回合上游社区补丁,补丁数量：8

【是否新引入rpm包，是否进行了安全编译选项扫描】

否

【定位分析】

<table><tbody><tr><td>软件包</td><td>补丁名</td><td>描述</td><td>影响分析</td><td>分析人</td></tr><tr><td>openEuler:bind</td><td>backport-05-Recreate-listeners-on-DNS-transport-change.patch</td><td>Recreate listeners on DNS transport change
This commit ensures that listeners are recreated on reconfiguration inthe case when their type changes .
Previously, if a listen-on statement was modified to represent adifferent transport, BIND would not pick-up the change onreconfiguration if listener type changes  for a giveninterface address and port combination. This commit fixes that byrecreating the listener.
Initially, that worked for most of the new transports as we wouldrecreate listeners on each reconfiguration for DoH and DoT. But atsome point we changed that in such a way that listeners were notrecreated to avoid rebinding a port as on some platforms only root cando that for port numbers &lt;1000, making some ports binding possibleonly on start-up. We chose to asynchronously update listener socketsettings  instead.
Now, we both avoid recreating the sockets if unnecessary and recreatelisteners when listener type changes.

The DNS_GETDB_STALEFIRST flag is defined as 0x0C, which is thecombination of the DNS_GETDB_PARTIAL  , which isan obvious error.
All the flags should be power of two, so they don't interfere witheach other. Fix the DNS_GETDB_STALEFIRST flag by setting it to 0x10.

The older version of the code was reporting that listeners are goingto be of the same type after reconfiguration when switching from DoTto HTTPS listener, making BIND abort its executions.
That was happening due to the flaw in logic due to which the codecould consider a current listener and a configuration for the new oneto be of the same type  even when the new listener entry isexplicitly marked as HTTP.
The checks for PROXY in between the configuration were masking thatbehaviour, but when porting it to 9.18 , the behaviour was exposed.
Now the code mirrors the logic in 'interface_setup.

When getting a SERVFAIL reply from a query, 'host' tries to startthe next query in the lookup's list ,all the queries in the lookup start from the beginning, so that logicbrings to a crash because of the attempted start of the query whichwas already started.
Don't start the next query in the affected code path when in +nssearchmode.

dns__cacherbt_expireheader can unlink / free header_prev underneathit. Use ISC_LIST_TAIL after calling dns__cacherbt_expireheaderinstead to get the next pointer to be processed.

The Depends relation refers to types of rollovers in which a certainrecord type is going to be swapped. Specifically, the Depends relationsays there should be no dependency on the predecessor key .
But if the key is phased out  is not consideredempty.
This slows down key rollovers, only retiring keys when the successorkey has been fully propagated.

When connecting to a remote party the TLS DNS code could process morethan one message at a time despite the fact that it is expected thatwe should stop after every DNS message.
Every DNS message is handled and consumed from the input buffer byisc__nm_process_sock_buffer. That, in turn means that we canprocess more than one message at a time. Some higher level code mightnot expect that, as it breaks the contract.
In particular, in the original report that happened duringisc__nm_async_tlsdnsshutdown.

Just remove the key from consideration as it is being removed.
The old code could leak a key reference as dst_free_key was notcalled every time we continued. This simplification will addressthis as well.

否

【是否修改引入】

**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

src-openEuler/bind

内容风险标识

评论 (3)

src-openEuler/bind .gitee-modal { width: 500px !important; }

内容风险标识