diff --git a/.gitignore b/.gitignore index 2740de0..958955d 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1 @@ -SOURCES/ldns-1.7.0.tar.gz -/ldns-1.7.0.tar.gz +ldns-1.8.3.tar.gz diff --git a/gating.yaml b/gating.yaml deleted file mode 100644 index eb7c84f..0000000 --- a/gating.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- !Policy -product_versions: - - rhel-8 -decision_context: osci_compose_gate -rules: - - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} diff --git a/ldns-1.7.0-coverity.patch b/ldns-1.7.0-coverity.patch deleted file mode 100644 index 6aaa451..0000000 --- a/ldns-1.7.0-coverity.patch +++ /dev/null @@ -1,437 +0,0 @@ -From c5fcd8ab8ee1b66d0ef75b02f72ccfc3ebf50cf5 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Wed, 12 Sep 2018 15:01:37 +0200 -Subject: [PATCH 1/2] Purge unused variables - ---- - packaging/ldns-config.in | 3 --- - 1 file changed, 3 deletions(-) - -diff --git a/packaging/ldns-config.in b/packaging/ldns-config.in -index 950c135..a8c860e 100755 ---- a/packaging/ldns-config.in -+++ b/packaging/ldns-config.in -@@ -1,9 +1,6 @@ - #!/bin/sh - --prefix="@prefix@" --exec_prefix="@exec_prefix@" - VERSION="@PACKAGE_VERSION@" --CPPFLAGS="@CPPFLAGS@ @LIBSSL_CPPFLAGS@ @PYTHON_CPPFLAGS@" - LIBS="@LIBS@ @LIBSSL_LIBS@" - INCLUDEDIR="@includedir@" - LIBVERSION="@VERSION_INFO@" --- -2.20.1 - - -From db06eb482b09a0bcdaf3f688702b1c0df2cb1eca Mon Sep 17 00:00:00 2001 -From: Willem Toorop -Date: Thu, 11 Jul 2019 15:22:44 +0200 -Subject: [PATCH 2/2] Issues detected in ldns library by scan of Coverity -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Thanks Petr Menšík ---- - dnssec.c | 6 +++++- - dnssec_sign.c | 4 ++-- - dnssec_verify.c | 18 ++++++------------ - dnssec_zone.c | 23 +++++++++++++++++------ - host2str.c | 13 +++++++------ - host2wire.c | 22 ++++++++++++++++------ - net.c | 12 ++++++++++-- - packet.c | 2 ++ - radix.c | 5 ++++- - str2host.c | 2 ++ - 10 files changed, 71 insertions(+), 36 deletions(-) - -diff --git a/dnssec.c b/dnssec.c -index e3c99de..b2dd3f3 100644 ---- a/dnssec.c -+++ b/dnssec.c -@@ -149,6 +149,7 @@ ldns_dnssec_nsec3_closest_encloser(const ldns_rdf *qname, - LDNS_FREE(salt); - ldns_rdf_deep_free(zone_name); - ldns_rdf_deep_free(sname); -+ ldns_rdf_deep_free(hashed_sname); - return NULL; - } - -@@ -1556,6 +1557,7 @@ ldns_pkt_verify_time(const ldns_pkt *p, ldns_rr_type t, const ldns_rdf *o, - ldns_rr_list *sigs_covered; - ldns_rdf *rdf_t; - ldns_rr_type t_netorder; -+ ldns_status status; - - if (!k) { - return LDNS_STATUS_ERR; -@@ -1607,7 +1609,9 @@ ldns_pkt_verify_time(const ldns_pkt *p, ldns_rr_type t, const ldns_rdf *o, - } - return LDNS_STATUS_ERR; - } -- return ldns_verify_time(rrset, sigs, k, check_time, good_keys); -+ status = ldns_verify_time(rrset, sigs, k, check_time, good_keys); -+ ldns_rr_list_deep_free(rrset); -+ return status; - } - - ldns_status -diff --git a/dnssec_sign.c b/dnssec_sign.c -index 22f0981..94ea925 100644 ---- a/dnssec_sign.c -+++ b/dnssec_sign.c -@@ -234,8 +234,6 @@ ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys) - - new_owner = NULL; - -- signatures = ldns_rr_list_new(); -- - /* prepare a signature and add all the know data - * prepare the rrset. Sign this together. */ - rrset_clone = ldns_rr_list_clone(rrset); -@@ -252,6 +250,8 @@ ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys) - /* sort */ - ldns_rr_list_sort(rrset_clone); - -+ signatures = ldns_rr_list_new(); -+ - for (key_count = 0; - key_count < ldns_key_list_key_count(keys); - key_count++) { -diff --git a/dnssec_verify.c b/dnssec_verify.c -index c554e4f..c7e2fba 100644 ---- a/dnssec_verify.c -+++ b/dnssec_verify.c -@@ -1583,8 +1583,6 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr - bool wildcard_covered = false; - ldns_rdf *zone_name; - ldns_rdf *hashed_name; -- /* self assignment to suppress uninitialized warning */ -- ldns_rdf *next_closer = next_closer; - ldns_rdf *hashed_next_closer; - size_t i; - ldns_status result = LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED; -@@ -1659,6 +1657,7 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr - } - } - } -+ ldns_rdf_deep_free(hashed_name); - result = LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED; - /* wildcard no data? section 8.7 */ - closest_encloser = ldns_dnssec_nsec3_closest_encloser( -@@ -1748,7 +1747,9 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr - /* Query name *is* the "next closer". */ - hashed_next_closer = hashed_name; - } else { -- -+ ldns_rdf *next_closer; -+ -+ ldns_rdf_deep_free(hashed_name); - /* "next closer" has less labels than the query name. - * Create the name and hash it. - */ -@@ -1762,6 +1763,7 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr - next_closer - ); - (void) ldns_dname_cat(hashed_next_closer, zone_name); -+ ldns_rdf_deep_free(next_closer); - } - /* Find the NSEC3 that covers the "next closer" */ - for (i = 0; i < ldns_rr_list_rr_count(nsecs); i++) { -@@ -1776,15 +1778,7 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr - break; - } - } -- if (ldns_dname_label_count(closest_encloser) + 1 -- < ldns_dname_label_count(ldns_rr_owner(rr))) { -- -- /* "next closer" has less labels than the query name. -- * Dispose of the temporary variables that held that name. -- */ -- ldns_rdf_deep_free(hashed_next_closer); -- ldns_rdf_deep_free(next_closer); -- } -+ ldns_rdf_deep_free(hashed_next_closer); - ldns_rdf_deep_free(closest_encloser); - } - -diff --git a/dnssec_zone.c b/dnssec_zone.c -index f610a3c..e089754 100644 ---- a/dnssec_zone.c -+++ b/dnssec_zone.c -@@ -746,6 +746,7 @@ ldns_dnssec_zone_new_frm_fp_l(ldns_dnssec_zone** z, FILE* fp, const ldns_rdf* or - newzone = NULL; - } else { - ldns_dnssec_zone_free(newzone); -+ newzone = NULL; - } - - error: -@@ -1105,8 +1106,12 @@ ldns_dnssec_zone_add_empty_nonterminals_nsec3( - ldns_rdf *ent_name; - - if (!(ent_name = ldns_dname_clone_from( -- next_name, i))) -+ next_name, i))) { -+ -+ ldns_rdf_deep_free(l1); -+ ldns_rdf_deep_free(l2); - return LDNS_STATUS_MEM_ERR; -+ } - - if (nsec3s && zone->_nsec3params) { - ldns_rdf *ent_hashed_name; -@@ -1114,28 +1119,34 @@ ldns_dnssec_zone_add_empty_nonterminals_nsec3( - if (!(ent_hashed_name = - ldns_nsec3_hash_name_frm_nsec3( - zone->_nsec3params, -- ent_name))) -+ ent_name))) { -+ ldns_rdf_deep_free(l1); -+ ldns_rdf_deep_free(l2); -+ ldns_rdf_deep_free(ent_name); - return LDNS_STATUS_MEM_ERR; -+ } - node = ldns_rbtree_search(nsec3s, - ent_hashed_name); - if (!node) { - ldns_rdf_deep_free(l1); - ldns_rdf_deep_free(l2); -+ ldns_rdf_deep_free(ent_name); - continue; - } - } - new_name = ldns_dnssec_name_new(); - if (!new_name) { -+ ldns_rdf_deep_free(l1); -+ ldns_rdf_deep_free(l2); -+ ldns_rdf_deep_free(ent_name); - return LDNS_STATUS_MEM_ERR; - } - new_name->name = ent_name; -- if (!new_name->name) { -- ldns_dnssec_name_free(new_name); -- return LDNS_STATUS_MEM_ERR; -- } - new_name->name_alloced = true; - new_node = LDNS_MALLOC(ldns_rbnode_t); - if (!new_node) { -+ ldns_rdf_deep_free(l1); -+ ldns_rdf_deep_free(l2); - ldns_dnssec_name_free(new_name); - return LDNS_STATUS_MEM_ERR; - } -diff --git a/host2str.c b/host2str.c -index 747d543..f39a184 100644 ---- a/host2str.c -+++ b/host2str.c -@@ -1085,12 +1085,12 @@ ldns_rdf2buffer_str_ipseckey(ldns_buffer *output, const ldns_rdf *rdf) - /* no gateway */ - break; - case 1: -- gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP4ADDRLEN); -- if(!gateway_data) -- return LDNS_STATUS_MEM_ERR; - if (ldns_rdf_size(rdf) < offset + LDNS_IP4ADDRLEN) { - return LDNS_STATUS_ERR; - } -+ gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP4ADDRLEN); -+ if(!gateway_data) -+ return LDNS_STATUS_MEM_ERR; - memcpy(gateway_data, &data[offset], LDNS_IP4ADDRLEN); - gateway = ldns_rdf_new(LDNS_RDF_TYPE_A, - LDNS_IP4ADDRLEN , gateway_data); -@@ -1101,12 +1101,12 @@ ldns_rdf2buffer_str_ipseckey(ldns_buffer *output, const ldns_rdf *rdf) - } - break; - case 2: -- gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP6ADDRLEN); -- if(!gateway_data) -- return LDNS_STATUS_MEM_ERR; - if (ldns_rdf_size(rdf) < offset + LDNS_IP6ADDRLEN) { - return LDNS_STATUS_ERR; - } -+ gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP6ADDRLEN); -+ if(!gateway_data) -+ return LDNS_STATUS_MEM_ERR; - memcpy(gateway_data, &data[offset], LDNS_IP6ADDRLEN); - offset += LDNS_IP6ADDRLEN; - gateway = -@@ -1129,6 +1129,7 @@ ldns_rdf2buffer_str_ipseckey(ldns_buffer *output, const ldns_rdf *rdf) - } - - if (ldns_rdf_size(rdf) <= offset) { -+ ldns_rdf_deep_free(gateway); - return LDNS_STATUS_ERR; - } - public_key_size = ldns_rdf_size(rdf) - offset; -diff --git a/host2wire.c b/host2wire.c -index 4d8aa30..a12b6b0 100644 ---- a/host2wire.c -+++ b/host2wire.c -@@ -67,17 +67,27 @@ ldns_dname2buffer_wire_compress(ldns_buffer *buffer, const ldns_rdf *name, ldns_ - { - /* Not found. Write cache entry, take off first label, write it, */ - /* try again with the rest of the name. */ -- node = LDNS_MALLOC(ldns_rbnode_t); -- if(!node) -- { -- return LDNS_STATUS_MEM_ERR; -- } - if (ldns_buffer_position(buffer) < 16384) { -- node->key = ldns_rdf_clone(name); -+ ldns_rdf *key; -+ -+ node = LDNS_MALLOC(ldns_rbnode_t); -+ if(!node) -+ { -+ return LDNS_STATUS_MEM_ERR; -+ } -+ -+ key = ldns_rdf_clone(name); -+ if (!key) { -+ LDNS_FREE(node); -+ return LDNS_STATUS_MEM_ERR; -+ } -+ node->key = key; - node->data = (void *) (intptr_t) ldns_buffer_position(buffer); - if(!ldns_rbtree_insert(compression_data,node)) - { - /* fprintf(stderr,"Name not found but now it's there?\n"); */ -+ ldns_rdf_deep_free(key); -+ LDNS_FREE(node); - } - } - label = ldns_dname_label(name, 0); -diff --git a/net.c b/net.c -index 9e048d2..6e6a12b 100644 ---- a/net.c -+++ b/net.c -@@ -202,6 +202,7 @@ ldns_tcp_connect_from(const struct sockaddr_storage *to, socklen_t tolen, - } - #endif - if (from && bind(sockfd, (const struct sockaddr*)from, fromlen) == SOCK_INVALID){ -+ close_socket(sockfd); - return 0; - } - -@@ -337,7 +338,7 @@ ldns_tcp_send_from(uint8_t **result, ldns_buffer *qbin, - answer = ldns_tcp_read_wire_timeout(sockfd, answer_size, timeout); - close_socket(sockfd); - -- if (*answer_size == 0) { -+ if (!answer) { - /* oops */ - return LDNS_STATUS_NETWORK_ERR; - } -@@ -390,6 +391,7 @@ ldns_udp_bgsend_from(ldns_buffer *qbin, - } - - if (from && bind(sockfd, (const struct sockaddr*)from, fromlen) == -1){ -+ close_socket(sockfd); - return 0; - } - -@@ -437,7 +439,7 @@ ldns_udp_send_from(uint8_t **result, ldns_buffer *qbin, - answer = ldns_udp_read_wire(sockfd, answer_size, NULL, NULL); - close_socket(sockfd); - -- if (*answer_size == 0) { -+ if (!answer) { - /* oops */ - return LDNS_STATUS_NETWORK_ERR; - } -@@ -571,6 +573,9 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf - if (!reply_bytes) { - /* the current nameserver seems to have a problem, blacklist it */ - if (ldns_resolver_fail(r)) { -+ if(src) { -+ LDNS_FREE(src); -+ } - LDNS_FREE(ns); - return LDNS_STATUS_ERR; - } else { -@@ -918,6 +923,9 @@ ldns_axfr_start(ldns_resolver *resolver, const ldns_rdf *domain, ldns_rr_class c - src, (socklen_t)src_len, - ldns_resolver_timeout(resolver)); - } -+ if (src) { -+ LDNS_FREE(src); -+ } - - if (resolver->_socket == SOCK_INVALID) { - ldns_pkt_free(query); -diff --git a/packet.c b/packet.c -index 95f8f3f..f8fb960 100644 ---- a/packet.c -+++ b/packet.c -@@ -928,11 +928,13 @@ ldns_pkt_query_new_frm_str_internal(ldns_pkt **p, const char *name, - } - - if (!ldns_pkt_set_flags(packet, flags)) { -+ ldns_pkt_free(packet); - return LDNS_STATUS_ERR; - } - - question_rr = ldns_rr_new(); - if (!question_rr) { -+ ldns_pkt_free(packet); - return LDNS_STATUS_MEM_ERR; - } - -diff --git a/radix.c b/radix.c -index 43f7365..9695e13 100644 ---- a/radix.c -+++ b/radix.c -@@ -225,9 +225,9 @@ ldns_radix_insert(ldns_radix_t* tree, uint8_t* key, radix_strlen_t len, - } - } else if (pos == len) { - /** Exact match found */ -+ LDNS_FREE(add); - if (prefix->data) { - /* Element already exists */ -- LDNS_FREE(add); - return LDNS_STATUS_EXISTS_ERR; - } - prefix->data = data; -@@ -1120,12 +1120,15 @@ ldns_radix_array_split(ldns_radix_array_t* array, uint8_t* key, - if (array->len - common_len > 1) { - if (!ldns_radix_prefix_remainder(common_len+1, - array->str, array->len, &s1, &l1)) { -+ LDNS_FREE(common); - return 0; - } - } - if (strlen_to_add - common_len > 1) { - if (!ldns_radix_prefix_remainder(common_len+1, - str_to_add, strlen_to_add, &s2, &l2)) { -+ LDNS_FREE(common); -+ LDNS_FREE(s1); - return 0; - } - } -diff --git a/str2host.c b/str2host.c -index c3afba1..68bccf1 100644 ---- a/str2host.c -+++ b/str2host.c -@@ -445,6 +445,7 @@ ldns_str2rdf_str(ldns_rdf **rd, const char *str) - *++dp = ch; - } - if (! str) { -+ LDNS_FREE(data); - return LDNS_STATUS_SYNTAX_BAD_ESCAPE; - } - length = (size_t)(dp - data); -@@ -1494,6 +1495,7 @@ ldns_str2rdf_long_str(ldns_rdf **rd, const char *str) - } - } - if (! str) { -+ LDNS_FREE(data); - return LDNS_STATUS_SYNTAX_BAD_ESCAPE; - } - if (!(length = (size_t)(dp - data))) { --- -2.20.1 - diff --git a/ldns-1.7.0-multilib.patch b/ldns-1.7.0-multilib.patch index 428dc78..61f8de9 100644 --- a/ldns-1.7.0-multilib.patch +++ b/ldns-1.7.0-multilib.patch @@ -1,48 +1,23 @@ -diff --git a/ldns-1.7.0/configure b/ldns-1.7.0/configure -index cd087de..aeec9fb 100755 ---- a/ldns-1.7.0/configure -+++ b/ldns-1.7.0/configure -@@ -684,6 +684,7 @@ PYTHON_SITE_PKG - PYTHON_LDFLAGS - PYTHON_CPPFLAGS - PYTHON -+PYTHON_LIB - PYTHON_VERSION - UNINSTALL_CONFIG_MANPAGE - UNINSTALL_CONFIG -@@ -14311,6 +14312,7 @@ EOD` - # use the official shared library - ac_python_library=`echo "$ac_python_library" | sed "s/^lib//"` - PYTHON_LDFLAGS="-L$ac_python_libdir -l$ac_python_library" -+ PYTHON_LIB="$ac_python_library" - else - # old way: use libpython from python_configdir - ac_python_libdir=`$PYTHON -c \ -@@ -14318,6 +14320,7 @@ EOD` - import os; \ - print (os.path.join(f(plat_specific=1, standard_lib=1), 'config'));"` - PYTHON_LDFLAGS="-L$ac_python_libdir -lpython$ac_python_version" -+ PYTHON_LIB="python$ac_python_version" - fi - - if test -z "PYTHON_LDFLAGS"; then -diff --git a/ldns-1.7.0/packaging/ldns-config.in b/ldns-1.7.0/packaging/ldns-config.in -index ffb2c57..950c135 100755 ---- a/ldns-1.7.0/packaging/ldns-config.in -+++ b/ldns-1.7.0/packaging/ldns-config.in -@@ -3,13 +3,26 @@ +diff --git a/ldns-1.8.1/packaging/ldns-config.in b/ldns-1.8.1/packaging/ldns-config.in +index 623f77e..2b961f9 100755 +--- a/ldns-1.8.1/packaging/ldns-config.in ++++ b/ldns-1.8.1/packaging/ldns-config.in +@@ -3,16 +3,28 @@ prefix="@prefix@" exec_prefix="@exec_prefix@" VERSION="@PACKAGE_VERSION@" -CFLAGS="@CFLAGS@" - CPPFLAGS="@CPPFLAGS@ @LIBSSL_CPPFLAGS@ @PYTHON_CPPFLAGS@" --LDFLAGS="@LDFLAGS@ @LIBSSL_LDFLAGS@ @PYTHON_LDFLAGS@" + CPPFLAGS="@CPPFLAGS@ @LIBSSL_CPPFLAGS@" +-LDFLAGS="@LDFLAGS@ @LIBSSL_LDFLAGS@" + PYTHON_CPPFLAGS="@PYTHON_CPPFLAGS@" +-PYTHON_LDFLAGS="@PYTHON_LDFLAGS@" ++PYTHON_LDFLAGS="@PYTHON_LIBS@" LIBS="@LIBS@ @LIBSSL_LIBS@" -LIBDIR="@libdir@" INCLUDEDIR="@includedir@" LIBVERSION="@VERSION_INFO@" +ARCH="`uname -m`" -+ + +case $ARCH in + x86_64 | amd64 | sparc64 | s390x | ppc64) + @@ -55,23 +30,40 @@ index ffb2c57..950c135 100755 + ;; +esac + -+LDFLAGS="@LDFLAGS@ @LIBSSL_LDFLAGS@ -L$LIBDIR -l@PYTHON_LIB@" -+LDFLAGS_SEC="@LDFLAGS@ @LIBSSL_LDFLAGS@ -L$LIBDIR_SEC -l@PYTHON_LIB@" ++LDFLAGS_SEC="@LDFLAGS@ -L$LIBDIR_SEC" ++LDFLAGS="@LDFLAGS@ -L$LIBDIR" for arg in $@ do -@@ -21,9 +34,13 @@ do +@@ -28,13 +40,17 @@ do then echo "${LDFLAGS} -L${LIBDIR} ${LIBS} -lldns" fi -+ if [ $arg = "--libs_sec" ] ++ if [ $arg = "--libs_sec" ] || [ $arg = "--libs-sec" ] + then -+ echo "${LDFLAGS_SEC} -L${LIBDIR_SEC} ${LIBS} -lldns" ++ echo "${LDFLAGS_SEC} ${LIBS} -lldns" + fi + if [ $arg = "--python-libs" ] + then + echo "${LDFLAGS} ${PYTHON_LDFLAGS} -L${LIBDIR} ${LIBS} -lldns" + fi if [ $arg = "-h" ] || [ $arg = "--help" ] then -- echo "Usage: $0 [--cflags] [--libs] [--version]" -+ echo "Usage: $0 [--cflags] [--libs] [--libs_sec] [--version]" +- echo "Usage: $0 [--cflags] [--python-cflags] [--libs] [--python-libs] [--version]" ++ echo "Usage: $0 [--cflags] [--python-cflags] [--libs] [--libs-sec] [--python-libs] [--version]" fi if [ $arg = "--version" ] then +diff --git a/ldns-1.8.1/packaging/libldns.pc.in b/ldns-1.8.1/packaging/libldns.pc.in +index 923b688..3c30db8 100644 +--- a/ldns-1.8.1/packaging/libldns.pc.in ++++ b/ldns-1.8.1/packaging/libldns.pc.in +@@ -1,7 +1,7 @@ + prefix=@prefix@ + exec_prefix=@exec_prefix@ + libdir=@libdir@ +-includedir=@includedir@ ++includedir=@includedir@/ldns + + Name: ldns + Description: Library for DNS programming diff --git a/ldns-1.7.0-parse-limit.patch b/ldns-1.7.0-parse-limit.patch deleted file mode 100644 index 2c2abe8..0000000 --- a/ldns-1.7.0-parse-limit.patch +++ /dev/null @@ -1,28 +0,0 @@ -From c8391790c96d4c8a2c10f9ab1460fda83b509fc2 Mon Sep 17 00:00:00 2001 -From: Willem Toorop -Date: Thu, 27 Apr 2017 00:14:58 +0200 -Subject: [PATCH] Check parse limit before t increment - -Thanks Stephan Zeisberg ---- - parse.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/parse.c b/parse.c -index e68627c..947dbb8 100644 ---- a/parse.c -+++ b/parse.c -@@ -118,6 +118,10 @@ ldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *li - if (line_nr) { - *line_nr = *line_nr + 1; - } -+ if (limit > 0 && (i >= limit || (size_t)(t-token) >= limit)) { -+ *t = '\0'; -+ return -1; -+ } - *t++ = ' '; - prev_c = c; - continue; --- -2.9.5 - diff --git a/ldns-1.7.0-realloc.patch b/ldns-1.7.0-realloc.patch deleted file mode 100644 index 25be44d..0000000 --- a/ldns-1.7.0-realloc.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 3bdeed02505c9bbacb3b64a97ddcb1de967153b7 Mon Sep 17 00:00:00 2001 -From: Willem Toorop -Date: Thu, 27 Apr 2017 00:25:20 +0200 -Subject: [PATCH] bugfix #1257: Free after reallocing to 0 size - -Thanks Stephan Zeisberg ---- - str2host.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/str2host.c b/str2host.c -index b274b17..f2a317b 100644 ---- a/str2host.c -+++ b/str2host.c -@@ -1525,8 +1525,10 @@ ldns_str2rdf_long_str(ldns_rdf **rd, const char *str) - if (! str) { - return LDNS_STATUS_SYNTAX_BAD_ESCAPE; - } -- length = (size_t)(dp - data); -- -+ if (!(length = (size_t)(dp - data))) { -+ LDNS_FREE(data); -+ return LDNS_STATUS_SYNTAX_EMPTY; -+ } - /* Lose the overmeasure */ - data = LDNS_XREALLOC(dp = data, uint8_t, length); - if (! data) { --- -2.9.5 - diff --git a/ldns-1.8-openssl-engine.patch b/ldns-1.8-openssl-engine.patch new file mode 100644 index 0000000..8005eb9 --- /dev/null +++ b/ldns-1.8-openssl-engine.patch @@ -0,0 +1,24 @@ +From d7c107aff35800cd571f69d56a118d9ec91bd152 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Fri, 19 Jul 2024 12:58:05 +0200 +Subject: [PATCH] Remove unused openssl/engine.h header + +--- + ldns-1.8.3/examples/ldns-nsec3-hash.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/ldns-1.8.3/examples/ldns-nsec3-hash.c b/ldns-1.8.3/examples/ldns-nsec3-hash.c +index f9325d3..f04f1aa 100644 +--- a/ldns-1.8.3/examples/ldns-nsec3-hash.c ++++ b/ldns-1.8.3/examples/ldns-nsec3-hash.c +@@ -18,7 +18,6 @@ + + #ifdef HAVE_SSL + #include +-#include + #endif /* HAVE_SSL */ + + #define MAX_FILENAME_LEN 250 +-- +2.45.2 + diff --git a/ldns-1.8-python-dirs.patch b/ldns-1.8-python-dirs.patch new file mode 100644 index 0000000..ae0eeac --- /dev/null +++ b/ldns-1.8-python-dirs.patch @@ -0,0 +1,293 @@ +From 5a9b19d53b34b3a1b332b39569945ae5dedb1a61 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Tue, 3 Jan 2023 21:37:34 +0100 +Subject: [PATCH] Update python configuration, support platform site dir + +Update to the most recent ax_python_devel.m4 from autoconf-archive +2022.09.03. It reports two separate directories, one for platform +independent files, another for platform specific files. + +Make minimal change and switch to using platform dependent directory. +Should work on python 3.12, which removes distutils module completely. +--- + ldns-1.8.3/Makefile.in | 2 +- + ldns-1.8.3/ax_python_devel.m4 | 147 +++++++++++++++++++++++++++------- + 2 files changed, 119 insertions(+), 30 deletions(-) + +diff --git a/ldns-1.8.3/Makefile.in b/ldns-1.8.3/Makefile.in +index 57957d0..64bb155 100644 +--- a/ldns-1.8.3/Makefile.in ++++ b/ldns-1.8.3/Makefile.in +@@ -20,7 +20,7 @@ p5_dns_ldns_dir = $(srcdir)/contrib/DNS-LDNS + PERL = @PERL@ + swig = @swig@ + swigpy_flags = -python @SWIGPY3@ +-python_site = @PYTHON_SITE_PKG@ ++python_site = @PYTHON_PLATFORM_SITE_PKG@ + pyldns_inst = @PYLDNSINST@ + pyldns_uninst = @PYLDNSUNINST@ + pyldnsx_inst = @PYLDNSXINST@ +diff --git a/ldns-1.8.3/ax_python_devel.m4 b/ldns-1.8.3/ax_python_devel.m4 +index aff04f6..780584e 100644 +--- a/ldns-1.8.3/ax_python_devel.m4 ++++ b/ldns-1.8.3/ax_python_devel.m4 +@@ -67,7 +67,7 @@ + # modified version of the Autoconf Macro, you may extend this special + # exception to the GPL to apply to your modified version as well. + +-#serial 21 ++#serial 32 + + AU_ALIAS([AC_PYTHON_DEVEL], [AX_PYTHON_DEVEL]) + AC_DEFUN([AX_PYTHON_DEVEL],[ +@@ -112,15 +112,39 @@ to something else than an empty string. + fi + + # +- # if the macro parameter ``version'' is set, honour it ++ # If the macro parameter ``version'' is set, honour it. ++ # A Python shim class, VPy, is used to implement correct version comparisons via ++ # string expressions, since e.g. a naive textual ">= 2.7.3" won't work for ++ # Python 2.7.10 (the ".1" being evaluated as less than ".3"). + # + if test -n "$1"; then + AC_MSG_CHECKING([for a version of Python $1]) +- ac_supports_python_ver=`$PYTHON -c "import sys; \ +- ver = sys.version.split ()[[0]]; \ ++ cat << EOF > ax_python_devel_vpy.py ++class VPy: ++ def vtup(self, s): ++ return tuple(map(int, s.strip().replace("rc", ".").split("."))) ++ def __init__(self): ++ import sys ++ self.vpy = tuple(sys.version_info) ++ def __eq__(self, s): ++ return self.vpy == self.vtup(s) ++ def __ne__(self, s): ++ return self.vpy != self.vtup(s) ++ def __lt__(self, s): ++ return self.vpy < self.vtup(s) ++ def __gt__(self, s): ++ return self.vpy > self.vtup(s) ++ def __le__(self, s): ++ return self.vpy <= self.vtup(s) ++ def __ge__(self, s): ++ return self.vpy >= self.vtup(s) ++EOF ++ ac_supports_python_ver=`$PYTHON -c "import ax_python_devel_vpy; \ ++ ver = ax_python_devel_vpy.VPy(); \ + print (ver $1)"` ++ rm -rf ax_python_devel_vpy*.py* __pycache__/ax_python_devel_vpy*.py* + if test "$ac_supports_python_ver" = "True"; then +- AC_MSG_RESULT([yes]) ++ AC_MSG_RESULT([yes]) + else + AC_MSG_RESULT([no]) + AC_MSG_ERROR([this package requires Python $1. +@@ -135,16 +159,25 @@ variable to configure. See ``configure --help'' for reference. + # + # Check if you have distutils, else fail + # +- AC_MSG_CHECKING([for the distutils Python package]) +- ac_distutils_result=`$PYTHON -c "import distutils" 2>&1` ++ AC_MSG_CHECKING([for the sysconfig Python package]) ++ ac_sysconfig_result=`$PYTHON -c "import sysconfig" 2>&1` + if test $? -eq 0; then + AC_MSG_RESULT([yes]) ++ IMPORT_SYSCONFIG="import sysconfig" + else + AC_MSG_RESULT([no]) +- AC_MSG_ERROR([cannot import Python module "distutils". ++ ++ AC_MSG_CHECKING([for the distutils Python package]) ++ ac_sysconfig_result=`$PYTHON -c "from distutils import sysconfig" 2>&1` ++ if test $? -eq 0; then ++ AC_MSG_RESULT([yes]) ++ IMPORT_SYSCONFIG="from distutils import sysconfig" ++ else ++ AC_MSG_ERROR([cannot import Python module "distutils". + Please check your Python installation. The error was: +-$ac_distutils_result]) +- PYTHON_VERSION="" ++$ac_sysconfig_result]) ++ PYTHON_VERSION="" ++ fi + fi + + # +@@ -152,10 +185,19 @@ $ac_distutils_result]) + # + AC_MSG_CHECKING([for Python include path]) + if test -z "$PYTHON_CPPFLAGS"; then +- python_path=`$PYTHON -c "import distutils.sysconfig; \ +- print (distutils.sysconfig.get_python_inc ());"` +- plat_python_path=`$PYTHON -c "import distutils.sysconfig; \ +- print (distutils.sysconfig.get_python_inc (plat_specific=1));"` ++ if test "$IMPORT_SYSCONFIG" = "import sysconfig"; then ++ # sysconfig module has different functions ++ python_path=`$PYTHON -c "$IMPORT_SYSCONFIG; \ ++ print (sysconfig.get_path ('include'));"` ++ plat_python_path=`$PYTHON -c "$IMPORT_SYSCONFIG; \ ++ print (sysconfig.get_path ('platinclude'));"` ++ else ++ # old distutils way ++ python_path=`$PYTHON -c "$IMPORT_SYSCONFIG; \ ++ print (sysconfig.get_python_inc ());"` ++ plat_python_path=`$PYTHON -c "$IMPORT_SYSCONFIG; \ ++ print (sysconfig.get_python_inc (plat_specific=1));"` ++ fi + if test -n "${python_path}"; then + if test "${plat_python_path}" != "${python_path}"; then + python_path="-I$python_path -I$plat_python_path" +@@ -179,7 +221,7 @@ $ac_distutils_result]) + + # join all versioning strings, on some systems + # major/minor numbers could be in different list elements +-from distutils.sysconfig import * ++from sysconfig import * + e = get_config_var('VERSION') + if e is not None: + print(e) +@@ -190,7 +232,7 @@ EOD` + ac_python_version=$PYTHON_VERSION + else + ac_python_version=`$PYTHON -c "import sys; \ +- print (sys.version[[:3]])"` ++ print ("%d.%d" % sys.version_info[[:2]])"` + fi + fi + +@@ -202,8 +244,8 @@ EOD` + ac_python_libdir=`cat< +Date: Thu, 4 Jan 2024 10:02:11 +0100 +Subject: [PATCH] Update address of b.root-servers.net and some others + +Update recently changed root servers address in the drill tool. Update +also other addresses and expand IPv6 addresses. +--- + ldns-1.8.3/drill/root.c | 22 +++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +diff --git a/ldns-1.8.3/drill/root.c b/ldns-1.8.3/drill/root.c +index a829935..8705094 100644 +--- a/ldns-1.8.3/drill/root.c ++++ b/ldns-1.8.3/drill/root.c +@@ -28,26 +28,38 @@ init_root(void) + ldns_rr_list_push_rr(global_dns_root, r); + (void)ldns_rr_new_frm_str(&r, "A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:BA3E::2:30", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); +- (void)ldns_rr_new_frm_str(&r, "B.ROOT-SERVERS.NET. 3600000 A 192.228.79.201", 0, NULL, NULL); ++ (void)ldns_rr_new_frm_str(&r, "B.ROOT-SERVERS.NET. 3600000 A 170.247.170.2", 0, NULL, NULL); ++ ldns_rr_list_push_rr(global_dns_root, r); ++ (void)ldns_rr_new_frm_str(&r, "B.ROOT-SERVERS.NET. 3600000 AAAA 2801:1b8:10::B", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); + (void)ldns_rr_new_frm_str(&r, "C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); +- (void)ldns_rr_new_frm_str(&r, "D.ROOT-SERVERS.NET. 3600000 A 128.8.10.90", 0, NULL, NULL); ++ (void)ldns_rr_new_frm_str(&r, "C.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2::C", 0, NULL, NULL); ++ ldns_rr_list_push_rr(global_dns_root, r); ++ (void)ldns_rr_new_frm_str(&r, "D.ROOT-SERVERS.NET. 3600000 A 199.7.91.13", 0, NULL, NULL); ++ ldns_rr_list_push_rr(global_dns_root, r); ++ (void)ldns_rr_new_frm_str(&r, "D.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2D::D", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); + (void)ldns_rr_new_frm_str(&r, "E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); ++ (void)ldns_rr_new_frm_str(&r, "E.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:A8::E", 0, NULL, NULL); ++ ldns_rr_list_push_rr(global_dns_root, r); + (void)ldns_rr_new_frm_str(&r, "F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); + (void)ldns_rr_new_frm_str(&r, "F.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2F::F", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); + (void)ldns_rr_new_frm_str(&r, "G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); +- (void)ldns_rr_new_frm_str(&r, "H.ROOT-SERVERS.NET. 3600000 A 128.63.2.53", 0, NULL, NULL); ++ (void)ldns_rr_new_frm_str(&r, "G.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:12::D0D", 0, NULL, NULL); ++ ldns_rr_list_push_rr(global_dns_root, r); ++ (void)ldns_rr_new_frm_str(&r, "H.ROOT-SERVERS.NET. 3600000 A 198.97.190.53", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); +- (void)ldns_rr_new_frm_str(&r, "H.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:1::803F:235", 0, NULL, NULL); ++ (void)ldns_rr_new_frm_str(&r, "H.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:1::53", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); + (void)ldns_rr_new_frm_str(&r, "I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); ++ (void)ldns_rr_new_frm_str(&r, "I.ROOT-SERVERS.NET. 3600000 AAAA 2001:7FE::53", 0, NULL, NULL); ++ ldns_rr_list_push_rr(global_dns_root, r); + (void)ldns_rr_new_frm_str(&r, "J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); + (void)ldns_rr_new_frm_str(&r, "J.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:C27::2:30", 0, NULL, NULL); +@@ -58,7 +70,7 @@ init_root(void) + ldns_rr_list_push_rr(global_dns_root, r); + (void)ldns_rr_new_frm_str(&r, "L.ROOT-SERVERS.NET. 3600000 A 199.7.83.42", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); +- (void)ldns_rr_new_frm_str(&r, "L.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:3::42 ", 0, NULL, NULL); ++ (void)ldns_rr_new_frm_str(&r, "L.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:9F::42", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); + (void)ldns_rr_new_frm_str(&r, "M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33", 0, NULL, NULL); + ldns_rr_list_push_rr(global_dns_root, r); +-- +2.43.0 + diff --git a/ldns-1.7.0-CVE-2026-10846.patch b/ldns-1.8.3-CVE-2026-10846.patch similarity index 68% rename from ldns-1.7.0-CVE-2026-10846.patch rename to ldns-1.8.3-CVE-2026-10846.patch index 0cc663a..656d347 100644 --- a/ldns-1.7.0-CVE-2026-10846.patch +++ b/ldns-1.8.3-CVE-2026-10846.patch @@ -1,29 +1,11 @@ -From cc51382f8bf8bb5675e93ed16e816ccdfb1581ea Mon Sep 17 00:00:00 2001 -From: RHEL Packaging Agent -Date: Wed, 15 Jul 2026 09:22:45 +0000 -Subject: [PATCH] Fix CVE-2026-10846: validate DNS response source address and - query matching - -Adapted from upstream patch for ldns 1.9.0. Adds: -- ldns_sockaddr_cmp() to verify response comes from queried address -- Transaction ID matching check -- Query section count validation -- Response question matching against original query -- New error status codes for ID mismatch, qdcount, and query mismatch ---- - ldns-1.7.0_python3/error.c | 6 +++ - ldns-1.7.0_python3/ldns/error.h | 5 +- - ldns-1.7.0_python3/net.c | 92 ++++++++++++++++++++++++++++++++- - 3 files changed, 100 insertions(+), 3 deletions(-) - -diff --git a/ldns-1.7.0_python3/error.c b/ldns-1.7.0_python3/error.c -index 35ee5bd..a3103f8 100644 ---- a/ldns-1.7.0_python3/error.c -+++ b/ldns-1.7.0_python3/error.c -@@ -157,6 +157,12 @@ ldns_lookup_table ldns_error_str[] = { - "X509_STORE_CTX_set0_dane() functions within OpenSSL >= 1.1.0 " - "to be able to verify the DANE-TA usage type." }, - #endif +diff --git a/ldns-1.8.3/error.c b/ldns-1.8.3/error.c +index e3fd121..f046c96 100644 +--- a/ldns-1.8.3/error.c ++++ b/ldns-1.8.3/error.c +@@ -184,6 +184,12 @@ ldns_lookup_table ldns_error_str[] = { + { LDNS_STATUS_INVALID_SVCPARAM_VALUE, + "Invalid wireformat of a value " + "in the ServiceParam rdata field of SVCB or HTTPS RR" }, + { LDNS_STATUS_ID_DID_NOT_MATCH, + "Response ID did not match the query ID" }, + { LDNS_STATUS_QDCOUNT_MUST_BE_ONE, @@ -33,27 +15,27 @@ index 35ee5bd..a3103f8 100644 { 0, NULL } }; -diff --git a/ldns-1.7.0_python3/ldns/error.h b/ldns-1.7.0_python3/ldns/error.h -index 15f49a2..936df38 100644 ---- a/ldns-1.7.0_python3/ldns/error.h -+++ b/ldns-1.7.0_python3/ldns/error.h -@@ -129,7 +129,10 @@ enum ldns_enum_status { - LDNS_STATUS_RDATA_OVERFLOW, - LDNS_STATUS_SYNTAX_SUPERFLUOUS_TEXT_ERR, - LDNS_STATUS_NSEC3_DOMAINNAME_OVERFLOW, -- LDNS_STATUS_DANE_NEED_OPENSSL_GE_1_1_FOR_DANE_TA -+ LDNS_STATUS_DANE_NEED_OPENSSL_GE_1_1_FOR_DANE_TA, +diff --git a/ldns-1.8.3/ldns/error.h b/ldns-1.8.3/ldns/error.h +index 2429b77..5754f5a 100644 +--- a/ldns-1.8.3/ldns/error.h ++++ b/ldns-1.8.3/ldns/error.h +@@ -141,7 +141,10 @@ enum ldns_enum_status { + LDNS_STATUS_RESERVED_SVCPARAM_KEY, + LDNS_STATUS_NO_SVCPARAM_VALUE_EXPECTED, + LDNS_STATUS_SVCPARAM_KEY_MORE_THAN_ONCE, +- LDNS_STATUS_INVALID_SVCPARAM_VALUE ++ LDNS_STATUS_INVALID_SVCPARAM_VALUE, + LDNS_STATUS_ID_DID_NOT_MATCH, + LDNS_STATUS_QDCOUNT_MUST_BE_ONE, + LDNS_STATUS_QUERY_DID_NOT_MATCH }; typedef enum ldns_enum_status ldns_status; -diff --git a/ldns-1.7.0_python3/net.c b/ldns-1.7.0_python3/net.c -index 6e6a12b..53b4df5 100644 ---- a/ldns-1.7.0_python3/net.c -+++ b/ldns-1.7.0_python3/net.c -@@ -410,6 +410,50 @@ ldns_udp_bgsend(ldns_buffer *qbin, +diff --git a/ldns-1.8.3/net.c b/ldns-1.8.3/net.c +index 57d4dff..215c0ca 100644 +--- a/ldns-1.8.3/net.c ++++ b/ldns-1.8.3/net.c +@@ -441,6 +441,50 @@ ldns_udp_bgsend2(ldns_buffer *qbin, return ldns_udp_bgsend_from(qbin, to, tolen, NULL, 0, timeout); } @@ -104,7 +86,7 @@ index 6e6a12b..53b4df5 100644 static ldns_status ldns_udp_send_from(uint8_t **result, ldns_buffer *qbin, const struct sockaddr_storage *to , socklen_t tolen, -@@ -418,6 +462,8 @@ ldns_udp_send_from(uint8_t **result, ldns_buffer *qbin, +@@ -449,6 +493,8 @@ ldns_udp_send_from(uint8_t **result, ldns_buffer *qbin, { int sockfd; uint8_t *answer; @@ -113,7 +95,7 @@ index 6e6a12b..53b4df5 100644 sockfd = ldns_udp_bgsend_from(qbin, to, tolen, from, fromlen, timeout); -@@ -436,13 +482,21 @@ ldns_udp_send_from(uint8_t **result, ldns_buffer *qbin, +@@ -467,13 +513,21 @@ ldns_udp_send_from(uint8_t **result, ldns_buffer *qbin, * but returns a 'NETWORK_ERROR' much like a timeout. */ ldns_sock_nonblock(sockfd); @@ -136,7 +118,7 @@ index 6e6a12b..53b4df5 100644 *result = answer; return LDNS_STATUS_OK; -@@ -481,6 +535,10 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf +@@ -512,6 +566,10 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf assert(r != NULL); @@ -147,7 +129,7 @@ index 6e6a12b..53b4df5 100644 status = LDNS_STATUS_OK; rtt = ldns_resolver_rtt(r); ns_array = ldns_resolver_nameservers(r); -@@ -568,6 +626,16 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf +@@ -599,6 +657,16 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf ldns_resolver_set_nameserver_rtt(r, i, LDNS_RESOLV_RTT_INF); status = send_status; } @@ -164,7 +146,7 @@ index 6e6a12b..53b4df5 100644 /* obey the fail directive */ if (!reply_bytes) { -@@ -577,7 +645,7 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf +@@ -608,7 +676,7 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf LDNS_FREE(src); } LDNS_FREE(ns); @@ -173,7 +155,7 @@ index 6e6a12b..53b4df5 100644 } else { LDNS_FREE(ns); continue; -@@ -637,6 +705,26 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf +@@ -670,6 +738,26 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf #endif /* HAVE_SSL */ LDNS_FREE(reply_bytes); diff --git a/ldns-1.8.3-swig-4.3.patch b/ldns-1.8.3-swig-4.3.patch new file mode 100644 index 0000000..8a85ef8 --- /dev/null +++ b/ldns-1.8.3-swig-4.3.patch @@ -0,0 +1,116 @@ +From 4a74281b387c9fe8f0c22a3698f27ac27e03887b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Wed, 23 Oct 2024 23:08:54 +0200 +Subject: [PATCH] Use SWIG_AppendOutput to support swig 4.3 + +Swig has changed language specific AppendOutput functions. But helper +macro SWIG_AppendOutput remains unchanged. Use that everywhere instead +of SWIG_Python_AppendOutput, which would require one extra parameter +since swig 4.3.0. + +https://github.com/swig/swig/blob/v4.3.0/CHANGES.current#L376 +https://github.com/swig/swig/issues/2905 +--- + ldns-1.8.3/contrib/python/ldns_buffer.i | 2 +- + ldns-1.8.3/contrib/python/ldns_key.i | 2 +- + ldns-1.8.3/contrib/python/ldns_packet.i | 2 +- + ldns-1.8.3/contrib/python/ldns_rdf.i | 2 +- + ldns-1.8.3/contrib/python/ldns_resolver.i | 2 +- + ldns-1.8.3/contrib/python/ldns_rr.i | 2 +- + ldns-1.8.3/contrib/python/ldns_zone.i | 2 +- + 7 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/ldns-1.8.3/contrib/python/ldns_buffer.i b/ldns-1.8.3/contrib/python/ldns_buffer.i +index 5c2d583..0a3e389 100644 +--- a/ldns-1.8.3/contrib/python/ldns_buffer.i ++++ b/ldns-1.8.3/contrib/python/ldns_buffer.i +@@ -45,7 +45,7 @@ + /* Result generation, appends (ldns_buffer *) after the result. */ + %typemap(argout, noblock=1) (ldns_buffer **) + { +- $result = SWIG_Python_AppendOutput($result, ++ $result = SWIG_AppendOutput($result, + SWIG_NewPointerObj(SWIG_as_voidptr($1_buf), + SWIGTYPE_p_ldns_struct_buffer, SWIG_POINTER_OWN | 0)); + } +diff --git a/ldns-1.8.3/contrib/python/ldns_key.i b/ldns-1.8.3/contrib/python/ldns_key.i +index dc67e67..6a3c2db 100644 +--- a/ldns-1.8.3/contrib/python/ldns_key.i ++++ b/ldns-1.8.3/contrib/python/ldns_key.i +@@ -38,7 +38,7 @@ + /* result generation */ + %typemap(argout,noblock=1) (ldns_key **) + { +- $result = SWIG_Python_AppendOutput($result, SWIG_NewPointerObj(SWIG_as_voidptr($1_key), SWIGTYPE_p_ldns_struct_key, SWIG_POINTER_OWN | 0 )); ++ $result = SWIG_AppendOutput($result, SWIG_NewPointerObj(SWIG_as_voidptr($1_key), SWIGTYPE_p_ldns_struct_key, SWIG_POINTER_OWN | 0 )); + } + + %typemap(argout) ldns_rdf *r "Py_INCREF($input);" +diff --git a/ldns-1.8.3/contrib/python/ldns_packet.i b/ldns-1.8.3/contrib/python/ldns_packet.i +index c2d7a3b..8309808 100644 +--- a/ldns-1.8.3/contrib/python/ldns_packet.i ++++ b/ldns-1.8.3/contrib/python/ldns_packet.i +@@ -45,7 +45,7 @@ + /* Result generation, appends (ldns_pkt *) after the result. */ + %typemap(argout,noblock=1) (ldns_pkt **) + { +- $result = SWIG_Python_AppendOutput($result, ++ $result = SWIG_AppendOutput($result, + SWIG_NewPointerObj(SWIG_as_voidptr($1_pkt), + SWIGTYPE_p_ldns_struct_pkt, SWIG_POINTER_OWN | 0 )); + } +diff --git a/ldns-1.8.3/contrib/python/ldns_rdf.i b/ldns-1.8.3/contrib/python/ldns_rdf.i +index 60daf1a..c2e143a 100644 +--- a/ldns-1.8.3/contrib/python/ldns_rdf.i ++++ b/ldns-1.8.3/contrib/python/ldns_rdf.i +@@ -45,7 +45,7 @@ + /* Result generation, appends (ldns_rdf *) after the result. */ + %typemap(argout, noblock=1) (ldns_rdf **) + { +- $result = SWIG_Python_AppendOutput($result, ++ $result = SWIG_AppendOutput($result, + SWIG_NewPointerObj(SWIG_as_voidptr($1_rdf), + SWIGTYPE_p_ldns_struct_rdf, SWIG_POINTER_OWN | 0)); + } +diff --git a/ldns-1.8.3/contrib/python/ldns_resolver.i b/ldns-1.8.3/contrib/python/ldns_resolver.i +index 8468cce..8d0abc6 100644 +--- a/ldns-1.8.3/contrib/python/ldns_resolver.i ++++ b/ldns-1.8.3/contrib/python/ldns_resolver.i +@@ -45,7 +45,7 @@ + /* Result generation, appends (ldns_resolver *) after the result. */ + %typemap(argout,noblock=1) (ldns_resolver **r) + { +- $result = SWIG_Python_AppendOutput($result, ++ $result = SWIG_AppendOutput($result, + SWIG_NewPointerObj(SWIG_as_voidptr($1_res), + SWIGTYPE_p_ldns_struct_resolver, SWIG_POINTER_OWN | 0 )); + } +diff --git a/ldns-1.8.3/contrib/python/ldns_rr.i b/ldns-1.8.3/contrib/python/ldns_rr.i +index 2e0a071..c53955c 100644 +--- a/ldns-1.8.3/contrib/python/ldns_rr.i ++++ b/ldns-1.8.3/contrib/python/ldns_rr.i +@@ -45,7 +45,7 @@ + /* Result generation, appends (ldns_rr *) after the result. */ + %typemap(argout, noblock=1) (ldns_rr **) + { +- $result = SWIG_Python_AppendOutput($result, ++ $result = SWIG_AppendOutput($result, + SWIG_NewPointerObj(SWIG_as_voidptr($1_rr), + SWIGTYPE_p_ldns_struct_rr, SWIG_POINTER_OWN | 0 )); + } +diff --git a/ldns-1.8.3/contrib/python/ldns_zone.i b/ldns-1.8.3/contrib/python/ldns_zone.i +index bbb8d8f..3459478 100644 +--- a/ldns-1.8.3/contrib/python/ldns_zone.i ++++ b/ldns-1.8.3/contrib/python/ldns_zone.i +@@ -39,7 +39,7 @@ + /* result generation */ + %typemap(argout,noblock=1) (ldns_zone **) + { +- $result = SWIG_Python_AppendOutput($result, SWIG_NewPointerObj(SWIG_as_voidptr($1_zone), SWIGTYPE_p_ldns_struct_zone, SWIG_POINTER_OWN | 0 )); ++ $result = SWIG_AppendOutput($result, SWIG_NewPointerObj(SWIG_as_voidptr($1_zone), SWIGTYPE_p_ldns_struct_zone, SWIG_POINTER_OWN | 0 )); + } + + %nodefaultctor ldns_struct_zone; //no default constructor & destructor +-- +2.47.0 + diff --git a/ldns-1.8.3.tar.gz.asc b/ldns-1.8.3.tar.gz.asc new file mode 100644 index 0000000..0be0353 --- /dev/null +++ b/ldns-1.8.3.tar.gz.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEE3DTuXbJBe8wVHlEA5fj4IS93pJgFAmL6IjQACgkQ5fj4IS93 +pJhiJA//eHb2+DVUz4StIrTwfCd5VSe0xETUkg2m3qfUT+7+blf/w+8aRzN6dwhQ +bs44URFgmpy2dKUlC9Q2sCKX5RxLFI/8JnXWenaofIw/n320F0YhBN/kewH+8YTN +KN9CMFbEsAR1ortzPPsM4r56JeHgcTwEwwIhYX+WaC9n6QMqk7pJVC+B6vrW1Gjc +7loZ0vD1CeLSTKZrt9aknlQEjBe0CSpCAVOBlrh/fPghv9p0slIq6Ovol6Kt2w88 +OeheBWf6g/Ll4g1ke41VE40e3SETW5KxHsxyIuhUltaUyJHzpmrGac6ydoctipzT +nJzwPA9PUIt+dX2qOKlUDD7PwRIGqmOG1pV6x0wz7eJq7tIjPgxgNk+xF2rTKjyt +m3bRGgBOzYf0raOE1yGtnyanAtI9BK6HbsaEuLxsZswzNWByZ9Fgp5sOK5iTswQO +xl2nhH9chyf0ktxbHvla6zZIi/Jj1mAumiZbkWUg6LHnIORYOqdeKByCg/aFHuNX +t7IDpO9VL+EPdrrhnynX+JDRbAxxarQAYqOsi+ARWyygQ0tON+UyxJ2vtEoFQFhG +LMQoal2h9mohYl5pJoWigsnPKdN4JMIhyxEyAS5HreDoeB8YX8x64cuvySVkUlyr +Qi7eByrJuyw9YdWt8iWOO6chokzw9S3jOyuYiKH/G9cqMDpRgAY= +=lSAh +-----END PGP SIGNATURE----- diff --git a/ldns-swig-32bit.patch b/ldns-swig-32bit.patch new file mode 100644 index 0000000..5282c4b --- /dev/null +++ b/ldns-swig-32bit.patch @@ -0,0 +1,26 @@ +32-bit compatibility for Python SWIG bindings + +The ssize_t type can be int instead of long, and the pointer types are +incompatible. + +Submitted upstream: + +diff -ur ldns-1.8.3.orig/ldns-1.8.3/contrib/python/ldns.i ldns-1.8.3/ldns-1.8.3/contrib/python/ldns.i +--- ldns-1.8.3.orig/ldns-1.8.3/contrib/python/ldns.i 2022-08-15 12:38:22.000000000 +0200 ++++ ldns-1.8.3/ldns-1.8.3/contrib/python/ldns.i 2024-01-26 11:46:55.329133288 +0100 +@@ -99,12 +99,14 @@ + %typemap(in, noblock=1) (ssize_t) + { + int $1_res = 0; +- $1_res = SWIG_AsVal_long($input, &$1); ++ long val; ++ $1_res = SWIG_AsVal_long($input, &val); + if (!SWIG_IsOK($1_res)) { + SWIG_exception_fail(SWIG_ArgError($1_res), "in method '" + "$symname" "', argument " "$argnum" " of type '" + "$type""'"); + } ++ $1 = val; + } + + diff --git a/ldns-swig-4.2.patch b/ldns-swig-4.2.patch new file mode 100644 index 0000000..ce511ba --- /dev/null +++ b/ldns-swig-4.2.patch @@ -0,0 +1,60 @@ +SWIG_Python_str_AsChar removal in SWIG 4.2.0 + +The replacement, SWIG_PyUnicode_AsUTF8AndSize, has different memory +management requirements. + +Submitted upstream: + +diff -ur ldns-1.8.3.orig/ldns-1.8.3/contrib/python/ldns_rdf.i ldns-1.8.3/ldns-1.8.3/contrib/python/ldns_rdf.i +--- ldns-1.8.3.orig/ldns-1.8.3/contrib/python/ldns_rdf.i 2022-08-15 12:38:22.000000000 +0200 ++++ ldns-1.8.3/ldns-1.8.3/contrib/python/ldns_rdf.i 2024-01-26 11:28:52.983540469 +0100 +@@ -56,7 +56,11 @@ + */ + %typemap(arginit, noblock=1) const ldns_rdf * + { ++#if SWIG_VERSION >= 0x040200 ++ PyObject *$1_bytes = NULL; ++#else + char *$1_str = NULL; ++#endif + } + + /* +@@ -66,11 +70,17 @@ + %typemap(in, noblock=1) const ldns_rdf * (void* argp, $1_ltype tmp = 0, int res) + { + if (Python_str_Check($input)) { ++ const char *argstr; ++#if SWIG_VERSION >= 0x040200 ++ argstr = SWIG_PyUnicode_AsUTF8AndSize($input, NULL, &$1_bytes); ++#else + $1_str = SWIG_Python_str_AsChar($input); +- if ($1_str == NULL) { ++ argstr = $1_str; ++#endif ++ if (argstr == NULL) { + %argument_fail(SWIG_TypeError, "char *", $symname, $argnum); + } +- tmp = ldns_dname_new_frm_str($1_str); ++ tmp = ldns_dname_new_frm_str(argstr); + if (tmp == NULL) { + %argument_fail(SWIG_TypeError, "char *", $symname, $argnum); + } +@@ -90,10 +100,17 @@ + */ + %typemap(freearg, noblock=1) const ldns_rdf * + { ++#if SWIG_VERSION >= 0x040200 ++ if ($1_bytes != NULL) { ++ /* Is not NULL only when a conversion form string occurred. */ ++ Py_XDECREF($1_bytes); ++ } ++#else + if ($1_str != NULL) { + /* Is not NULL only when a conversion form string occurred. */ + SWIG_Python_str_DelForPy3($1_str); /* Is a empty macro for Python < 3. */ + } ++#endif + } + + %nodefaultctor ldns_struct_rdf; /* No default constructor. */ diff --git a/ldns.spec b/ldns.spec index 23840ab..6331fdf 100644 --- a/ldns.spec +++ b/ldns.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 %bcond_without python3 -%if 0%{?rhel} > 7 +%if 0%{?rhel} > 7 || 0%{?fedora} > 29 %bcond_with python2 %else %bcond_without python2 @@ -18,8 +18,6 @@ # GOST is not allowed in Fedora/RHEL due to legal reasons (not NIST ECC) %bcond_with gost -%{?!snapshot: %global snapshot 0} - %if %{with python2} || %{with python3} %{?filter_setup: %global _ldns_internal_filter /^_ldns[.]so.*/d; @@ -38,26 +36,37 @@ Summary: Low-level DNS(SEC) library with API Name: ldns -Version: 1.7.0 -Release: 23%{?dist} +Version: 1.8.3 +Release: 18%{?dist}.1 -License: BSD -Url: http://www.nlnetlabs.nl/%{name}/ -Source0: http://www.nlnetlabs.nl/downloads/%{name}/%{name}-%{version}.tar.gz +License: BSD-3-Clause +Url: https://www.nlnetlabs.nl/%{name}/ +Source0: https://www.nlnetlabs.nl/downloads/%{name}/%{name}-%{version}.tar.gz +Source1: https://www.nlnetlabs.nl/downloads/%{name}/%{name}-%{version}.tar.gz.asc +# Willem Toorop, https://www.nlnetlabs.nl/people/ +Source2: https://keys.openpgp.org/vks/v1/by-fingerprint/DC34EE5DB2417BCC151E5100E5F8F8212F77A498#/wtoorop.asc Patch1: ldns-1.7.0-multilib.patch -Patch2: ldns-1.7.0-parse-limit.patch -Patch3: ldns-1.7.0-realloc.patch -Patch4: ldns-1.7.0-coverity.patch -# https://src.fedoraproject.org/rpms/ldns/raw/rawhide/f/ldns-1.9.0-CVE-2026-10846.patch -Patch5: ldns-1.7.0-CVE-2026-10846.patch +# https://github.com/NLnetLabs/ldns/pull/204 +Patch2: ldns-1.8-python-dirs.patch +# https://github.com/NLnetLabs/ldns/pull/230 +Patch3: ldns-1.8-root-servers.net.patch +# https://github.com/NLnetLabs/ldns/pull/232 +Patch4: ldns-swig-4.2.patch +# https://github.com/NLnetLabs/ldns/pull/233 +Patch5: ldns-swig-32bit.patch +# https://github.com/NLnetLabs/ldns/pull/242 +Patch6: ldns-1.8-openssl-engine.patch +# Fix for SWIG 4.3.0 +# https://github.com/NLnetLabs/ldns/pull/256 +# https://github.com/NLnetLabs/ldns/pull/257 +Patch7: ldns-1.8.3-swig-4.3.patch +# https://nlnetlabs.nl/downloads/ldns/patch_cve_2026-10846.diff +Patch8: ldns-1.8.3-CVE-2026-10846.patch -Group: System Environment/Libraries -# Only needed for builds from svn snapshot -%if 0%{snapshot} BuildRequires: libtool BuildRequires: autoconf BuildRequires: automake -%endif +BuildRequires: autoconf-archive BuildRequires: gcc, make BuildRequires: libpcap-devel @@ -68,9 +77,8 @@ BuildRequires: openssl-devel >= 1.0.2k %endif BuildRequires: gcc-c++ BuildRequires: doxygen +BuildRequires: gnupg2 -# for snapshots only -# BuildRequires: libtool, autoconf, automake %if %{with python2} BuildRequires: python2-devel, swig %endif @@ -82,6 +90,8 @@ BuildRequires: perl-devel BuildRequires: perl-ExtUtils-MakeMaker BuildRequires: perl-generators BuildRequires: perl(Devel::CheckLib) +# workaround for koji / perl bug +BuildRequires: perl-interpreter %endif Requires: ca-certificates @@ -93,7 +103,6 @@ packets. %package devel Summary: Development package that includes the ldns header files -Group: Development/Libraries Requires: %{name}%{?_isa} = %{version}-%{release} Requires: pkgconfig openssl-devel @@ -102,7 +111,6 @@ The devel package contains the ldns library and the include files %package utils Summary: DNS(SEC) utilities for querying dns -Group: Applications/System Requires: %{name}%{?_isa} = %{version}-%{release} %description utils @@ -112,7 +120,6 @@ Collection of tools to get, check or alter DNS(SEC) data. %if %{with python2} %package -n python2-ldns Summary: Python2 extensions for ldns -Group: Applications/System Requires: %{name}%{?_isa} = %{version}-%{release} %{?python_provide:%python_provide python2-ldns} @@ -124,7 +131,6 @@ Python2 extensions for ldns %if %{with python3} %package -n python3-ldns Summary: Python3 extensions for ldns -Group: Applications/System Requires: %{name}%{?_isa} = %{version}-%{release} %{?python_provide:%python_provide python3-ldns} @@ -136,9 +142,7 @@ Python3 extensions for ldns %if %{with perl} %package -n perl-ldns Summary: Perl extensions for ldns -Group: Applications/System Requires: %{name}%{?_isa} = %{version}-%{release} -Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) %description -n perl-ldns Perl extensions for ldns @@ -146,7 +150,6 @@ Perl extensions for ldns %package doc Summary: Documentation for the ldns library -Group: Development/Libraries BuildArch: noarch %description doc @@ -154,22 +157,21 @@ This package contains documentation for the ldns library %prep %{?extra_version:%global pkgname %{name}-%{version}%{extra_version}}%{!?extra_version:%global pkgname %{name}-%{version}} +%if 0%{?fedora} +%gpgverify -d 0 -s 1 -k 2 +%endif -%setup -qcn %{pkgname} +%autosetup -cn %{pkgname} -N pushd %{pkgname} -%patch1 -p2 -b .multilib -%patch2 -p1 -b .limit -%patch3 -p1 -b .realloc -%patch4 -p1 -b .covscan -%patch5 -p2 -b .cve-2026-10846 -# To built svn snapshots -%if 0%{snapshot} - rm config.guess config.sub ltmain.sh - aclocal - libtoolize -c --install - autoreconf --install -%endif +%autopatch -p2 + +rm -f config.guess config.sub ltmain.sh +# Use ax_python_devel from autoconf-archive +cp -p %{_datadir}/aclocal/{ax_python_devel,ax_pkg_swig}.m4 . +aclocal +libtoolize -c --install +autoreconf --install # fixup .pc file sed -i "s/@includedir@/@includedir@\/ldns/" packaging/libldns.pc.in @@ -181,17 +183,17 @@ cp -p contrib/ldnsx/README ../README.ldnsx popd %if %{with python3} -mv %{pkgname} %{pkgname}_python3 +cp -a %{pkgname} %{pkgname}_python3 %endif %if %{with python2} -cp -a %{pkgname}_python3 %{pkgname}_python2 -%endif # with python2 +cp -a %{pkgname} %{pkgname}_python2 +%endif %build -CFLAGS="%{optflags} -fPIC" -CXXFLAGS="%{optflags} -fPIC" +CFLAGS="%{optflags} -fPIC -fno-strict-aliasing -DOPENSSL_NO_ENGINE" +CXXFLAGS="%{optflags} -fPIC -fno-strict-aliasing -DOPENSSL_NO_ENGINE" LDFLAGS="$RPM_LD_FLAGS -Wl,-z,now -pie" export CFLAGS CXXFLAGS LDFLAGS @@ -225,12 +227,11 @@ export CFLAGS CXXFLAGS LDFLAGS --with-trust-anchor=%{_sharedstatedir}/unbound/root.key \\\ --disable-static \\\ - %if 0%{with python3} pushd %{pkgname}_python3 %else pushd %{pkgname} -%endif # with python3 +%endif %configure \ %{common_args} \ @@ -240,15 +241,19 @@ pushd %{pkgname} --with-pyldns PYTHON=%{__python3} %endif -make %{?_smp_mflags} -make %{?_smp_mflags} doc +# Using 'make' instead of 'make_build' macro to prevent build from failing +make +%make_build doc + +# Multilib conflict avoidance +sed -e "s,-L%{_libdir},," -i packaging/ldns-config # We cannot use the built-in --with-p5-dns-ldns %if %{with perl} pushd contrib/DNS-LDNS LD_LIBRARY_PATH="../../lib:$LD_LIBRARY_PATH" perl \ Makefile.PL INSTALLDIRS=vendor INC="-I. -I../.." LIBS="-L../../lib" - make + %make_build -j1 popd %endif @@ -262,7 +267,8 @@ popd %{common_args} \ --with-pyldns PYTHON=%{__python2} - make %{?_smp_mflags} + %make_build + sed -e "s,-L%{_libdir},," -i packaging/ldns-config popd %endif @@ -277,8 +283,9 @@ pushd %{pkgname}_python3 pushd %{pkgname} %endif -make DESTDIR=%{buildroot} INSTALL="%{__install} -p" install -make DESTDIR=%{buildroot} INSTALL="%{__install} -p" install-doc +mkdir -p %{buildroot}%{_libdir}/pkgconfig +%make_install install +%make_install install-doc # remove .la files rm -rf %{buildroot}%{_libdir}/*.la @@ -286,18 +293,17 @@ rm -rf %{buildroot}%{_libdir}/*.la rm -rf %{buildroot}%{python3_sitearch}/*.la %endif -# install pkg-config file -install -D -m644 packaging/libldns.pc %{buildroot}%{_libdir}/pkgconfig/ldns.pc %if %{with perl} - make -C contrib/DNS-LDNS DESTDIR=%{buildroot} pure_install + %make_install -j1 -C contrib/DNS-LDNS pure_install chmod 755 %{buildroot}%{perl_vendorarch}/auto/DNS/LDNS/LDNS.so rm -f %{buildroot}%{perl_vendorarch}/auto/DNS/LDNS/{.packlist,LDNS.bs} + rm -f %{buildroot}%{perl_archlib}/perllocal.pod %endif popd %if %{with python2} pushd %{pkgname}_python2 - make DESTDIR=%{buildroot} INSTALL="%{__install} -p" install-pyldns install-pyldnsx + %make_install install-pyldns install-pyldnsx rm -rf %{buildroot}%{_libdir}/*.la %{buildroot}%{python2_sitearch}/*.la popd %endif @@ -314,7 +320,7 @@ rm -rf doc/man %files %doc README %license LICENSE -%{_libdir}/libldns.so.2* +%{_libdir}/libldns.so.3* %files utils %{_bindir}/drill @@ -322,52 +328,201 @@ rm -rf doc/man %{_bindir}/ldns-chaos %{_bindir}/ldns-compare-zones %{_bindir}/ldns-[d-z]* -%{_mandir}/man1/* +%{_mandir}/man1/drill* +%{_mandir}/man1/%{name}* %files devel %doc Changelog README.git %{_libdir}/libldns.so %{_libdir}/pkgconfig/ldns.pc %{_bindir}/ldns-config -%dir %{_includedir}/ldns -%{_includedir}/ldns/*.h -%{_mandir}/man3/*.3.gz +%dir %{_includedir}/%{name} +%{_includedir}/%{name}/*.h +%{_mandir}/man3/%{name}*.3* %if %{with python2} %files -n python2-ldns %doc %{pkgname}_python2/contrib/python/Changelog README.ldnsx %license LICENSE.ldnsx -%{python2_sitearch}/* +%{python2_sitearch}/%{name}.py* +%{python2_sitearch}/%{name}x.py* +%{python2_sitearch}/_%{name}.so* %endif %if %{with python3} %files -n python3-ldns %doc %{pkgname}_python3/contrib/python/Changelog README.ldnsx %license LICENSE.ldnsx -%{python3_sitearch}/* +%pycached %{python3_sitearch}/%{name}.py +%pycached %{python3_sitearch}/%{name}x.py +%{python3_sitearch}/_%{name}.so* %endif %if %{with perl} %files -n perl-ldns %{perl_vendorarch}/* %exclude %dir %{perl_vendorarch}/auto/ -%{_mandir}/man3/*.3pm.gz +%{_mandir}/man3/DNS::LDNS*.3pm.gz %endif %files doc %doc doc %changelog -* Wed Jul 15 2026 RHEL Packaging Agent - 1.7.0-23 -- Fix CVE-2026-10846: validate DNS response source address, transaction - ID, and query section matching -- Resolves: RHEL-210700 +* Fri Jul 17 2026 Fedor Vorobev - 1.8.3-18.1 +- Fix CVE-2026-10846: Off-path poisoning attacks due to insufficient + query-response matching (RHEL-210690) -* Tue Jan 16 2024 Petr Menšík - 1.7.0-22 -- Export ldns-utils, ldns-doc, perl-ldns and python3-ldns into CRB (RHEL-315) +* Tue Oct 29 2024 Jitka Plesnikova - 1.8.3-18 +- Fix for SWIG 4.3.0 -* Tue Jul 23 2019 Martin Osvald - 1.7.0-21 -- Fix for issues found by covscan (#1602571) +* Tue Oct 29 2024 Troy Dawson - 1.8.3-17 +- Bump release for October 2024 mass rebuild: + Resolves: RHEL-64018 + +* Thu Aug 08 2024 Troy Dawson - 1.8.3-16 +- Bump release for Aug 2024 java mass rebuild + +* Fri Jul 19 2024 Petr Menšík - 1.8.3-15 +- Remove unneeded openssl/engine.h causing build failures +- Explicitly disable openssl engine (RHEL-33736) + +* Mon Jun 24 2024 Troy Dawson - 1.8.3-14 +- Bump release for June 2024 mass rebuild + +* Fri Jan 26 2024 Florian Weimer - 1.8.3-13 +- SWIG 4.2 and i686 compatibility + +* Thu Jan 25 2024 Fedora Release Engineering - 1.8.3-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sun Jan 21 2024 Fedora Release Engineering - 1.8.3-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Jan 04 2024 Petr Menšík - 1.8.3-10 +- Update address of b.root-servers.net and some others (#2253462) + +* Thu Jul 20 2023 Fedora Release Engineering - 1.8.3-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Tue Jul 11 2023 Jitka Plesnikova - 1.8.3-8 +- Perl 5.38 rebuild + +* Tue Jun 13 2023 Python Maint - 1.8.3-7 +- Rebuilt for Python 3.12 + +* Wed Jan 25 2023 Petr Menšík - 1.8.3-6 +- Python packaging cleanups (#2155003) + +* Thu Jan 19 2023 Fedora Release Engineering - 1.8.3-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Tue Jan 17 2023 Petr Menšík - 1.8.3-4 +- Return back dist tag to release + +* Tue Jan 03 2023 Petr Menšík - 1.8.3-3 +- Use recent autoconf python detection (#2155003) +- Install python modules into separate directories + +* Fri Sep 30 2022 Petr Menšík - 1.8.3-2 +- Update License tag to SPDX identifier + +* Fri Aug 19 2022 Paul Wouters - 1.8.3-1 +- Update to 1.8.3 +- Remove --enable-rrtype-svcb-https, it is now enabled by default +- Bugfix #183: Assertion failure with OPT record without rdata. +- minor other fixups + +* Thu Jul 21 2022 Fedora Release Engineering - 1.8.1-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Mon Jun 13 2022 Python Maint - 1.8.1-6 +- Rebuilt for Python 3.11 + +* Tue May 31 2022 Jitka Plesnikova - 1.8.1-5 +- Perl 5.36 rebuild + +* Thu Jan 20 2022 Fedora Release Engineering - 1.8.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Wed Dec 08 2021 Richard Lescak - 1.8.1-3 +- Replaced 'make_build' macro with 'make' to prevent build from failing + +* Mon Dec 06 2021 Petr Menšík - 1.8.1-2 +- Enable svcb and https record type support +- Remove multilib conflict in ldns-devel + +* Mon Dec 06 2021 Paul Wouters - 1.8.1-1 +- Resolves: rhbz#2028465 Heap out-of-bound read vulnerability in rr_frm_str_internal function +- Resolves: rhbz#2028468 Heap out-of-bound read vulnerability in ldns_nsec3_salt_data function +- Resolves: rhbz#2028472 Fixed time memory compare for Openssl 0.9.8 + +* Mon Oct 11 2021 Richard Lescak - 1.7.1-10 +- Added patch for failing rebuild with OpenSSL 3.0.0 (#2010601) + +* Tue Sep 14 2021 Sahana Prasad - 1.7.1-9 +- Rebuilt with OpenSSL 3.0.0 + +* Thu Jul 22 2021 Fedora Release Engineering - 1.7.1-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Fri Jun 04 2021 Petr Menšík - 1.7.1-7 +- Support python3.10 builds (#1948435) + +* Fri Jun 04 2021 Python Maint - 1.7.1-6 +- Rebuilt for Python 3.10 + +* Fri May 21 2021 Jitka Plesnikova - 1.7.1-5 +- Perl 5.34 rebuild + +* Thu May 20 2021 Paul Wouters - 1.7.1-4 +- Resolves rhbz#1962010 drill fails on sig chase + +* Tue Jan 26 2021 Fedora Release Engineering - 1.7.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Mon Jan 04 2021 Petr Menšík - 1.7.1-2 +- Use make_build and make_install macro instead of make +- https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make + +* Thu Oct 08 2020 Petr Menšík - 1.7.1-1 +- Update to 1.7.1 + +* Tue Jul 28 2020 Fedora Release Engineering - 1.7.0-32 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jun 23 2020 Jitka Plesnikova - 1.7.0-31 +- Perl 5.32 rebuild + +* Tue May 26 2020 Miro Hrončok - 1.7.0-30 +- Rebuilt for Python 3.9 + +* Wed Jan 29 2020 Fedora Release Engineering - 1.7.0-29 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Thu Oct 03 2019 Miro Hrončok - 1.7.0-28 +- Rebuilt for Python 3.8.0rc1 (#1748018) + +* Mon Aug 19 2019 Miro Hrončok - 1.7.0-27 +- Rebuilt for Python 3.8 + +* Thu Jul 25 2019 Fedora Release Engineering - 1.7.0-26 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Fri May 31 2019 Jitka Plesnikova - 1.7.0-25 +- Perl 5.30 rebuild + +* Mon May 20 2019 Jitka Plesnikova - 1.7.0-24 +- Fixed build for SWIG 4.0.0 (#1707450) + +* Fri Feb 01 2019 Fedora Release Engineering - 1.7.0-23 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Wed Sep 26 2018 Petr Menšík - 1.7.0-22 +- Do not build python2 subpackage on Fedora 30 (#1629800) + +* Fri Jul 13 2018 Fedora Release Engineering - 1.7.0-21 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild * Tue Jul 10 2018 Petr Menšík - 1.7.0-20 - Add all depends, spec cleanup, use full python interpreter diff --git a/sources b/sources index 2b97c9f..08850c9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ldns-1.7.0.tar.gz) = 8a4e48bcc2a244b92447a9830b60efbb656fb7955f3559ef2eb6f8e724c4c0208776350c44ccf7dcf1ffe0b7b9d9ccc4cbddc5bc16e8888db494ab4d0bce3bd8 +SHA512 (ldns-1.8.3.tar.gz) = c318747bd975ade389d048680b80495fb083b46507d8dcea7d4d42c75823f56a35b438dcc5320803d39583e5a1e515a51686f7f9010c061a6e8199e1a5505ae9 diff --git a/wtoorop.asc b/wtoorop.asc new file mode 100644 index 0000000..475fb0a --- /dev/null +++ b/wtoorop.asc @@ -0,0 +1,99 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +xsFNBE1s81EBEACuJzGgccrmYEAzHc//vBq66gH7orM0GtKfQZHh4uR1FMxZXl07 +WevUYNuBywTpinU9rpY1Q3S4w6QgNklgpsaHXmbOpyFjJ8FpllV8TRPiXiNrNxTp +Mnlb6InoszopX69tkBVHTP6cJkNgPx6R4BM0ARqEGQmOL8mAcoWyGVzbsamuGRai +a54zs/kc3i9yiqEzRkoQmfwr7sr49n7gOpmaqXvonOSiUvgEziep77emMcqVa/qZ +xR1r7KUq85qTNTqsQwl2cQdKS7WwOeuG6ZIJmJ1bakriKzLBYF5xIHKSYJW0ZA20 +tNFrVKgTkEjiXvAJh4HlJEIi35tqa/IzWUJSc1ainhBjxbwSl8BRq5aaPgwB+xXi +DqY6BrQW1slvl5TF2A6Xr7JJ0rkH3EZgXxABAZ3WJ3RLwq1z8jnNYj+UW/mSLsbO +tgfOiBhFUXMZneHvVVvz6F6XAtyrejDl5sD2gnzm1VDfK6T6bvLtR7zrkWre0lpy +cDmgmUKgaEiXzfLvwT9RaWk8GdqU2GG+QOiwf+hT0peDieuodjMr59sUbx7GqVe/ +45rJBRSx+HCl2Jm7Th2Xr0kpStCd7ebVoEq9wpMyu+dM9wOTtibA9P3+9u4rAdim +pAdQxEbhWbRNCng2EVhThbqRK3cTZLbtqKaWgAJqa/IQVpL9b5ps8Z4JVQARAQAB +zSNXaWxsZW0gVG9vcm9wIDx3aWxsZW1AbmxuZXRsYWJzLm5sPsLBfgQTAQIAKAUC +TWzzUQIbIwUJCWYBgAYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQ5fj4IS93 +pJhdWw/+KJuX99jk5avFN4t9bbfDlfmMPXh+P7WYY4xB6ImupAy+WzAB2UfHGEyS +nv5q0eMq6aywgCgjhwuxScOnvfu1kWAdjAmbO907PdzLA7TWEdx0HZxJw7W4dlSi +HfthjP5gh/Fys9xmOp9MDa2BR26+W2/ZZhZDg7w5MDpmJyo/5qC5qBPU4knGudrP +dIpJqXmz+iQDbkcJnh0k7TMQzAQ0Hgvzr9TjZaBM0HW30d/2B6O4c4q/iFp9yVkl +F4XKYmuMm0dvREOWU2FUN8cVsaWGI2Ey4fibDkqdLYTkA+ZzPJCpbsBB0UmUsZ7A +0jFTu5TZBZhRkBNT3bYLnELt9xWvbuTvER5a/VYJKh92Yqcq+A+HaEJTJKinM1yA +WkmxxNPcJ5tpEUpcWSY4/yKpY7000tS8wxmXK5nBl/oxwhuJ5ifzbOgRKX/3B/U+ +bCWNq0B7fWGOwpYxelZcLIt0CjkkTY+CCVhC9vhESNzim7KSx+FQcrAMBPKg9M1w +Dy5zSLcD90vLjV9CNfvSgk9RWFLqm+BiVfiNgaUEbR9zDpvxA7MzX18D10rC7GWB +Tdkg6YW1ejtODGmfMQOrAzzPNqWwN7Nmg2VIS1ikRi15QU0nFwydtChb7HLSSpZU +NUuZbRPBSymU9nJeNvt2bVenntchw8okgiE5DX1vpl+Gf6b6E2nCwX4EEwECACgC +GyMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheABQJW1BOaBQkQ6+5JAAoJEOX4+CEv +d6SYhnwP/AtfvzPhGkCLVc0P4jwm2oAU6ljkorKTMyZ3vYJopicz7PpcYJ61zrmJ +SAcsB6VgdiZs+OYfgnOPnYuPFkH1fbRxDZ/TFRZMCs0nXGOr+XqLesUmORUR0ttu +jD0fVCfP8+T75Ys2VFW2zPjYMYN0cdOOUNBZ0JtKOVWrBCdT6EdwkohCyaGdd7pE +5OaUJSslZJ1Ch9RNXbPl7YNY6WQaoi4gc3C5ClmKgb61yOlwBD6/sKEYI98VfD9u +FI9t9riu8aHvNo1iHmVl7fwGxwUpjTljyIDHfYtxY3Xkw5pebGUstwZQ2DK/ISDX +p4WC4XS6SZ18D3LGo9Ir3FfsUoy7UodJhOILnXFYZOV0dTOnpkpQEwuvgap9DPST +U5+Eh4ZDUsqPO2j8CqlhQ5b4wGZUcj8pvZoiQZc3nIdrjpWEpOhhbnmnezKRgIqX ++T8DTUSgzA4t8vh+O2Btos266o93DmXamZhK8K8wlPMVZMc2PxGOsPzDTBTXqpl1 +RscyGfMvSgIx+iTvejPwMUuJlxyYdaHHx7UpvdAIcvxzySvtvufiIJAMpirL8iG7 +47OxXHDFKPjokj1mIvsTvzVwOKQZVLhpleeSqIO8ptX5c6PDg/bh3yz61TkQR4J7 +CE283/b4CdHpsvH8TApMxU99+IAtTlYQ9X39X62z18lW3BiPADvqwsGPBBMBAgA5 +AhsjBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgBYhBNw07l2yQXvMFR5RAOX4+CEv +d6SYBQJeCb+wAAoJEOX4+CEvd6SYsQ4P/RbnQYVbk59L9pneTsF+gGBJgSmCzfBQ +/EUK+TDguxERxItJ0T2MV8haHuwaJLXI/+RAZmv/JSdHnycCMav17HIH3RWyARCp +SVuSzmcKpBlmsxxlGAcIHQiK1hmp7AF+X8Y43+aoClMRBeBMlLvTCLrrzbxfsDII +DqQ+BR8OXlX/M4TQYqbx6M20oggSexw0dTCk2nBMX8R6BToWjoiHj9sy+mBHK0KA +iLW12ZYRN7IqMvsBIgZkvSRmRN+FBlX5Xk2BOgOcwXE/Kd2+/nsWKnaZRI+QABZG +GCoCkvv3sL8oylzWYIrjeDqAPbUo/TV7nLPUGdJzT00nuG4sdgMVApEEJ9tRm4l7 +QpKJulGCY0RhpZPWzEHLGo9tOZYOC9FfLhMaGQ+bbXAupEAJWbKZ38qIUd1oHk3N +bOsLkLR5ZIKzajOIO7JLN/z/vWwjyk3COoEin/zMDxkj0BmsKSDN64R7IoFyNbw7 +zeImTHZL0ILQoGuvK9OLZDCK0df5bEmcaU4U0tAbh+n3/oQO49QQqCZupqKigKAP +JThodg8WlSsdNzxpqNqEnb3BxeRaQiubqsGZbNP/7TmPKusyXQehKZkiqHCC0Yet +bD5ucLEFlXYk7KcMTSf7PjOHw3itDW+8Je7foJxH/rZgVOWItUqjCQW2o76iboM7 +wwHCz8WhifD8zsFNBE1s81EBEACk7OIVs/eCuuj7bB4/3AbR5iQicfQbBz/HqFI3 +eIgUe3FoE04LdTxgjQcwjxiLlImvNPHasbtS/Dlo0KcFwwo16gIm59JgiTETjVbM +8SSpI2J2RihjqPHIOzpkAWchHeqq38VX/3cBy7HUEyWc8/WxjsbmFQALtKtzx1uY +BhXPqad3jeO6sxjMRI7KBE4/3JWsY6orKIRtd/4ZD+j7w6A+zjnThnUED/G+BkQQ ++q2fxajC7+AvNMw58wh9ay6TRkKZX9Wp8tOlkwLAy+H+oBACx+tkyMTl+FO1sXrr +x8cilzgLjfnsfzLxdms9duGG3Fgu7dXalVt8rNtMymnpnpsl0isVemjJ+CgXCRdw +nTNaAAWQ8r4i/Xpe0P8kMpaWQuhJeEKMGjyDgLsznSHOnLjOj01rwQK3ClYEIVny +bIX3hZn5Mac/4VnPSuNMgo5m/oT2SK90W10rECLVFJAajkjBza6CIF/iGljKt3u8 +jB3TKpSq9JVOdpXwW3xAo5XgfzTuCt0hiQT804C7c3vi7FsUiUKEDFir+iEsEK1t +67JlI6oEDa0hkTl960cvDb7s62r7OGtxZnVKRyFsNin2NjOgLF/RwRbkbIpoKhY0 +JuVW6lwOzbRyQpwNUb6l5YP4iecPgxJR6LMcIx0vlG3owxplUPiE6pYd/fdaLD42 +atSMtQARAQABwsFkBBgBAgAPBQJNbPNRAhsMBQkJZgGAAAoJEOX4+CEvd6SY7XQP ++OHNW6pjHXXf8Yoqon3vnEFhGNF4CSocMnw8xkH9dLyXbzobXaUrlc/qaGGLMfKq +7m+C8w7ZNOuY3gEFh4pIFPyBETntSzqjVuPJYsQi8L5NPVn46eZJE5ZChygqZRnN +Cx8/A2Fa6iI7J278vFzUkheHwX9wsJZ679zFRiNEOZtBgO/XXBGFqD1raR5mD4IQ +52Yk8ah9mIuvk2fSa4Tctd+McwPClHxMI4c0rdzLeXD2wZLz9d1fdRJ+KJ8msv2g +VitEoDLtRa4fyFXcpn1UElzNNsFvIH5DibD05f9F/mAyilOzIlNIaP8NPYrKC7B4 +HuH+YvLA5vxGj1fM95XO2fKyfjy20W/EF71MqWmjZNxknqXFfwMlIF6qd/2d+EQx +w75TKXc4KNDjLAARy7iF5xMbRLH8Umews/8SXnJVwjMjn8boyIRNYT2rdoM+SafZ +R/rms86zWy3c4qD3HzhPdP7NpSGuB84zMuXrLHnRAK2Pms4qAGfBtZD2HdGKsCHW +ZgWqdFtZRNgw3kyfYdzIiTVLGmID2RilwjF7bV8YjY0M9tqxHJV49vQdMImHG7sp +Y7EUWasLTEIg3a+xTCDsusqxzsYKUi7MiDvR1TnKYc3UkzxBL6/WMdA+/yOyOkFk +cp4yI2lH9iL+eaF0kxVOmjCyV+P9+X8LLhuMZfyFvZjCwWUEGAECAA8CGwwFAlbU +E5oFCRDr7kkACgkQ5fj4IS93pJjBwxAAnko5CSFDX/ZqW97satNacACHSAOOM8/j +z1p2QtJSwbrbLsJRMpN1mSnjXWPBTmXoP4SGHGtxTVZxrYCpSMEHMqOV4yK3QlUn +QXnf+CSvo2Ud3rpCh/lFLVHqG2Sy5Ietf/T+GGsoPd9DIdTHO0aFlW2yRQPxSrbY +pv1v2aACgRO4114qkex2j36diqlLod/OU4OQ51nuSesjTrUM9Fz6ikBJ1UDjakjA +Xe/HiRxUmdv4LANCmso+Gn17Co5lUdpn3fa8zTwNNAgLm6RBiBSSdaYExM9ir6pH +rcWL5N+iZKnVmfE5CBufziZq7V1E3I4FRuvDN4echbf58c6YxBQDsd9VZMJeFWY6 +0w4JEXpHQdt129GS1FN/2PQ8NmAUXYCkYYk6Lv1tnGJCSLnD3ObLyWm+sjA5yAK2 +H8WU+nutsDF63yFJujNMpmB3bi9+699TzsyQNVKd2fH38cgk1gZFb6Nbx9+lrTIw +zAJJlOu8UwbR0HgGuRmrWp0EIm3tcy4xqWF3CavnM22BAOKKKH+qnwx8BRrx58co +HQFMswW4W7Bo+jpKbQJ4RV2cXUEbmHbYUoXDHZyv/RzOI46dXAoWFc3oCoqLqpsZ +YZstJ4UJHXB5aHi1zxJDwzKxsflmSKfIUr3glRWCy/ylcPMEXzPBb3qbGFMUboio +UjqLuNV4SSbCwXYEGAECACACGwwWIQTcNO5dskF7zBUeUQDl+PghL3ekmAUCXgm/ +sAAKCRDl+PghL3ekmJ0MEAClDfBdTdxua0YHcqK0Y1/fjRL2Up+rBQGWbJ4JDtX1 +p8t8/T6BkvZ9zqynajtlPTXcL3VhC8rhSL/t7KXejJ+g0mC0n6o4PYvmBgtwIkDa +EUflV9RVkP02rRS6avqNS28tOLFgAYSonOqQsXgj12NgsxOw0n1LTMAbD4XiuCYa +UDbelOPu8duECB28XIr6U6ufVe32QfCaVIKDdZOwxAHrPTBHdYjijOmbnCoMdUN3 +pWkvA40Vu5yZflPXmrn2twVbd/id3i9y60OnqeCAzRJECaDsCcrQc1UCXBpBNKXZ +EozuIxKHLDXEEVU2oTms7mFVMmHs6hw8VJbQCagbsY58skds2WsgwqF/NvlCNI7b +m8M9axTKgncyA/J9zz59AJZnBwLEjZwr+JiISPraH3Om53TXLrSWTI6GANTJhIYM +dU0rUKbQED/2UTcFdk2RUdtIMEFldaf+Ufxk5T96JTXQvTo8tAJhTAS2W8ezyO+R +1SdsLRfGqu76NopbRDNZNc4ZdEruTr/0xAauiYag+VM6aiT1erU8++hBF38efAMR +YX1ZMrYni1wjyNJEE1n3p3sXfQ1ADQqGv032CBDou2ByRmMfw6Y30j304Q8Uxn1r +dFmjCC6TqvmExQOOvH0FucYHlbyZQTa8uHU9V14FW3vx/gje6uwtGNTYNdVTnzuu +Vw== +=0pAG +-----END PGP PUBLIC KEY BLOCK-----