开源软件构建与测试

_service:tar_scm:unbound.spec Changed

@@ -1,10 +1,10 @@
 %{!?delete_la: %global delete_la  find $RPM_BUILD_ROOT -type f -name "*.la" -delete}
 
 Name:          unbound
-Version:       1.13.2
-Release:       3
+Version:       1.17.1
+Release:       1
 Summary:       Unbound is a validating, recursive, caching DNS resolver
-License:       BSD
+License:       BSD-3-Clause
 Url:           https://nlnetlabs.nl/projects/unbound/about/
 Source:        https://nlnetlabs.nl/downloads/unbound/%{name}-%{version}.tar.gz
 Source1:       unbound.service
@@ -21,7 +21,6 @@
 Source12:      unbound-anchor.timer
 Source13:      unbound-anchor.service
 
-Patch0:        backport-fix-q-doesnt-work-when-use-with-unbound-control-stats_shm.patch
 Patch1:        unbound-remove-buildin-key.patch
 
 BuildRequires: make flex swig pkgconfig systemd
@@ -30,6 +29,7 @@
 
 %{?systemd_requires}
 Requires:      %{name}-libs = %{version}-%{release}
+Requires:      openssl
 
 %description
 Unbound is a validating, recursive, caching DNS resolver. It is designed
@@ -84,13 +84,13 @@
             --enable-relro-now --enable-pie \\\
             --enable-subnet --enable-ipsecmod \\\
             --with-conf-file=%{_sysconfdir}/%{name}/unbound.conf \\\
-            --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid \\\
+            --with-pidfile=%{_rundir}/%{name}/%{name}.pid \\\
             --enable-sha2 --disable-gost --enable-ecdsa \\\
             --with-rootkey-file=%{_sharedstatedir}/unbound/root.key \\\
             --enable-linux-ip-local-port-range
 
 pushd %{name}-%{version}
-%configure --with-pythonmodule --with-pyunbound PYTHON=%{__python3} \%{configure_args}
+%configure --with-pythonmodule --with-pyunbound PYTHON=%{__python3} --disable-sha1 %{configure_args}
 %make_build
 %make_build streamtcp
 popd
@@ -124,12 +124,7 @@
 
 %delete_la
 
-for mpage in ub_ctx ub_result ub_ctx_create ub_ctx_delete ub_ctx_set_option ub_ctx_get_option ub_ctx_config ub_ctx_set_fwd ub_ctx_resolvconf ub_ctx_hosts ub_ctx_add_ta ub_ctx_add_ta_file ub_ctx_trustedkeys ub_ctx_debugout ub_ctx_debuglevel ub_ctx_async ub_poll ub_wait ub_fd ub_process ub_resolve ub_resolve_async ub_cancel ub_resolve_free ub_strerror ub_ctx_print_local_zones ub_ctx_zone_add ub_ctx_zone_remove ub_ctx_data_add ub_ctx_data_remove;
-do
-  echo ".so man3/libunbound.3" > $RPM_BUILD_ROOT%{_mandir}/man3/$mpage ;
-done
-
-install -d $RPM_BUILD_ROOT%{_localstatedir}/run/unbound
+install -d $RPM_BUILD_ROOT%{_rundir}/unbound
 
 install -d $RPM_BUILD_ROOT%{_sysconfdir}/unbound/{keys.d,conf.d,local.d}
 install -p %{SOURCE6} $RPM_BUILD_ROOT%{_sysconfdir}/unbound/keys.d/
@@ -186,6 +181,7 @@
 %defattr(-,root,root)
 %doc doc/CREDITS doc/FEATURES doc/README doc/LICENSE
 %attr(0644,root,root) %{_tmpfilesdir}/unbound.conf
+%attr(0755,unbound,unbound) %dir %{_rundir}/%{name}
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/%{name}
 %dir %attr(0755,root,unbound) %{_sysconfdir}/%{name}/keys.d
@@ -238,6 +234,42 @@
 %{_mandir}/man*
 
 %changelog
+* Tue Mar 07 2023 gaihuiying <eaglegai@163.com> - 1.17.1-1
+- Type:requirement
+- CVE:NA
+- SUG:NA
+- DESC:update to 1.17.1
+
+* Fri Mar 03 2023 gaihuiying <eaglegai@163.com> - 1.17.0-2
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:change run directory from /var/run to /run to fix "/usr/lib/tmpfiles.d/unbound.conf:1: xxxx"
+
+* Tue Nov 08 2022 gaihuiying <eaglegai@163.com> - 1.17.0-1
+- Type:requirement
+- CVE:NA
+- SUG:NA
+- DESC:update to 1.17.0
+
+* Thu Sep 22 2022 xingwei <xingwei14@h-partners.com> - 1.13.2-6
+- Type:cves
+- CVE:CVE-2022-3204
+- SUG:NA
+- DESC:fix CVE-2022-3204
+
+* Wed Aug 03 2022 yanglu <yanglu72@h-partners.com> - 1.13.2-5
+- Type:cves
+- CVE:CVE-2022-30689 CVE-2022-30699
+- SUG:NA
+- DESC:fix CVE-2022-30689 and CVE-2022-30699
+
+* Tue Aug 02 2022 gaihuiying <eaglegai@163.com> - 1.13.2-4
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:rebuild to 1.13.2-4
+
 * Sat Jun 11 2022 gaihuiying <eaglegai@163.com> - 1.13.2-3
 - Type:bugfix
 - CVE:NA

_service:tar_scm:backport-fix-q-doesnt-work-when-use-with-unbound-control-stats_shm.patch Deleted

@@ -1,46 +0,0 @@
-From c60bed8eef8962c6f7d8deb266d438ff77baaaf5 Mon Sep 17 00:00:00 2001
-From: eaglegai <eaglegai@163.com>
-Date: Fri, 18 Mar 2022 19:08:02 +0800
-Subject: PATCH fix -q doesn't work when use with 'unbound-control stats_shm'
-
-Signed-off-by: eaglegai <eaglegai@163.com>
----
- smallapp/unbound-control.c | 11 +++++++----
- 1 file changed, 7 insertions(+), 4 deletions(-)
-
-diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
-index c7c38276f..b0835e3e1 100644
---- a/smallapp/unbound-control.c
-+++ b/smallapp/unbound-control.c
-@@ -444,7 +444,7 @@ static void do_stats_shm(struct config_file* cfg, struct ub_stats_info* stats,
- #endif /* HAVE_SHMGET */
- 
- /** print statistics from shm memory segment */
--static void print_stats_shm(const char* cfgfile)
-+static void print_stats_shm(const char* cfgfile, int quiet)
- {
- #ifdef HAVE_SHMGET
- 	struct config_file* cfg;
-@@ -474,8 +474,11 @@ static void print_stats_shm(const char* cfgfile)
- 		fatal_exit("shmat(%d): %s", id_arr, strerror(errno));
- 	}
- 
--	/* print the stats */
--	do_stats_shm(cfg, stats, shm_stat);
-+
-+	if (!quiet) {
-+		/* print the stats */
-+		do_stats_shm(cfg, stats, shm_stat);
-+	}
- 
- 	/* shutdown */
- 	shmdt(shm_stat);
-@@ -987,7 +990,7 @@ int main(int argc, char* argv)
- #endif
- 	}
- 	if(argc >= 1 && strcmp(argv0, "stats_shm")==0) {
--		print_stats_shm(cfgfile);
-+		print_stats_shm(cfgfile, quiet);
- 		return 0;
- 	}
- 	check_args_for_listcmd(argc, argv);

_service Changed

_service:tar_scm:tmpfiles-unbound.conf Changed

_service:tar_scm:unbound-1.13.2.tar.gz -> _service:tar_scm:unbound-1.17.1.tar.gz Changed

_service:tar_scm:unbound.conf Changed

@@ -5,9 +5,13 @@
 #
 # this is a comment.
 
-#Use this to include other text into the file.
+# Use this anywhere in the file to include other text into this file.
 #include: "otherfile.conf"
 
+# Use this anywhere in the file to include other text, that explicitly starts a
+# clause, into this file. Text after this directive needs to start a clause.
+#include-toplevel: "otherfile.conf"
+
 # The server clause sets the main parameters.
 server:
 	# whitespace is not necessary, but looks cleaner.
@@ -37,6 +41,11 @@
 	# Needs to be enabled for munin plugin
 	extended-statistics: yes
 
+	# Inhibits selected extended statistics (qtype, qclass, qopcode, rcode,
+	# rpz-actions) from printing if their value is 0.
+	# Default on.
+	# statistics-inhibit-zero: yes
+
 	# number of threads to create. 1 disables threading.
 	num-threads: 4
 
@@ -67,6 +76,10 @@
 	# NOTE: If deploying on non-default port, eg 80/443, this needs to be disabled
 	interface-automatic: no
 
+	# instead of the default port, open additional ports separated by
+	# spaces when interface-automatic is enabled, by listing them here.
+	# interface-automatic-ports: ""
+
 	# port to answer queries from
 	# port: 53
 
@@ -86,19 +99,22 @@
 	# Set this to yes to prefer ipv6 upstream servers over ipv4.
 	# prefer-ip6: no
 
+	# Prefer ipv4 upstream servers, even if ipv6 is available.
+	# prefer-ip4: no
+
 	# number of ports to allocate per thread, determines the size of the
 	# port range that can be open simultaneously.  About double the
 	# num-queries-per-thread, or, use as many as the OS will allow you.
 	# outgoing-range: 4096
 
-	# permit unbound to use this port number or port range for
+	# permit Unbound to use this port number or port range for
 	# making outgoing queries, using an outgoing interface.
 	# Only ephemeral ports are allowed by SElinux
 	outgoing-port-permit: 32768-60999
 
-	# deny unbound the use this of port number or port range for
+	# deny Unbound the use this of port number or port range for
 	# making outgoing queries, using an outgoing interface.
-	# Use this to make sure unbound does not grab a UDP port that some
+	# Use this to make sure Unbound does not grab a UDP port that some
 	# other server on this computer needs. The default is to avoid
 	# IANA-assigned port numbers.
 	# If multiple outgoing-port-permit and outgoing-port-avoid options
@@ -122,6 +138,7 @@
 	# so-sndbuf: 0
 
 	# use SO_REUSEPORT to distribute queries over threads.
+	# at extreme load it could be better to turn it off to distribute even.
 	so-reuseport: yes
 
 	# use IP_TRANSPARENT so the interface: addresses can be non-local
@@ -134,9 +151,14 @@
 	# Linux only.  On Linux you also have ip-transparent that is similar.
 	# ip-freebind: no
 
+	# the value of the Differentiated Services Codepoint (DSCP)
+	# in the differentiated services field (DS) of the outgoing
+	# IP packets
+	# ip-dscp: 0
+
 	# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
-	# is set with msg-buffer-size). 1472 can solve fragmentation (timeouts).
-	# edns-buffer-size: 4096
+	# is set with msg-buffer-size).
+	# edns-buffer-size: 1232
 
 	# Maximum UDP response size (not applied to TCP response).
 	# Suggested values are 512 to 4096. Default is 4096. 65536 disables it.
@@ -144,6 +166,9 @@
 	# Helps mitigating DDOS
 	max-udp-size: 3072
 
+	# max memory to use for stream(tcp and tls) waiting result buffers.
+	# stream-wait-size: 4m
+
 	# buffer size for handling DNS data. No messages larger than this
 	# size can be sent or received, by UDP or TCP. In bytes.
 	# msg-buffer-size: 65552
@@ -166,6 +191,26 @@
 	# msec to wait before close of port on timeout UDP. 0 disables.
 	# delay-close: 0
 
+	# perform connect for UDP sockets to mitigate ICMP side channel.
+	# udp-connect: yes
+
+	# The number of retries, per upstream nameserver in a delegation, when
+	# a throwaway response (also timeouts) is received.
+	# outbound-msg-retry: 5
+
+	# Hard limit on the number of outgoing queries Unbound will make while
+	# resolving a name, making sure large NS sets do not loop.
+	# It resets on query restarts (e.g., CNAME) and referrals.
+	# max-sent-count: 32
+
+	# Hard limit on the number of times Unbound is allowed to restart a
+	# query upon encountering a CNAME record.
+	# max-query-restarts: 11
+
+	# msec for waiting for an unknown server to reply.  Increase if you
+	# are behind a slow satellite link, to eg. 1128.
+	# unknown-server-time-limit: 376
+
 	# the amount of memory to use for the RRset cache.
 	# plain value in bytes or you can append k, m or G. default is "4Mb".
 	# rrset-cache-size: 4m
@@ -193,6 +238,12 @@
 	# minimum wait time for responses, increase if uplink is long. In msec.
 	# infra-cache-min-rtt: 50
 
+	# maximum wait time for responses. In msec.
+	# infra-cache-max-rtt: 120000
+
+	# enable to make server probe down hosts more frequently.
+	# infra-keep-probing: no
+
 	# the number of slabs to use for the Infrastructure cache.
 	# the number of slabs must be a power of 2.
 	# more slabs reduce lock contention, but fragment memory usage.
@@ -201,7 +252,8 @@
 	# the maximum number of hosts that are cached (roundtrip, EDNS, lame).
 	# infra-cache-numhosts: 10000
 
-	# define a number of tags here, use with local-zone, access-control.
+	# define a number of tags here, use with local-zone, access-control,
+	# interface-*.
 	# repeat the define-tag statement to add additional tags.
 	# define-tag: "tag1 tag2 tag3"
 
@@ -212,7 +264,7 @@
 	# do-ip6: yes
 
 	# Enable UDP, "yes" or "no".
-	# NOTE: if setting up an unbound on tls443 for public use, you might want to
+	# NOTE: if setting up an Unbound on tls443 for public use, you might want to
 	# disable UDP to avoid being used in DNS amplification attacks.
 	# do-udp: yes
 
@@ -235,12 +287,23 @@
 	# Default is 0, system default MSS.
 	# outgoing-tcp-mss: 0
 
-	# Fedora note: do not activate this - can cause a crash
+	# Idle TCP timeout, connection closed in milliseconds
+	# tcp-idle-timeout: 30000
+
+	# Enable EDNS TCP keepalive option.
+	edns-tcp-keepalive: yes
+
+	# Timeout for EDNS TCP keepalive, in msec.
+	# edns-tcp-keepalive-timeout: 120000
+
+	# Fedora note: do not activate this - not compiled in because
+	# it causes frequent unbound crashes. Also, socket activation
+	# is bad when you have things like dnsmasq also running with libvirt.
 	# Use systemd socket activation for UDP, TCP, and control sockets.
 	# use-systemd: no
 
 	# Detach from the terminal, run in background, "yes" or "no".
-	# Set the value to "no" when unbound runs as systemd service.
+	# Set the value to "no" when Unbound runs as systemd service.
 	# do-daemonize: yes
 
 	# control which clients are allowed to make (recursive) queries
@@ -251,9 +314,7 @@
 	# allow_snoop (recursive and nonrecursive ok)
 	# deny_non_local (drop queries unless can be answered from local-data)
 	# refuse_non_local (like deny_non_local but polite error reply).
-	# access-control: 0.0.0.0/0 refuse
 	# access-control: 127.0.0.0/8 allow
-	# access-control: ::0/0 refuse
 	# access-control: ::1 allow
 	# access-control: ::ffff:127.0.0.1 allow
 
@@ -262,7 +323,7 @@
 	# are tagged with one of these tags.
 	# access-control-tag: 192.0.2.0/24 "tag2 tag3"
 
-	# set action for particular tag for given access control element
+	# set action for particular tag for given access control element.

_service:tar_scm:unbound.service Changed

Changes of Revision 2