01:00
Petr Menšík
d5106d287e Add one more candidate for issue fixing
Imported from upstream commit 6eed12605154b8ce10e9be0f51253e6ec318550e
2019-12-19 18:42:47 +01:00
Petr Menšík
9cfd91a473 Add ThreadSanitizer support
Has to be enabled in build by --with TSAN.
Would make build fail unit tests and print many warnings about possible
race conditions. Not useful for production build, but useful for
debugging thread related problems in system tests.
2019-12-04 17:57:12 +01:00
Petr Menšík
ccf1b03734 Disable Berkeley DB support (#1779190)
Allow enabling it by build --with BDB, but keep it disabled by default.
2019-12-03 19:05:53 +01:00
Petr Menšík
c44ebdeade Bump spec for bug #1736762 2019-12-02 20:35:43 +01:00
Petr Menšík
1a4de8b956 Backport a few upstream thread safety fixes
It might not fix all issues, but was detected by upstream using
automated tool. Should not break anything new, but might fix issue
triggered usually on ppc64le platform.
2019-12-02 20:34:08 +01:00
Petr Menšík
6f27f8e4a7 Complete explicit disabling of RSAMD5 in FIPS mode (#1709553)
Previous fix included just part inside named. However, checking part
would check algorithm support also in check library. The code is almost
the same. Permit already disabled algoritms also in libbind9.

Use the same change as RHEL.
2019-11-26 19:37:29 +01:00
Petr Menšík
adcfd20cb2 Remove tabs from spec
rpmlint complains about mixed spaces and tabs. Set vim mode and remove
tabs added by recent commit.
2019-11-25 21:32:36 +01:00
Petr Menšík
547656b469 Add source verification on build
Include verification on build time, with link to GPG keys on upstream
site.

Signed-off-by: Petr Menšík <pemensik@redhat.com>
2019-11-25 21:06:06 +01:00
Petr Menšík
74b53c3a58 Update to 9.11.13 2019-11-25 21:06:06 +01:00
Petr Menšík
b29a7e26db Report error on reload failure
Return failed status code to command. Not only report error message to
the log, but also report reload success. Must not terminate running
service on failed reload.
2019-11-19 13:37:14 +01:00
Petr Menšík
c45a218eef fixup! Remove config archive with zone files 2019-11-19 12:01:15 +01:00
Petr Menšík
9bef003ee5 Fix binary compatibility after serve-stale patch (#1770492)
Move new entry to the end. Do not break already compiled bind-dyndb-ldap
compatibility.
2019-11-12 11:17:43 +01:00
Petr Menšík
8544584691 Add serve-stale feature
Backported from 9.12 version, adds support for stale-answer-enable
option, as well stale-answer-ttl and max-stale-ttl.
2019-11-07 14:36:47 +01:00
Petr Menšík
dff9083e8c Fix wrong default GeoIP directory (#1768258) 2019-11-06 21:31:14 +01:00
Petr Menšík
cba49a643a Improve SYSTEMTEST running on build time
Use parallel execution on test run. Support already configured
interfaces without special permissions on build. It can either use
already present addresses or configure it on build time. If it has no
rights to configure it, just skip the test and continue.
2019-11-05 13:03:34 +01:00
Petr Menšík
63bb1cf127 Add GeoIP configuration into config file
Upstream has wrong default path of GeoIP2. Use it explicitly.
2019-11-04 21:48:36 +01:00
Petr Menšík
ed8f6043d7 Bump version 2019-11-04 21:45:08 +01:00
Petr Menšík
86712fc834 Remove config archive with zone files
Few configuration and zone files were moved into tarball by commit
55b04de09a. It makes tracking of changes difficult, hardens rebases,
makes difficult building without proper lookaside cache. Those files are
tiny, no need to hold them inside compressed binary archive. Move them
out.

Replaces also few places with proper directory macros.
2019-11-04 21:45:08 +01:00
Petr Menšík
176d144f32 Adjust patches to 9.11.12
Few changes occured, remove one upstream applied patch.
2019-10-21 14:40:42 +02:00
Petr Menšík
d0053ae530 Update to 9.11.12 (#1557762) 2019-10-21 14:26:32 +02:00
Petr Menšík
833ef7b7b4 Adjust downstream patches to 9.11.11 2019-09-25 21:30:47 +02:00
Petr Menšík
d568c54c25 Share pkcs11-utils and dnssec-utils manuals
Previous build recommended bind-dnssec-utils just to provide manual for
pkcs11 variants. Instead, share the same files between pkcs11-utils and
dnssec-utils. Skip unnecessary manual of non-existent dnssec-coverage-pkcs11 tool.
2019-09-05 21:18:52 +02:00
Petr Menšík
9d1aaa502b Recommend bind-dnssec-utils from bind-pkcs11-utils
Manual pages are just links to pages in bind-dnssec-utils. Do not copy
them, but suggest them for installation is possible. It would be handy
to have them available, but are not required for any function.
2019-09-03 18:34:04 +02:00
Petr Menšík
bf5bc99f81 Add GeoIP to bind-chroot (#1497646)
named can use ACLs defined by GeoIP of request. Such information is not
available by default under named-chroot service. Enable GeoIP databases
under chroot without explicit configuration.
2019-09-03 13:58:49 +02:00
Petr Menšík
0fa39c28ad Move created empty directories to single define
Make it easier to manage list of used directories in chroot. Use
appropriate macros for system directories everywhere in chroot package.
Share common variable with -sdb-chroot and -chroot packages.
2019-09-03 13:58:31 +02:00
Petr Menšík
8cd5c11f0d Move some administration utilities back to utils (#1720380)
Some utilities are not related DNSSEC at all, but are just bind related
tools. Because they do not require additional dependencies, they do not
save any space in containers.
2019-09-03 11:37:26 +02:00
Petr Menšík
c5d9a5c66a Avoid conflicts between OpenSSL and native PKCS#11
Do not set default engine when native module should be used.
2019-08-27 21:39:46 +02:00
Petr Menšík
72f1dad845 Update to BIND 9.11.10 2019-08-27 21:39:46 +02:00
Miro Hrončok
c92fe260ae Rebuilt for Python 3.8 2019-08-19 10:10:45 +02:00
Petr Menšík
b75571c4df Add changelog and bump spec 2019-08-09 12:39:58 +02:00
Petr Menšík
963c4b916b Fix rpmlint warnings
Clean whitespace to satisfy rpmlint
2019-08-08 15:08:53 +02:00
Petr Menšík
dab22dd2c2 Permit explicit disabling of RSAMD5 in FIPS mode (#1709553)
When MD5 is disabled in library, it behaved like RSAMD5 were unknown.
But security-policy disables it explicitly. It failed to even start in
FIPS mode, because such algorithm were unknown. Fix disabled algorithm
to return disabled result code. Accept such algorithm only when
disabling it.

Signed-off-by: Petr Menšík <pemensik@redhat.com>
2019-08-08 14:19:59 +02:00
Petr Menšík
fac5ed036c Disable building of export-libs
DHCP no longer needs export libs, stop building them.
2019-08-08 14:19:59 +02:00
Petr Menšík
b4e74efbf2 Enable GeoLite2 support
Make GeoIP support controlled by bcond, defaults to off now.
Instead enable GeoLite2 support.
2019-08-08 12:16:51 +02:00
Petr Menšík
448b6647dc Solve conflicting jsoncpp-devel and json-c-devel 2019-08-08 12:16:51 +02:00
Petr Menšík
afa1fa2af7 Update to 9.11.9 2019-08-08 12:16:51 +02:00
Petr Menšík
1050b1aed6 Use monotonic time in export library (#1732883)
Signed-off-by: Petr Menšík <pemensik@redhat.com>
2019-08-08 12:16:51 +02:00
Fedora Release Engineering
3a67af20ad - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2019-07-24 19:16:14 +00:00
Petr Menšík
16ecf0736f Update to 9.11.8
Contains:
5244.	[security]	Fixed a race condition in dns_dispatch_getnext()
			that could cause an assertion failure if a
			significant number of incoming packets were
			rejected. (CVE-2019-6471) [GL #942]

5241.	[bug]		Fix Ed448 private and public key ASN.1 prefix blobs.
			[GL #225]

5237.	[bug]		Recurse to find the root server list with 'dig +trace'.
			[GL #1028]
2019-07-02 11:10:03 +02:00
Petr Menšík
564c143a1b Fix OpenSSL random generator initialization
Also fix warning in test.
2019-06-17 13:56:47 +02:00
Petr Menšík
ecef966359 Fix libisc so version 2019-06-11 14:56:08 +02:00
Petr Menšík
2a466330c5 Update patches to new sources
Modify current and remove already merged patches.
Adjust versions of so libs.
2019-06-11 12:08:54 +02:00
Petr Menšík
625ca235be Update to BIND 9.11.7
Fixes trusted-keys and managed-keys using the same filename.

https://downloads.isc.org/isc/bind9/9.11.7/RELEASE-NOTES-bind-9.11.7.html
2019-06-10 10:41:28 +02:00
Petr Menšík
e97d036624 Fix also postun script 2019-05-06 14:04:12 +02:00
Petr Menšík
926c8e07af Fix error in scriptlet condition
Selinux boolean is not correctly set, correct syntax of bash condition.
2019-05-06 13:05:44 +02:00
Petr Menšík
4b42a5c162 5200. [security] tcp-clients settings could be exceeded in some cases,
which could lead to exhaustion of file descriptors.
                        (CVE-2018-5743) [GL #615]
2019-05-02 14:49:56 +02:00
Petr Menšík
7232bc0a99 Attempt to use rich dependencies
Selinux boolean should be set only in case given selinux policy is
installed. Do not require it inside containers.
2019-04-09 22:18:22 +02:00