summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristian Ruppert <idl0r@gentoo.org>2018-06-19 10:03:14 +0200
committerChristian Ruppert <idl0r@gentoo.org>2018-06-19 10:03:27 +0200
commited0e614b9f561112b74c28c0f4ce9343164861ac (patch)
tree9a20e129e692a46df1b1d1a397179da42dc59654
parentsys-apps/sysvinit: Bump to version 2.90 (diff)
downloadgentoo-ed0e614b9f561112b74c28c0f4ce9343164861ac.tar.gz
gentoo-ed0e614b9f561112b74c28c0f4ce9343164861ac.tar.bz2
gentoo-ed0e614b9f561112b74c28c0f4ce9343164861ac.zip
net-dns/bind: Revbumps re bug 657654 / CVE-2018-5738
Package-Manager: Portage-2.3.40, Repoman-2.3.9
-rw-r--r--net-dns/bind/bind-9.11.3-r1.ebuild (renamed from net-dns/bind/bind-9.11.3.ebuild)3
-rw-r--r--net-dns/bind/bind-9.12.1_p2-r1.ebuild (renamed from net-dns/bind/bind-9.12.1_p2.ebuild)3
-rw-r--r--net-dns/bind/files/bind-9.11.3-CVE-2018-5738.patch110
-rw-r--r--net-dns/bind/files/bind-9.12.1_p2-CVE-2018-5738.patch95
4 files changed, 211 insertions, 0 deletions
diff --git a/net-dns/bind/bind-9.11.3.ebuild b/net-dns/bind/bind-9.11.3-r1.ebuild
index 4da95bc7613..74e4fcd1fc1 100644
--- a/net-dns/bind/bind-9.11.3.ebuild
+++ b/net-dns/bind/bind-9.11.3-r1.ebuild
@@ -109,6 +109,9 @@ src_prepare() {
"${i}" || die "sed failed, ${i} doesn't exist"
done
+ # bug 657654 / CVE-2018-5738
+ epatch "${FILESDIR}/${P}-CVE-2018-5738.patch"
+
# if use dlz; then
# # sdb-ldap patch as per bug #160567
# # Upstream URL: http://bind9-ldap.bayour.com/
diff --git a/net-dns/bind/bind-9.12.1_p2.ebuild b/net-dns/bind/bind-9.12.1_p2-r1.ebuild
index a8a7a130b53..3e1a46c7bf0 100644
--- a/net-dns/bind/bind-9.12.1_p2.ebuild
+++ b/net-dns/bind/bind-9.12.1_p2-r1.ebuild
@@ -107,6 +107,9 @@ src_prepare() {
"${i}" || die "sed failed, ${i} doesn't exist"
done
+ # bug 657654 / CVE-2018-5738
+ epatch "${FILESDIR}/${P}-CVE-2018-5738.patch"
+
# if use dlz; then
# # sdb-ldap patch as per bug #160567
# # Upstream URL: http://bind9-ldap.bayour.com/
diff --git a/net-dns/bind/files/bind-9.11.3-CVE-2018-5738.patch b/net-dns/bind/files/bind-9.11.3-CVE-2018-5738.patch
new file mode 100644
index 00000000000..4a2c7832ebf
--- /dev/null
+++ b/net-dns/bind/files/bind-9.11.3-CVE-2018-5738.patch
@@ -0,0 +1,110 @@
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 64a5180..41a1826 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -3376,10 +3376,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ dns_acache_setcachesize(view->acache, max_acache_size);
+ }
+
+- CHECK(configure_view_acl(vconfig, config, ns_g_config,
+- "allow-query", NULL, actx,
+- ns_g_mctx, &view->queryacl));
+-
+ /*
+ * Make the list of response policy zone names for a view that
+ * is used for real lookups and so cares about hints.
+@@ -4258,9 +4254,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ INSIST(result == ISC_R_SUCCESS);
+ view->trust_anchor_telemetry = cfg_obj_asboolean(obj);
+
+- CHECK(configure_view_acl(vconfig, config, ns_g_config,
+- "allow-query-cache-on", NULL, actx,
+- ns_g_mctx, &view->cacheonacl));
+ /*
+ * Set sources where additional data and CNAME/DNAME
+ * targets for authoritative answers may be found.
+@@ -4287,22 +4280,40 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ view->additionalfromcache = ISC_TRUE;
+ }
+
++ CHECK(configure_view_acl(vconfig, config, ns_g_config,
++ "allow-query-cache-on", NULL, actx,
++ ns_g_mctx, &view->cacheonacl));
++
+ /*
+- * Set "allow-query-cache", "allow-recursion", and
+- * "allow-recursion-on" acls if configured in named.conf.
+- * (Ignore the global defaults for now, because these ACLs
+- * can inherit from each other when only some of them set at
+- * the options/view level.)
++ * Set the "allow-query", "allow-query-cache", "allow-recursion",
++ * and "allow-recursion-on" ACLs if configured in named.conf, but
++ * NOT from the global defaults. This is done by leaving the third
++ * argument to configure_view_acl() NULL.
++ *
++ * We ignore the global defaults here because these ACLs
++ * can inherit from each other. If any are still unset after
++ * applying the inheritance rules, we'll look up the defaults at
++ * that time.
+ */
+- CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache",
+- NULL, actx, ns_g_mctx, &view->cacheacl));
++
++ /* named.conf only */
++ CHECK(configure_view_acl(vconfig, config, NULL,
++ "allow-query", NULL, actx,
++ ns_g_mctx, &view->queryacl));
++
++ /* named.conf only */
++ CHECK(configure_view_acl(vconfig, config, NULL,
++ "allow-query-cache", NULL, actx,
++ ns_g_mctx, &view->cacheacl));
+
+ if (strcmp(view->name, "_bind") != 0 &&
+ view->rdclass != dns_rdataclass_chaos)
+ {
++ /* named.conf only */
+ CHECK(configure_view_acl(vconfig, config, NULL,
+ "allow-recursion", NULL, actx,
+ ns_g_mctx, &view->recursionacl));
++ /* named.conf only */
+ CHECK(configure_view_acl(vconfig, config, NULL,
+ "allow-recursion-on", NULL, actx,
+ ns_g_mctx, &view->recursiononacl));
+@@ -4340,18 +4351,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ * the global config.
+ */
+ if (view->recursionacl == NULL) {
++ /* global default only */
+ CHECK(configure_view_acl(NULL, NULL, ns_g_config,
+ "allow-recursion", NULL,
+ actx, ns_g_mctx,
+ &view->recursionacl));
+ }
+ if (view->recursiononacl == NULL) {
++ /* global default only */
+ CHECK(configure_view_acl(NULL, NULL, ns_g_config,
+ "allow-recursion-on", NULL,
+ actx, ns_g_mctx,
+ &view->recursiononacl));
+ }
+ if (view->cacheacl == NULL) {
++ /* global default only */
+ CHECK(configure_view_acl(NULL, NULL, ns_g_config,
+ "allow-query-cache", NULL,
+ actx, ns_g_mctx,
+@@ -4365,6 +4379,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ CHECK(dns_acl_none(mctx, &view->cacheacl));
+ }
+
++ if (view->queryacl == NULL) {
++ /* global default only */
++ CHECK(configure_view_acl(NULL, NULL, ns_g_config,
++ "allow-query", NULL,
++ actx, ns_g_mctx,
++ &view->queryacl));
++ }
++
+ /*
+ * Ignore case when compressing responses to the specified
+ * clients. This causes case not always to be preserved,
diff --git a/net-dns/bind/files/bind-9.12.1_p2-CVE-2018-5738.patch b/net-dns/bind/files/bind-9.12.1_p2-CVE-2018-5738.patch
new file mode 100644
index 00000000000..75c98d4f175
--- /dev/null
+++ b/net-dns/bind/files/bind-9.12.1_p2-CVE-2018-5738.patch
@@ -0,0 +1,95 @@
+diff --git a/bin/named/server.c b/bin/named/server.c
+index f63554e..847c4ff 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -3725,10 +3725,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ CHECKM(named_config_getport(config, &port), "port");
+ dns_view_setdstport(view, port);
+
+- CHECK(configure_view_acl(vconfig, config, named_g_config,
+- "allow-query", NULL, actx,
+- named_g_mctx, &view->queryacl));
+-
+ /*
+ * Make the list of response policy zone names for a view that
+ * is used for real lookups and so cares about hints.
+@@ -4692,21 +4688,35 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ "allow-query-cache-on", NULL, actx,
+ named_g_mctx, &view->cacheonacl));
+ /*
+- * Set "allow-query-cache", "allow-recursion", and
+- * "allow-recursion-on" acls if configured in named.conf.
+- * (Ignore the global defaults for now, because these ACLs
+- * can inherit from each other when only some of them set at
+- * the options/view level.)
++ * Set the "allow-query", "allow-query-cache", "allow-recursion",
++ * and "allow-recursion-on" ACLs if configured in named.conf, but
++ * NOT from the global defaults. This is done by leaving the third
++ * argument to configure_view_acl() NULL.
++ *
++ * We ignore the global defaults here because these ACLs
++ * can inherit from each other. If any are still unset after
++ * applying the inheritance rules, we'll look up the defaults at
++ * that time.
+ */
+- CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache",
+- NULL, actx, named_g_mctx, &view->cacheacl));
++
++ /* named.conf only */
++ CHECK(configure_view_acl(vconfig, config, NULL,
++ "allow-query", NULL, actx,
++ named_g_mctx, &view->queryacl));
++
++ /* named.conf only */
++ CHECK(configure_view_acl(vconfig, config, NULL,
++ "allow-query-cache", NULL, actx,
++ named_g_mctx, &view->cacheacl));
+
+ if (strcmp(view->name, "_bind") != 0 &&
+ view->rdclass != dns_rdataclass_chaos)
+ {
++ /* named.conf only */
+ CHECK(configure_view_acl(vconfig, config, NULL,
+ "allow-recursion", NULL, actx,
+ named_g_mctx, &view->recursionacl));
++ /* named.conf only */
+ CHECK(configure_view_acl(vconfig, config, NULL,
+ "allow-recursion-on", NULL, actx,
+ named_g_mctx, &view->recursiononacl));
+@@ -4744,18 +4754,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ * the global config.
+ */
+ if (view->recursionacl == NULL) {
++ /* global default only */
+ CHECK(configure_view_acl(NULL, NULL, named_g_config,
+ "allow-recursion", NULL,
+ actx, named_g_mctx,
+ &view->recursionacl));
+ }
+ if (view->recursiononacl == NULL) {
++ /* global default only */
+ CHECK(configure_view_acl(NULL, NULL, named_g_config,
+ "allow-recursion-on", NULL,
+ actx, named_g_mctx,
+ &view->recursiononacl));
+ }
+ if (view->cacheacl == NULL) {
++ /* global default only */
+ CHECK(configure_view_acl(NULL, NULL, named_g_config,
+ "allow-query-cache", NULL,
+ actx, named_g_mctx,
+@@ -4769,6 +4782,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ CHECK(dns_acl_none(mctx, &view->cacheacl));
+ }
+
++ if (view->queryacl == NULL) {
++ /* global default only */
++ CHECK(configure_view_acl(NULL, NULL, named_g_config,
++ "allow-query", NULL,
++ actx, named_g_mctx,
++ &view->queryacl));
++ }
++
+ /*
+ * Ignore case when compressing responses to the specified
+ * clients. This causes case not always to be preserved,