From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id E64BA138334 for ; Tue, 19 Jun 2018 08:03:45 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id D6638E085E; Tue, 19 Jun 2018 08:03:42 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 91B4FE085E for ; Tue, 19 Jun 2018 08:03:42 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 7A7B5335C90 for ; Tue, 19 Jun 2018 08:03:40 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id ECB8D2CD for ; Tue, 19 Jun 2018 08:03:38 +0000 (UTC) From: "Christian Ruppert" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Christian Ruppert" Message-ID: <1529395407.ed0e614b9f561112b74c28c0f4ce9343164861ac.idl0r@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: net-dns/bind/, net-dns/bind/files/ X-VCS-Repository: repo/gentoo X-VCS-Files: net-dns/bind/bind-9.11.3-r1.ebuild net-dns/bind/bind-9.11.3.ebuild net-dns/bind/bind-9.12.1_p2-r1.ebuild net-dns/bind/bind-9.12.1_p2.ebuild net-dns/bind/files/bind-9.11.3-CVE-2018-5738.patch net-dns/bind/files/bind-9.12.1_p2-CVE-2018-5738.patch X-VCS-Directories: net-dns/bind/ net-dns/bind/files/ X-VCS-Committer: idl0r X-VCS-Committer-Name: Christian Ruppert X-VCS-Revision: ed0e614b9f561112b74c28c0f4ce9343164861ac X-VCS-Branch: master Date: Tue, 19 Jun 2018 08:03:38 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: aa9aec79-7b40-46cc-a47e-8d623dfbc735 X-Archives-Hash: b57a52e1592a36185d402022f1a6c3dc commit: ed0e614b9f561112b74c28c0f4ce9343164861ac Author: Christian Ruppert gentoo org> AuthorDate: Tue Jun 19 08:03:14 2018 +0000 Commit: Christian Ruppert gentoo org> CommitDate: Tue Jun 19 08:03:27 2018 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ed0e614b net-dns/bind: Revbumps re bug 657654 / CVE-2018-5738 Package-Manager: Portage-2.3.40, Repoman-2.3.9 .../{bind-9.11.3.ebuild => bind-9.11.3-r1.ebuild} | 3 + ...d-9.12.1_p2.ebuild => bind-9.12.1_p2-r1.ebuild} | 3 + net-dns/bind/files/bind-9.11.3-CVE-2018-5738.patch | 110 +++++++++++++++++++++ .../bind/files/bind-9.12.1_p2-CVE-2018-5738.patch | 95 ++++++++++++++++++ 4 files changed, 211 insertions(+) diff --git a/net-dns/bind/bind-9.11.3.ebuild b/net-dns/bind/bind-9.11.3-r1.ebuild similarity index 99% rename from net-dns/bind/bind-9.11.3.ebuild rename to net-dns/bind/bind-9.11.3-r1.ebuild index 4da95bc7613..74e4fcd1fc1 100644 --- a/net-dns/bind/bind-9.11.3.ebuild +++ b/net-dns/bind/bind-9.11.3-r1.ebuild @@ -109,6 +109,9 @@ src_prepare() { "${i}" || die "sed failed, ${i} doesn't exist" done + # bug 657654 / CVE-2018-5738 + epatch "${FILESDIR}/${P}-CVE-2018-5738.patch" + # if use dlz; then # # sdb-ldap patch as per bug #160567 # # Upstream URL: http://bind9-ldap.bayour.com/ diff --git a/net-dns/bind/bind-9.12.1_p2.ebuild b/net-dns/bind/bind-9.12.1_p2-r1.ebuild similarity index 99% rename from net-dns/bind/bind-9.12.1_p2.ebuild rename to net-dns/bind/bind-9.12.1_p2-r1.ebuild index a8a7a130b53..3e1a46c7bf0 100644 --- a/net-dns/bind/bind-9.12.1_p2.ebuild +++ b/net-dns/bind/bind-9.12.1_p2-r1.ebuild @@ -107,6 +107,9 @@ src_prepare() { "${i}" || die "sed failed, ${i} doesn't exist" done + # bug 657654 / CVE-2018-5738 + epatch "${FILESDIR}/${P}-CVE-2018-5738.patch" + # if use dlz; then # # sdb-ldap patch as per bug #160567 # # Upstream URL: http://bind9-ldap.bayour.com/ diff --git a/net-dns/bind/files/bind-9.11.3-CVE-2018-5738.patch b/net-dns/bind/files/bind-9.11.3-CVE-2018-5738.patch new file mode 100644 index 00000000000..4a2c7832ebf --- /dev/null +++ b/net-dns/bind/files/bind-9.11.3-CVE-2018-5738.patch @@ -0,0 +1,110 @@ +diff --git a/bin/named/server.c b/bin/named/server.c +index 64a5180..41a1826 100644 +--- a/bin/named/server.c ++++ b/bin/named/server.c +@@ -3376,10 +3376,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, + dns_acache_setcachesize(view->acache, max_acache_size); + } + +- CHECK(configure_view_acl(vconfig, config, ns_g_config, +- "allow-query", NULL, actx, +- ns_g_mctx, &view->queryacl)); +- + /* + * Make the list of response policy zone names for a view that + * is used for real lookups and so cares about hints. +@@ -4258,9 +4254,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, + INSIST(result == ISC_R_SUCCESS); + view->trust_anchor_telemetry = cfg_obj_asboolean(obj); + +- CHECK(configure_view_acl(vconfig, config, ns_g_config, +- "allow-query-cache-on", NULL, actx, +- ns_g_mctx, &view->cacheonacl)); + /* + * Set sources where additional data and CNAME/DNAME + * targets for authoritative answers may be found. +@@ -4287,22 +4280,40 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, + view->additionalfromcache = ISC_TRUE; + } + ++ CHECK(configure_view_acl(vconfig, config, ns_g_config, ++ "allow-query-cache-on", NULL, actx, ++ ns_g_mctx, &view->cacheonacl)); ++ + /* +- * Set "allow-query-cache", "allow-recursion", and +- * "allow-recursion-on" acls if configured in named.conf. +- * (Ignore the global defaults for now, because these ACLs +- * can inherit from each other when only some of them set at +- * the options/view level.) ++ * Set the "allow-query", "allow-query-cache", "allow-recursion", ++ * and "allow-recursion-on" ACLs if configured in named.conf, but ++ * NOT from the global defaults. This is done by leaving the third ++ * argument to configure_view_acl() NULL. ++ * ++ * We ignore the global defaults here because these ACLs ++ * can inherit from each other. If any are still unset after ++ * applying the inheritance rules, we'll look up the defaults at ++ * that time. + */ +- CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache", +- NULL, actx, ns_g_mctx, &view->cacheacl)); ++ ++ /* named.conf only */ ++ CHECK(configure_view_acl(vconfig, config, NULL, ++ "allow-query", NULL, actx, ++ ns_g_mctx, &view->queryacl)); ++ ++ /* named.conf only */ ++ CHECK(configure_view_acl(vconfig, config, NULL, ++ "allow-query-cache", NULL, actx, ++ ns_g_mctx, &view->cacheacl)); + + if (strcmp(view->name, "_bind") != 0 && + view->rdclass != dns_rdataclass_chaos) + { ++ /* named.conf only */ + CHECK(configure_view_acl(vconfig, config, NULL, + "allow-recursion", NULL, actx, + ns_g_mctx, &view->recursionacl)); ++ /* named.conf only */ + CHECK(configure_view_acl(vconfig, config, NULL, + "allow-recursion-on", NULL, actx, + ns_g_mctx, &view->recursiononacl)); +@@ -4340,18 +4351,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, + * the global config. + */ + if (view->recursionacl == NULL) { ++ /* global default only */ + CHECK(configure_view_acl(NULL, NULL, ns_g_config, + "allow-recursion", NULL, + actx, ns_g_mctx, + &view->recursionacl)); + } + if (view->recursiononacl == NULL) { ++ /* global default only */ + CHECK(configure_view_acl(NULL, NULL, ns_g_config, + "allow-recursion-on", NULL, + actx, ns_g_mctx, + &view->recursiononacl)); + } + if (view->cacheacl == NULL) { ++ /* global default only */ + CHECK(configure_view_acl(NULL, NULL, ns_g_config, + "allow-query-cache", NULL, + actx, ns_g_mctx, +@@ -4365,6 +4379,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, + CHECK(dns_acl_none(mctx, &view->cacheacl)); + } + ++ if (view->queryacl == NULL) { ++ /* global default only */ ++ CHECK(configure_view_acl(NULL, NULL, ns_g_config, ++ "allow-query", NULL, ++ actx, ns_g_mctx, ++ &view->queryacl)); ++ } ++ + /* + * Ignore case when compressing responses to the specified + * clients. This causes case not always to be preserved, diff --git a/net-dns/bind/files/bind-9.12.1_p2-CVE-2018-5738.patch b/net-dns/bind/files/bind-9.12.1_p2-CVE-2018-5738.patch new file mode 100644 index 00000000000..75c98d4f175 --- /dev/null +++ b/net-dns/bind/files/bind-9.12.1_p2-CVE-2018-5738.patch @@ -0,0 +1,95 @@ +diff --git a/bin/named/server.c b/bin/named/server.c +index f63554e..847c4ff 100644 +--- a/bin/named/server.c ++++ b/bin/named/server.c +@@ -3725,10 +3725,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, + CHECKM(named_config_getport(config, &port), "port"); + dns_view_setdstport(view, port); + +- CHECK(configure_view_acl(vconfig, config, named_g_config, +- "allow-query", NULL, actx, +- named_g_mctx, &view->queryacl)); +- + /* + * Make the list of response policy zone names for a view that + * is used for real lookups and so cares about hints. +@@ -4692,21 +4688,35 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, + "allow-query-cache-on", NULL, actx, + named_g_mctx, &view->cacheonacl)); + /* +- * Set "allow-query-cache", "allow-recursion", and +- * "allow-recursion-on" acls if configured in named.conf. +- * (Ignore the global defaults for now, because these ACLs +- * can inherit from each other when only some of them set at +- * the options/view level.) ++ * Set the "allow-query", "allow-query-cache", "allow-recursion", ++ * and "allow-recursion-on" ACLs if configured in named.conf, but ++ * NOT from the global defaults. This is done by leaving the third ++ * argument to configure_view_acl() NULL. ++ * ++ * We ignore the global defaults here because these ACLs ++ * can inherit from each other. If any are still unset after ++ * applying the inheritance rules, we'll look up the defaults at ++ * that time. + */ +- CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache", +- NULL, actx, named_g_mctx, &view->cacheacl)); ++ ++ /* named.conf only */ ++ CHECK(configure_view_acl(vconfig, config, NULL, ++ "allow-query", NULL, actx, ++ named_g_mctx, &view->queryacl)); ++ ++ /* named.conf only */ ++ CHECK(configure_view_acl(vconfig, config, NULL, ++ "allow-query-cache", NULL, actx, ++ named_g_mctx, &view->cacheacl)); + + if (strcmp(view->name, "_bind") != 0 && + view->rdclass != dns_rdataclass_chaos) + { ++ /* named.conf only */ + CHECK(configure_view_acl(vconfig, config, NULL, + "allow-recursion", NULL, actx, + named_g_mctx, &view->recursionacl)); ++ /* named.conf only */ + CHECK(configure_view_acl(vconfig, config, NULL, + "allow-recursion-on", NULL, actx, + named_g_mctx, &view->recursiononacl)); +@@ -4744,18 +4754,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, + * the global config. + */ + if (view->recursionacl == NULL) { ++ /* global default only */ + CHECK(configure_view_acl(NULL, NULL, named_g_config, + "allow-recursion", NULL, + actx, named_g_mctx, + &view->recursionacl)); + } + if (view->recursiononacl == NULL) { ++ /* global default only */ + CHECK(configure_view_acl(NULL, NULL, named_g_config, + "allow-recursion-on", NULL, + actx, named_g_mctx, + &view->recursiononacl)); + } + if (view->cacheacl == NULL) { ++ /* global default only */ + CHECK(configure_view_acl(NULL, NULL, named_g_config, + "allow-query-cache", NULL, + actx, named_g_mctx, +@@ -4769,6 +4782,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, + CHECK(dns_acl_none(mctx, &view->cacheacl)); + } + ++ if (view->queryacl == NULL) { ++ /* global default only */ ++ CHECK(configure_view_acl(NULL, NULL, named_g_config, ++ "allow-query", NULL, ++ actx, named_g_mctx, ++ &view->queryacl)); ++ } ++ + /* + * Ignore case when compressing responses to the specified + * clients. This causes case not always to be preserved,