From owner-svn-ports-all@freebsd.org Tue Jun 11 12:19:42 2019 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id EE18415B92E7; Tue, 11 Jun 2019 12:19:41 +0000 (UTC) (envelope-from mat@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 8FC308964A; Tue, 11 Jun 2019 12:19:41 +0000 (UTC) (envelope-from mat@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 6B1AF16F4; Tue, 11 Jun 2019 12:19:41 +0000 (UTC) (envelope-from mat@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id x5BCJfwS046559; Tue, 11 Jun 2019 12:19:41 GMT (envelope-from mat@FreeBSD.org) Received: (from mat@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id x5BCJeSN046552; Tue, 11 Jun 2019 12:19:40 GMT (envelope-from mat@FreeBSD.org) Message-Id: <201906111219.x5BCJeSN046552@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: mat set sender to mat@FreeBSD.org using -f From: Mathieu Arnold Date: Tue, 11 Jun 2019 12:19:40 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Subject: svn commit: r503956 - in branches/2019Q2/dns: bind9-devel bind9-devel/files bind914 bind914/files X-SVN-Group: ports-branches X-SVN-Commit-Author: mat X-SVN-Commit-Paths: in branches/2019Q2/dns: bind9-devel bind9-devel/files bind914 bind914/files X-SVN-Commit-Revision: 503956 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: 8FC308964A X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.96 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.999,0]; NEURAL_HAM_SHORT(-0.96)[-0.958,0]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US] X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Jun 2019 12:19:42 -0000 Author: mat Date: Tue Jun 11 12:19:40 2019 New Revision: 503956 URL: https://svnweb.freebsd.org/changeset/ports/503956 Log: MFH: r503955 Fix named when using plugins and chroot. BIND9 introduced plugins and migrated the filter-aaaa feature to a plugin. As it loads its plugins late in the startup process (read after chroot), the plugins need to be available in the chroot. Also, refactor the code now that a second directory need to be handled. PR: 238011 Reported by: ryan@timewasted.me Modified: branches/2019Q2/dns/bind9-devel/Makefile branches/2019Q2/dns/bind9-devel/files/named.in branches/2019Q2/dns/bind914/Makefile branches/2019Q2/dns/bind914/files/named.in Directory Properties: branches/2019Q2/ (props changed) Modified: branches/2019Q2/dns/bind9-devel/Makefile ============================================================================== --- branches/2019Q2/dns/bind9-devel/Makefile Tue Jun 11 12:18:36 2019 (r503955) +++ branches/2019Q2/dns/bind9-devel/Makefile Tue Jun 11 12:19:40 2019 (r503956) @@ -9,7 +9,7 @@ PORTREVISION= 0 .else # XXX: correct version # dns/bind9xx here -PORTREVISION= 0 +PORTREVISION= 2 .endif CATEGORIES= dns net ipv6 # XXX: put the ISC master_site Modified: branches/2019Q2/dns/bind9-devel/files/named.in ============================================================================== --- branches/2019Q2/dns/bind9-devel/files/named.in Tue Jun 11 12:18:36 2019 (r503955) +++ branches/2019Q2/dns/bind9-devel/files/named.in Tue Jun 11 12:19:40 2019 (r503956) @@ -143,19 +143,10 @@ chroot_autoupdate() fi fi - # The OpenSSL engines should be present in the chroot, named loads them - # after chrooting. - if [ -d ${_openssl_engines} ]; then - mkdir -p ${named_chrootdir}${_openssl_engines} - if can_mount nullfs ; then - mount -t nullfs ${_openssl_engines} ${named_chrootdir}${_openssl_engines} - else - warn "named chroot: cannot nullfs mount OpenSSL" \ - "engines into the chroot, will copy the shared" \ - "libraries instead." - cp -f ${_openssl_engines}/*.so ${named_chrootdir}${_openssl_engines} - fi - fi + # The OpenSSL engines and BIND9 plugins should be present in the + # chroot, named loads them after chrooting. + null_mount_or_copy ${_openssl_engines} + null_mount_or_copy %%PREFIX%%/lib/named # Copy and/or update key files to the chroot /etc # @@ -239,13 +230,8 @@ named_stop() named_poststop() { if [ -n "${named_chrootdir}" ]; then - # if using OpenSSL from ports, unmount OpenSSL engines, if they - # were not mounted but only copied, do nothing. - if [ -d ${_openssl_engines} ]; then - if can_mount nullfs; then - umount ${named_chrootdir}${_openssl_engines} - fi - fi + null_umount %%PREFIX%%/lib/named + null_umount ${_openssl_engines} if [ -c ${named_chrootdir}/dev/null ]; then # unmount /dev if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then @@ -271,6 +257,36 @@ can_mount() return 0 fi return 1 +} + +null_mount_or_copy() +{ + local dir + dir=$1 + + if [ -d ${dir} ]; then + mkdir -p ${named_chrootdir}${dir} + if can_mount nullfs ; then + mount -t nullfs ${dir} ${named_chrootdir}${dir} + else + warn "named chroot: cannot nullfs mount OpenSSL" \ + "engines into the chroot, will copy the shared" \ + "libraries instead." + cp -f ${dir}/*.so ${named_chrootdir}${dir} + fi + fi +} + +null_umount() +{ + local dir + dir=$1 + + if [ -d ${dir} ]; then + if can_mount nullfs; then + umount ${named_chrootdir}${dir} + fi + fi } create_file() Modified: branches/2019Q2/dns/bind914/Makefile ============================================================================== --- branches/2019Q2/dns/bind914/Makefile Tue Jun 11 12:18:36 2019 (r503955) +++ branches/2019Q2/dns/bind914/Makefile Tue Jun 11 12:19:40 2019 (r503956) @@ -8,7 +8,7 @@ PORTVERSION= ${ISCVERSION:S/-P/P/:S/b/.b/:S/a/.a/:S/rc PORTREVISION= 0 .else # dns/bind913 here -PORTREVISION= 1 +PORTREVISION= 2 .endif CATEGORIES= dns net ipv6 MASTER_SITES= ISC/bind9/${ISCVERSION} Modified: branches/2019Q2/dns/bind914/files/named.in ============================================================================== --- branches/2019Q2/dns/bind914/files/named.in Tue Jun 11 12:18:36 2019 (r503955) +++ branches/2019Q2/dns/bind914/files/named.in Tue Jun 11 12:19:40 2019 (r503956) @@ -143,19 +143,10 @@ chroot_autoupdate() fi fi - # The OpenSSL engines should be present in the chroot, named loads them - # after chrooting. - if [ -d ${_openssl_engines} ]; then - mkdir -p ${named_chrootdir}${_openssl_engines} - if can_mount nullfs ; then - mount -t nullfs ${_openssl_engines} ${named_chrootdir}${_openssl_engines} - else - warn "named chroot: cannot nullfs mount OpenSSL" \ - "engines into the chroot, will copy the shared" \ - "libraries instead." - cp -f ${_openssl_engines}/*.so ${named_chrootdir}${_openssl_engines} - fi - fi + # The OpenSSL engines and BIND9 plugins should be present in the + # chroot, named loads them after chrooting. + null_mount_or_copy ${_openssl_engines} + null_mount_or_copy %%PREFIX%%/lib/named # Copy and/or update key files to the chroot /etc # @@ -239,13 +230,8 @@ named_stop() named_poststop() { if [ -n "${named_chrootdir}" ]; then - # if using OpenSSL from ports, unmount OpenSSL engines, if they - # were not mounted but only copied, do nothing. - if [ -d ${_openssl_engines} ]; then - if can_mount nullfs; then - umount ${named_chrootdir}${_openssl_engines} - fi - fi + null_umount %%PREFIX%%/lib/named + null_umount ${_openssl_engines} if [ -c ${named_chrootdir}/dev/null ]; then # unmount /dev if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then @@ -271,6 +257,36 @@ can_mount() return 0 fi return 1 +} + +null_mount_or_copy() +{ + local dir + dir=$1 + + if [ -d ${dir} ]; then + mkdir -p ${named_chrootdir}${dir} + if can_mount nullfs ; then + mount -t nullfs ${dir} ${named_chrootdir}${dir} + else + warn "named chroot: cannot nullfs mount OpenSSL" \ + "engines into the chroot, will copy the shared" \ + "libraries instead." + cp -f ${dir}/*.so ${named_chrootdir}${dir} + fi + fi +} + +null_umount() +{ + local dir + dir=$1 + + if [ -d ${dir} ]; then + if can_mount nullfs; then + umount ${named_chrootdir}${dir} + fi + fi } create_file()