- 9.5.0rc1 releasebind-9_5_0-32_rc1_fc9

- bind-9.5-libcap.patch merged to upstream
- initialize memory in ACL code correctly (#446848)

5 files changed, 31 insertions, 266 deletions

diff --git a/.cvsignore b/.cvsignore
index a75ba58..4ee1ba9 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,4 +1,4 @@
-bind-9.5.0b3.tar.gz
 bind-chroot.tar.bz2
 config-3.tar.bz2
 libbind-man.tar.gz
+bind-9.5.0rc1.tar.gz
diff --git a/bind-9.5-initialize.patch b/bind-9.5-initialize.patch
new file mode 100644
index 0000000..39101ff
--- /dev/null
+++ b/bind-9.5-initialize.patch
@@ -0,0 +1,19 @@
+diff -up bind-9.5.0rc1/lib/isc/radix.c.init bind-9.5.0rc1/lib/isc/radix.c
+--- bind-9.5.0rc1/lib/isc/radix.c.init	2008-05-22 17:11:59.000000000 +0200
++++ bind-9.5.0rc1/lib/isc/radix.c	2008-05-22 17:12:43.000000000 +0200
+@@ -323,6 +323,7 @@ isc_radix_insert(isc_radix_tree_t *radix
+ 		if (node == NULL)
+ 			return (ISC_R_NOMEMORY);
+ 		node->bit = bitlen;
++		node->node_num[0] = node->node_num[1] = -1;
+ 		result = _ref_prefix(radix->mctx, &node->prefix, prefix);
+ 		if (result != ISC_R_SUCCESS) {
+ 			isc_mem_put(radix->mctx, node,
+@@ -351,7 +352,6 @@ isc_radix_insert(isc_radix_tree_t *radix
+ 		} else {
+ 			node->node_num[ISC_IS6(family)] =
+ 				++radix->num_added_node;
+-			node->node_num[!ISC_IS6(family)] = -1;
+ 			node->data[0] = NULL;
+ 			node->data[1] = NULL;
+ 		}
diff --git a/bind-9.5-libcap.patch b/bind-9.5-libcap.patch
deleted file mode 100644
index 3140eff..0000000
--- a/bind-9.5-libcap.patch
+++ /dev/null
@@ -1,259 +0,0 @@
-diff -up bind-9.5.0b3/bin/named/unix/os.c.libcap bind-9.5.0b3/bin/named/unix/os.c
---- bind-9.5.0b3/bin/named/unix/os.c.libcap	2008-01-30 05:55:51.000000000 +0100
-+++ bind-9.5.0b3/bin/named/unix/os.c	2008-05-05 10:56:00.000000000 +0200
-@@ -69,7 +69,7 @@ static int devnullfd = -1;
- /*
-  * Linux defines:
-  *	(T) HAVE_LINUXTHREADS
-- *	(C) HAVE_LINUX_CAPABILITY_H
-+ *	(C) HAVE_SYS_CAPABILITY_H (or HAVE_LINUX_CAPABILITY_H)
-  *	(P) HAVE_SYS_PRCTL_H
-  * The possible cases are:
-  *	none:	setuid() normally
-@@ -116,16 +116,9 @@ static int dfd[2] = { -1, -1 };
- static isc_boolean_t non_root = ISC_FALSE;
- static isc_boolean_t non_root_caps = ISC_FALSE;
- 
--#if defined(HAVE_CAPSET)
--#undef _POSIX_SOURCE
- #ifdef HAVE_SYS_CAPABILITY_H
- #include <sys/capability.h>
- #else
--#include <linux/capability.h>
--int capset(cap_user_header_t hdrp, const cap_user_data_t datap);
--#endif
--#include <sys/prctl.h>
--#else
- /*%
-  * We define _LINUX_FS_H to prevent it from being included.  We don't need
-  * anything from it, and the files it includes cause warnings with 2.2
-@@ -133,9 +126,20 @@ int capset(cap_user_header_t hdrp, const
-  * and <string.h>) on 2.3 kernels.
-  */
- #define _LINUX_FS_H
--
--#include <sys/syscall.h>	/* Required for syscall(). */
--#include <linux/capability.h>	/* Required for _LINUX_CAPABILITY_VERSION. */
-+#include <linux/capability.h>
-+#ifdef HAVE_CAPSET
-+int capset(cap_user_header_t hdrp, const cap_user_data_t datap);
-+#else
-+/* We don't have libcap or capset, let's use syscall*/
-+#include <syscall.h>
-+#ifndef SYS_capset
-+#ifndef __NR_capset
-+#include <asm/unistd.h> /* Slackware 4.0 needs this. */
-+#endif /* __NR_capset */
-+#define SYS_capset __NR_capset
-+#endif /* SYS_capset */
-+#endif /* HAVE_CAPSET */
-+#endif /* HAVE_SYS_CAPABILITY_H */
- 
- #ifdef HAVE_SYS_PRCTL_H
- #include <sys/prctl.h>		/* Required for prctl(). */
-@@ -152,23 +156,28 @@ int capset(cap_user_header_t hdrp, const
- 
- #endif /* HAVE_SYS_PRCTL_H */
- 
--#ifndef SYS_capset
--#ifndef __NR_capset
--#include <asm/unistd.h> /* Slackware 4.0 needs this. */
--#endif
--#define SYS_capset __NR_capset
--#endif
--#endif
-+#ifdef HAVE_LIBCAP
-+#define SETCAPS_FUNC "cap_set_proc "
-+#else
-+typedef unsigned int cap_t;
-+#ifdef HAVE_CAPSET
-+#define SETCAPS_FUNC "capset "
-+#else
-+#define SETCAPS_FUNC "syscall(capset) "
-+#endif /* HAVE_CAPSET */
-+#endif /* HAVE_LIBCAP */
- 
- static void
--linux_setcaps(unsigned int caps) {
-+linux_setcaps(cap_t caps) {
-+#ifndef HAVE_LIBCAP
- 	struct __user_cap_header_struct caphead;
- 	struct __user_cap_data_struct cap;
-+#endif
- 	char strbuf[ISC_STRERRORSIZE];
- 
- 	if ((getuid() != 0 && !non_root_caps) || non_root)
- 		return;
--
-+#ifndef HAVE_LIBCAP
- 	memset(&caphead, 0, sizeof(caphead));
- 	caphead.version = _LINUX_CAPABILITY_VERSION;
- 	caphead.pid = 0;
-@@ -176,46 +185,76 @@ linux_setcaps(unsigned int caps) {
- 	cap.effective = caps;
- 	cap.permitted = caps;
- 	cap.inheritable = 0;
--#ifdef HAVE_CAPSET
-+#endif
-+#ifdef HAVE_LIBCAP
-+	if (cap_set_proc(caps) < 0) {
-+#elif defined(HAVE_CAPSET)
- 	if (capset(&caphead, &cap) < 0 ) {
--		isc__strerror(errno, strbuf, sizeof(strbuf));
--		ns_main_earlyfatal("capset failed: %s:"
--				   " please ensure that the capset kernel"
--				   " module is loaded.  see insmod(8)",
--				   strbuf);
--	}
- #else
- 	if (syscall(SYS_capset, &caphead, &cap) < 0) {
-+#endif
- 		isc__strerror(errno, strbuf, sizeof(strbuf));
--		ns_main_earlyfatal("syscall(capset) failed: %s:"
-+		ns_main_earlyfatal(SETCAPS_FUNC "failed: %s:"
- 				   " please ensure that the capset kernel"
- 				   " module is loaded.  see insmod(8)",
- 				   strbuf);
- 	}
--#endif
- }
- 
-+#ifdef HAVE_LIBCAP
-+#define SET_CAP(flag) \
-+	do { \
-+		capval = (flag); \
-+		err = cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); \
-+		if (err == -1) { \
-+			isc__strerror(errno, strbuf, sizeof(strbuf)); \
-+			ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
-+		} \
-+		\
-+		err = cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); \
-+		if (err == -1) { \
-+			isc__strerror(errno, strbuf, sizeof(strbuf)); \
-+			ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
-+		} \
-+	} while (0)
-+#define INIT_CAP \
-+	do { \
-+		caps = cap_init(); \
-+		if (caps == NULL) { \
-+			isc__strerror(errno, strbuf, sizeof(strbuf)); \
-+			ns_main_earlyfatal("cap_init failed: %s", strbuf); \
-+		} \
-+	} while (0)
-+#else
-+#define SET_CAP(flag) { caps |= (1 << (flag)); }
-+#define INIT_CAP { caps = 0; }
-+#endif /* HAVE_LIBCAP */
-+
- static void
- linux_initialprivs(void) {
--	unsigned int caps;
-+	cap_t caps;
-+#ifdef HAVE_LIBCAP
-+	cap_value_t capval;
-+	char strbuf[ISC_STRERRORSIZE];
-+	int err;
-+#endif
- 
- 	/*%
- 	 * We don't need most privileges, so we drop them right away.
- 	 * Later on linux_minprivs() will be called, which will drop our
- 	 * capabilities to the minimum needed to run the server.
- 	 */
--
--	caps = 0;
-+	INIT_CAP;
- 
- 	/*
- 	 * We need to be able to bind() to privileged ports, notably port 53!
- 	 */
--	caps |= (1 << CAP_NET_BIND_SERVICE);
-+	SET_CAP(CAP_NET_BIND_SERVICE);
- 
- 	/*
- 	 * We need chroot() initially too.
- 	 */
--	caps |= (1 << CAP_SYS_CHROOT);
-+	SET_CAP(CAP_SYS_CHROOT);
- 
- #if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
- 	/*
-@@ -224,19 +263,19 @@ linux_initialprivs(void) {
- 	 * tried) or we're not using threads.  If either of these is
- 	 * true, we want the setuid capability.
- 	 */
--	caps |= (1 << CAP_SETUID);
-+	SET_CAP(CAP_SETUID);
- #endif
- 
- 	/*
- 	 * Since we call initgroups, we need this.
- 	 */
--	caps |= (1 << CAP_SETGID);
-+	SET_CAP(CAP_SETGID);
- 
- 	/*
- 	 * Without this, we run into problems reading a configuration file
- 	 * owned by a non-root user and non-world-readable on startup.
- 	 */
--	caps |= (1 << CAP_DAC_READ_SEARCH);
-+	SET_CAP(CAP_DAC_READ_SEARCH);
- 
- 	/*
- 	 * XXX  We might want to add CAP_SYS_RESOURCE, though it's not
-@@ -245,15 +284,21 @@ linux_initialprivs(void) {
- 	 * of files, the stack size, data size, and core dump size to
- 	 * support named.conf options, this is now being added to test.
- 	 */
--	caps |= (1 << CAP_SYS_RESOURCE);
-+	SET_CAP(CAP_SYS_RESOURCE);
- 
- 	linux_setcaps(caps);
- }
- 
- static void
- linux_minprivs(void) {
--	unsigned int caps;
-+	cap_t caps;
-+#ifdef HAVE_LIBCAP
-+	cap_value_t capval;
-+	char strbuf[ISC_STRERRORSIZE];
-+	int err;
-+#endif
- 
-+	INIT_CAP;
- 	/*%
- 	 * Drop all privileges except the ability to bind() to privileged
- 	 * ports.
-@@ -262,8 +307,7 @@ linux_minprivs(void) {
- 	 * chroot() could be used to escape from the chrooted area.
- 	 */
- 
--	caps = 0;
--	caps |= (1 << CAP_NET_BIND_SERVICE);
-+	SET_CAP(CAP_NET_BIND_SERVICE);
- 
- 	/*
- 	 * XXX  We might want to add CAP_SYS_RESOURCE, though it's not
-@@ -272,7 +316,7 @@ linux_minprivs(void) {
- 	 * of files, the stack size, data size, and core dump size to
- 	 * support named.conf options, this is now being added to test.
- 	 */
--	caps |= (1 << CAP_SYS_RESOURCE);
-+	SET_CAP(CAP_SYS_RESOURCE);
- 
- 	linux_setcaps(caps);
- }
-diff -up bind-9.5.0b3/configure.in.libcap bind-9.5.0b3/configure.in
---- bind-9.5.0b3/configure.in.libcap	2008-01-30 05:55:51.000000000 +0100
-+++ bind-9.5.0b3/configure.in	2008-05-05 10:53:11.000000000 +0200
-@@ -1876,6 +1876,7 @@ AC_ARG_ENABLE(linux-caps,
- case "$enable_linux_caps" in
- 	yes|'')
- 		AC_CHECK_HEADERS(linux/capability.h sys/capability.h)
-+		AC_CHECK_LIB(cap, cap_set_proc)
- 		AC_CHECK_FUNCS(capset)
- 		;;
- 	no)
diff --git a/bind.spec b/bind.spec
index 5c111f5..d24da7e 100644
--- a/bind.spec
+++ b/bind.spec
@@ -2,7 +2,7 @@
 #               Red Hat BIND package .spec file
 #
 
-%define RELEASEVER b3
+%define RELEASEVER rc1
 
 %{?!SDB:        %define SDB         1}
 %{?!LIBBIND:    %define LIBBIND	    1}
@@ -18,7 +18,7 @@ Summary: 	The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name: 		bind
 License: 	ISC
 Version: 	9.5.0
-Release: 	31.1.%{RELEASEVER}%{?dist}
+Release: 	32.%{RELEASEVER}%{?dist}
 Epoch:   	32
 Url: 		http://www.isc.org/products/BIND/
 Buildroot:	%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -57,9 +57,9 @@ Patch63:	bind-9.4.0-dnssec-directory.patch
 Patch71:	bind-9.5-overflow.patch
 Patch72:	bind-9.5-dlz-64bit.patch
 Patch87:	bind-9.5-parallel-build.patch
-Patch90:	bind-9.5-libcap.patch
 Patch91:	bind-9.5-recv-race.patch
 Patch92:	bind-9.5-edns.patch
+Patch93:	bind-9.5-initialize.patch
 
 # SDB patches
 Patch11: 	bind-9.3.2b2-sdbsrc.patch
@@ -182,7 +182,6 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 %patch5 -p1 -b .nonexec
 %patch10 -p1 -b .PIE
 %patch16 -p1 -b .redhat_doc
-%patch90 -p1 -b .libcap
 %if %{SDB}
 mkdir bin/named-sdb
 cp -r bin/named/* bin/named-sdb
@@ -241,6 +240,7 @@ cp -fp contrib/dbus/{dbus_mgr.h,dbus_service.h} bin/named/include/named
 %patch87 -p1 -b .parallel
 %patch91 -p1 -b .recv-race
 %patch92 -p1 -b .edns
+%patch93 -p1 -b .init
 :;
 
 
@@ -395,7 +395,7 @@ for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.int
   echo '@ in soa localhost. root 1 3H 15M 1W 1D
   ns localhost.' > sample/var/named/$f; 
 done
-/usr/bin/tail -n '+'`/bin/egrep -n '\\$Id: bind.spec,v 1.261 2008/05/21 10:30:55 atkac Exp $/+1/' | bc` bin/rndc/rndc.conf | sed '/Sample rndc configuration file./{p;i\
+/usr/bin/tail -n '+'`/bin/egrep -n '\\$Id: bind.spec,v 1.262 2008/05/22 15:26:41 atkac Exp $/+1/' | bc` bin/rndc/rndc.conf | sed '/Sample rndc configuration file./{p;i\
  *\
  * NOTE: you only need to create this file if it is to\
  * differ from the following default contents:
@@ -646,6 +646,11 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_sbindir}/bind-chroot-admin
 
 %changelog
+* Thu May 22 2008 Adam Tkac <atkac redhat com> 32:9.5.0-31.9.rc1
+- 9.5.0rc1 release
+- bind-9.5-libcap.patch merged to upstream
+- initialize memory in ACL code correctly (#446848)
+
 * Tue May 20 2008 Adam Tkac <atkac redhat com> 32:9.5.0-31.1.b3
 - bind-chroot now depends on bind (#446477)
 
diff --git a/sources b/sources
index 42af33a..9682981 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
-9dbacfd7a957efd36e30736d579ed519  bind-9.5.0b3.tar.gz
 4faa4395b955e5f8a3d50f308b9fabc8  bind-chroot.tar.bz2
 d4bc7234a0d7b93328335ed9c076c6e9  config-3.tar.bz2
 13fef79f99fcefebb51d84b08805de51  libbind-man.tar.gz
+bf50ba674a8e2f9a762d423eba7dc01a  bind-9.5.0rc1.tar.gz