gentoo resync : 01.12.2017

6 files changed, 352 insertions, 5 deletions

diff --git a/net-dns/pdns/Manifest b/net-dns/pdns/Manifest
index dff1cc5f3011..97b436375702 100644
--- a/net-dns/pdns/Manifest
+++ b/net-dns/pdns/Manifest
@@ -1,7 +1,11 @@
+AUX CVE-2017-15091-4.0.4.patch 1127 BLAKE2B 0fd529b76fdfbb0c6f534f46eb1130ea66d349e4241680459bbeb3a87bc34f34e8485850639986754264005de094dca758e9f7c6cf6d8b86184337a918327b37 SHA512 78d991e755ca9e94eea7f027fff2e2cef7a7e290c1fafd74ee2821880b004c55237334e4b1ea307032be5bfd6d20843640d711e2c0b6b9a932786ac571c4eb0a
 AUX dnsdomain2.schema 6640 BLAKE2B d3efc6bc16390f35979f1184632e7184cf403453422888e2cb44fa4fed7891241919a39c8c6f539a61de032654650a45ea548a6983777ea1bfe029e817f2c315 SHA512 ac16f8d528d6138d3c2cbf997fd8fbb467d388aa63eb6ed4e7780a3dad11ea885b91252ff0809b1d2cf7d5200814b8963aab890af84741ea86d35b2f5955a7ea
 AUX pdns-r1 2533 BLAKE2B 0d4af8f9cd4568cde40b44c72cb10a29662daa514df1a1d8174dd02f2ad4324cb7c99a05736bac7cbe80e1b9081832cac95d8c482eb4d1a8c344a6b55da623e3 SHA512 6392f59f82b82621b6cab6823f7761cd875bc6818c48db846df289057c02d8119a1024c5ecdf70a5ca8a55c00a2c3c56240d36b42cc038a25e8616ab9b966dd6
-DIST pdns-4.0.4.tar.bz2 1320327 SHA256 d974ab89de69477c7f581a3233bc731eacbb43d479291e472b2c531c83b6d763 SHA512 4ef4705cd990b03976775167c7c37850d45907e198549feda5f5701172e008e3f1f74a35a9bebdb24b63dec15ff63cb2cc9dfc8f92e4e1012e0539c5a88b845b WHIRLPOOL 5ac68a15155424d42fb4b84be1b34eb2e51498ae5193ae104215e4bb52a72845923f82dc6b112ce165444cdbfe3aaf01557d2f6ab42f6531dd525aee15ee1b19
-DIST pdns-4.1.0-rc3.tar.bz2 1112366 SHA256 889e2135ad4fa716afdd762a1c1551881e96f656f4434b0b1dcd57c63e87ffe2 SHA512 19485bf95a68cbe2ac4cc826b44c3a8670f66cedc2ab426c589a3f67d96f70bd6dd297bd95301c29cda10ff9a7e429fa702bdc7368ce08862140d7097013ea7f WHIRLPOOL 2e6e6b0a1b173aaa4ac61ac6b11204b30c2fde527476a218e13e62100d82a14b676075ce76e6b830e4c0e5d7f79c4421df9a4539ff9c0a9c110f9509c2d3a8a4
+DIST pdns-4.0.4.tar.bz2 1320327 BLAKE2B 5c11a0245408f8448b41ed4229718e6f7244e0c8f36b60b07c280f82c7dea0065cce93c3814b3a396666be8d3b012ad4eb646cf55f531d22ce325190e0fd6e22 SHA512 4ef4705cd990b03976775167c7c37850d45907e198549feda5f5701172e008e3f1f74a35a9bebdb24b63dec15ff63cb2cc9dfc8f92e4e1012e0539c5a88b845b
+DIST pdns-4.0.5.tar.bz2 1323468 BLAKE2B 7e10cc98177bfa4f81888e2598ab4f0ce83ee45e6349372c065940424a74015302da879536dea8346fe7b86f35c0524a5449489bdf71d1a091b7c6a82fac4b6f SHA512 4b0fa932c1d9caf35b988916447aa21c64ebe2a58bdd84417cf09321a21b264cf1057206dc6993a45a3b591eb1dfa49463710c06b6bdfaf6fb17ae6dec6086d9
+DIST pdns-4.1.0.tar.bz2 1116905 BLAKE2B 91ec0f0cfa70966ff71dfb6302ed01355120ca1429d3c610c4abfb1b964cff78a6332700991bc259387e9095be03d3850da41750e93bb3ffe3db0e23562d156c SHA512 4b2b42f4893f8aac3cf07a6c8a3c999cb728a5907a710f1a5c9c8d08377ecb63e202e5eececbefc069c8f1d97a29b2aa607da7cf2bcc6335a72222418e409e77
+EBUILD pdns-4.0.4-r1.ebuild 4201 BLAKE2B d54e8e387ba8b5d623bf81ac09914ff40b9dcb0cf470ed9ac47c1fafa87d0a8f7bb9a18678b5cef4f891ad229014e574267de5dbcd2a77a197afbfe907a1337f SHA512 bf382471ddb2de96a0ecff1076402c1d5a0f1b5f40d9dd61640049ef979339235549452b75b68de0fed4aac31e5bc038be77b8f8801a244d4f6e6c320c47bf7e
 EBUILD pdns-4.0.4.ebuild 4144 BLAKE2B a5a33e8b5af9d03165cd3984b4626963d8bec9ea3414164006ced76bf3b2eedf6219f79f4dd4384df819be309641be1e7474ff51bccd950a9cf72aa7fd808830 SHA512 2491bd5013165ef666ca5c077c5d6330d016ba8d87950e6875fbdf780d212624616569a708ab6bdb7016ad10bfee18605d9136541d92166253a50e4ea0729ba0
-EBUILD pdns-4.1.0_rc3.ebuild 4044 BLAKE2B c0e7c5700c5b0e6bae38adfb70b5f1303e0346f7ee7e25f720fd4d372d89c4340cf5144aff4b52d1cf3c4c66da2c3c06af30d07fd6d78f649b49909f431e99d0 SHA512 d2e5892da35209c6aff25ffeb8e93936a382c728f7fdf7ceeb8b1ff5f2844b58f94a8dd5b8220014f69b8c2ee1f485cfe3fb58534133ab89cb9577b899ee6257
-MISC metadata.xml 1372 BLAKE2B 4f3cd59b044cef62a72ffc47b68d56ce471a781dad4dfd7a6a9a8b381cd15deb97b874bebb03c263fce0ba0714ff39fbbeb548b93040da6e44d6ff7a9eb2df5f SHA512 5031d165e37113c51d9c608a6493594825bbef8f35ea6e85eae0c4b515df91522c99c574bc0fac141fdd1d428065a66a45e8367c67b459f730d0171a3bb85080
+EBUILD pdns-4.0.5.ebuild 4122 BLAKE2B 80a41ec242413b88df4097d848fb3d84e6a7596ebb172250fe64b5eb4411ddc463a829d5fb1221556158347840090acfa0bcfd119b04f101553d7bc99a470024 SHA512 8da958850313422f711f05a6b9332f35abd8478249f863e071e69d6f30a38a86b9cb4b59b2d4aa85c83962a168c888167088eacc5fb27aa3d5669a6e7688d830
+EBUILD pdns-4.1.0.ebuild 4139 BLAKE2B 3b1c1baf7910e0b72d4c27ca34efb03e87d0983ac85a400adbe76d071edb5c274c68012365ac51b2af2a0c7442675e0a69a0e18e892b5115960093252076475b SHA512 befcd3c0e7e71a73e7c46e76592b71d843ec9b042029f60c952e6b4c9e1860d85cb910d29b40e7e5740c1e88f2314756fd251dec829c146120aaad9147c47853
+MISC metadata.xml 1451 BLAKE2B 69fede20eb18ba4d8bf397c51528a5b5ea4869802215c9851b21b4f71dd3545f7eb358e5e7581e23e5b5df67b29ec96d7da0caa69719951302d614b87f90f10b SHA512 ea054e8d7bdf7d4251ce00c342fda57fc3785a7ba8a8cd3ccd95c86eb8e1b5fbe155997210b67f65bcddab81e39ae136a99e61adf32de55e066d81f89ea50323
diff --git a/net-dns/pdns/files/CVE-2017-15091-4.0.4.patch b/net-dns/pdns/files/CVE-2017-15091-4.0.4.patch
new file mode 100644
index 000000000000..a9506af8ef95
--- /dev/null
+++ b/net-dns/pdns/files/CVE-2017-15091-4.0.4.patch
@@ -0,0 +1,30 @@
+diff -ru pdns-4.0.4.orig/pdns/ws-auth.cc pdns-4.0.4/pdns/ws-auth.cc
+--- pdns-4.0.4.orig/pdns/ws-auth.cc	2017-06-22 22:07:25.000000000 +0200
++++ pdns-4.0.4/pdns/ws-auth.cc	2017-11-02 18:07:20.986764858 +0100
+@@ -860,7 +860,7 @@
+ static void apiServerZoneAxfrRetrieve(HttpRequest* req, HttpResponse* resp) {
+   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
+ 
+-  if(req->method != "PUT")
++  if(req->method != "PUT" || ::arg().mustDo("api-readonly"))
+     throw HttpMethodNotAllowedException();
+ 
+   UeberBackend B;
+@@ -879,7 +879,7 @@
+ static void apiServerZoneNotify(HttpRequest* req, HttpResponse* resp) {
+   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
+ 
+-  if(req->method != "PUT")
++  if(req->method != "PUT" || ::arg().mustDo("api-readonly"))
+     throw HttpMethodNotAllowedException();
+ 
+   UeberBackend B;
+@@ -1191,7 +1191,7 @@
+ }
+ 
+ void apiServerCacheFlush(HttpRequest* req, HttpResponse* resp) {
+-  if(req->method != "PUT")
++  if(req->method != "PUT" || ::arg().mustDo("api-readonly"))
+     throw HttpMethodNotAllowedException();
+ 
+   DNSName canon = apiNameToDNSName(req->getvars["domain"]);
diff --git a/net-dns/pdns/metadata.xml b/net-dns/pdns/metadata.xml
index 264c58531540..03c68c6fd102 100644
--- a/net-dns/pdns/metadata.xml
+++ b/net-dns/pdns/metadata.xml
@@ -18,6 +18,7 @@ standards documents. Furthermore, PowerDNS interfaces with almost any database.
 	<flag name="opendbx">Use a database supported by <pkg>dev-db/opendbx</pkg> as backend.</flag>
 	<flag name="protobuf">Enable support for <pkg>dev-libs/protobuf</pkg>.</flag>
 	<flag name="remote">Use a generic socket or pipe as a backend (via JSON RPC requests).</flag>
+	<flag name="sodium">Use <pkg>dev-libs/libsodium</pkg> for cryptography</flag>
 	<flag name="tinydns">Use a TinyDNS CDB database as backend.</flag>
 	<flag name="tools">Build optional tools (dnsscan, dnsscope, etc..).</flag>
 </use>
diff --git a/net-dns/pdns/pdns-4.0.4-r1.ebuild b/net-dns/pdns/pdns-4.0.4-r1.ebuild
new file mode 100644
index 000000000000..9fa2350de534
--- /dev/null
+++ b/net-dns/pdns/pdns-4.0.4-r1.ebuild
@@ -0,0 +1,157 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+inherit eutils multilib user toolchain-funcs versionator
+
+DESCRIPTION="The PowerDNS Daemon"
+HOMEPAGE="https://www.powerdns.com/"
+SRC_URI="https://downloads.powerdns.com/releases/${P/_/-}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+# other possible flags:
+# db2: we lack the dep
+# oracle: dito (need Oracle Client Libraries)
+# xdb: (almost) dead, surely not supported
+
+IUSE="botan debug doc geoip ldap libressl lua luajit mydns mysql opendbx postgres protobuf remote sqlite systemd tools tinydns test"
+
+REQUIRED_USE="mydns? ( mysql ) ?? ( lua luajit )"
+
+RDEPEND="
+	libressl? ( dev-libs/libressl:= )
+	!libressl? ( dev-libs/openssl:= )
+	>=dev-libs/boost-1.35:=
+	botan? ( =dev-libs/botan-1.10*[threads] )
+	lua? ( dev-lang/lua:= )
+	luajit? ( dev-lang/luajit:= )
+	mysql? ( virtual/mysql )
+	postgres? ( dev-db/postgresql:= )
+	ldap? ( >=net-nds/openldap-2.0.27-r4 )
+	sqlite? ( dev-db/sqlite:3 )
+	opendbx? ( dev-db/opendbx )
+	geoip? ( >=dev-cpp/yaml-cpp-0.5.1 dev-libs/geoip )
+	tinydns? ( >=dev-db/tinycdb-0.77 )
+	protobuf? ( dev-libs/protobuf )"
+DEPEND="${RDEPEND}
+	virtual/pkgconfig
+	doc? ( app-doc/doxygen )"
+
+S="${WORKDIR}"/${P/_/-}
+
+PATCHES=(
+	"${FILESDIR}"/CVE-2017-15091-4.0.4.patch
+)
+
+src_configure() {
+	local dynmodules="pipe bind" # the default backends, always enabled
+
+	#use db2 && dynmodules+=" db2"
+	use ldap && dynmodules+=" ldap"
+	use lua && dynmodules+=" lua"
+	use mydns && dynmodules+=" mydns"
+	use mysql && dynmodules+=" gmysql"
+	use opendbx && dynmodules+=" opendbx"
+	#use oracle && dynmodules+=" goracle oracle"
+	use postgres && dynmodules+=" gpgsql"
+	use remote && dynmodules+=" remote"
+	use sqlite && dynmodules+=" gsqlite3"
+	use tinydns && dynmodules+=" tinydns"
+	use geoip && dynmodules+=" geoip"
+	#use xdb && dynmodules+=" xdb"
+
+	econf \
+		--disable-static \
+		--sysconfdir=/etc/powerdns \
+		--libdir=/usr/$(get_libdir)/powerdns \
+		--with-modules= \
+		--with-dynmodules="${dynmodules}" \
+		--with-pgsql-includes=/usr/include \
+		--with-pgsql-lib=/usr/$(get_libdir) \
+		--with-mysql-lib=/usr/$(get_libdir) \
+		$(use_enable botan botan1.10) \
+		$(use_enable debug verbose-logging) \
+		$(use_enable test unit-tests) \
+		$(use_enable tools) \
+		$(use_enable systemd) \
+		$(use_with lua) \
+		$(use_with luajit) \
+		$(use_with protobuf) \
+		${myconf}
+}
+
+src_compile() {
+	default
+	use doc && emake -C codedocs codedocs
+}
+
+src_install() {
+	default
+
+	mv "${D}"/etc/powerdns/pdns.conf{-dist,}
+
+	fperms 0700 /etc/powerdns
+	fperms 0600 /etc/powerdns/pdns.conf
+
+	# set defaults: setuid=pdns, setgid=pdns
+	sed -i \
+		-e 's/^# set\([ug]\)id=$/set\1id=pdns/g' \
+		"${D}"/etc/powerdns/pdns.conf
+
+	newinitd "${FILESDIR}"/pdns-r1 pdns
+
+	keepdir /var/empty
+
+	use doc && dohtml -r codedocs/html/.
+
+	# Install development headers
+	insinto /usr/include/pdns
+	doins pdns/*.hh
+	insinto /usr/include/pdns/backends/gsql
+	doins pdns/backends/gsql/*.hh
+
+	if use ldap ; then
+		insinto /etc/openldap/schema
+		doins "${FILESDIR}"/dnsdomain2.schema
+	fi
+
+	prune_libtool_files --all
+}
+
+pkg_preinst() {
+	enewgroup pdns
+	enewuser pdns -1 -1 /var/empty pdns
+}
+
+pkg_postinst() {
+	elog "PowerDNS provides multiple instances support. You can create more instances"
+	elog "by symlinking the pdns init script to another name."
+	elog
+	elog "The name must be in the format pdns.<suffix> and PowerDNS will use the"
+	elog "/etc/powerdns/pdns-<suffix>.conf configuration file instead of the default."
+
+	if use ldap ; then
+		ewarn "The official LDAP backend module is only compile-tested by upstream."
+		ewarn "Try net-dns/pdns-ldap-backend if you have problems with it."
+	fi
+
+	local old
+	for old in ${REPLACING_VERSIONS}; do
+		version_compare ${old} 3.2
+		[[ $? -eq 1 ]] || continue
+
+		ewarn "To fix a security bug (bug #458018) had the following"
+		ewarn "files/directories the world-readable bit removed (if set):"
+		ewarn "  ${EPREFIX}/etc/powerdns"
+		ewarn "  ${EPREFIX}/etc/powerdns/pdns.conf"
+		ewarn "Check if this is correct for your setup"
+		ewarn "This is a one-time change and will not happen on subsequent updates."
+		chmod o-rwx "${EPREFIX}"/etc/powerdns/{,pdns.conf}
+
+		break
+	done
+}
diff --git a/net-dns/pdns/pdns-4.1.0_rc3.ebuild b/net-dns/pdns/pdns-4.0.5.ebuild
index 8ec74d1ac285..891179a4bdbb 100644
--- a/net-dns/pdns/pdns-4.1.0_rc3.ebuild
+++ b/net-dns/pdns/pdns-4.0.5.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://downloads.powerdns.com/releases/${P/_/-}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 ~x86"
+KEYWORDS="~amd64 x86"
 
 # other possible flags:
 # db2: we lack the dep
@@ -66,6 +66,8 @@ src_configure() {
 		--libdir=/usr/$(get_libdir)/powerdns \
 		--with-modules= \
 		--with-dynmodules="${dynmodules}" \
+		--with-pgsql-includes=/usr/include \
+		--with-pgsql-lib=/usr/$(get_libdir) \
 		--with-mysql-lib=/usr/$(get_libdir) \
 		$(use_enable botan) \
 		$(use_enable debug verbose-logging) \
diff --git a/net-dns/pdns/pdns-4.1.0.ebuild b/net-dns/pdns/pdns-4.1.0.ebuild
new file mode 100644
index 000000000000..476a969f8a9a
--- /dev/null
+++ b/net-dns/pdns/pdns-4.1.0.ebuild
@@ -0,0 +1,153 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+inherit eutils multilib user toolchain-funcs versionator
+
+DESCRIPTION="The PowerDNS Daemon"
+HOMEPAGE="https://www.powerdns.com/"
+SRC_URI="https://downloads.powerdns.com/releases/${P/_/-}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+# other possible flags:
+# db2: we lack the dep
+# oracle: dito (need Oracle Client Libraries)
+# xdb: (almost) dead, surely not supported
+
+IUSE="botan debug doc geoip ldap libressl lua luajit mydns mysql opendbx postgres protobuf remote sodium sqlite systemd tools tinydns test"
+
+REQUIRED_USE="mydns? ( mysql ) ?? ( lua luajit )"
+
+RDEPEND="
+	libressl? ( dev-libs/libressl:= )
+	!libressl? ( dev-libs/openssl:= )
+	>=dev-libs/boost-1.35:=
+	botan? ( dev-libs/botan:2= )
+	lua? ( dev-lang/lua:= )
+	luajit? ( dev-lang/luajit:= )
+	mysql? ( virtual/mysql )
+	postgres? ( dev-db/postgresql:= )
+	ldap? ( >=net-nds/openldap-2.0.27-r4 app-crypt/mit-krb5 )
+	sqlite? ( dev-db/sqlite:3 )
+	opendbx? ( dev-db/opendbx )
+	geoip? ( >=dev-cpp/yaml-cpp-0.5.1 dev-libs/geoip )
+	sodium? ( dev-libs/libsodium:= )
+	tinydns? ( >=dev-db/tinycdb-0.77 )
+	protobuf? ( dev-libs/protobuf )"
+DEPEND="${RDEPEND}
+	virtual/pkgconfig
+	doc? ( app-doc/doxygen )"
+
+S="${WORKDIR}"/${P/_/-}
+
+src_configure() {
+	local dynmodules="pipe bind" # the default backends, always enabled
+
+	#use db2 && dynmodules+=" db2"
+	use ldap && dynmodules+=" ldap"
+	use lua && dynmodules+=" lua"
+	use mydns && dynmodules+=" mydns"
+	use mysql && dynmodules+=" gmysql"
+	use opendbx && dynmodules+=" opendbx"
+	#use oracle && dynmodules+=" goracle oracle"
+	use postgres && dynmodules+=" gpgsql"
+	use remote && dynmodules+=" remote"
+	use sqlite && dynmodules+=" gsqlite3"
+	use tinydns && dynmodules+=" tinydns"
+	use geoip && dynmodules+=" geoip"
+	#use xdb && dynmodules+=" xdb"
+
+	econf \
+		--disable-static \
+		--sysconfdir=/etc/powerdns \
+		--libdir=/usr/$(get_libdir)/powerdns \
+		--with-modules= \
+		--with-dynmodules="${dynmodules}" \
+		--with-mysql-lib=/usr/$(get_libdir) \
+		$(use_enable botan) \
+		$(use_enable debug verbose-logging) \
+		$(use_enable test unit-tests) \
+		$(use_enable tools) \
+		$(use_enable systemd) \
+		$(use_enable sodium libsodium) \
+		$(use_with lua) \
+		$(use_with luajit) \
+		$(use_with protobuf) \
+		${myconf}
+}
+
+src_compile() {
+	default
+	use doc && emake -C codedocs codedocs
+}
+
+src_install() {
+	default
+
+	mv "${D}"/etc/powerdns/pdns.conf{-dist,}
+
+	fperms 0700 /etc/powerdns
+	fperms 0600 /etc/powerdns/pdns.conf
+
+	# set defaults: setuid=pdns, setgid=pdns
+	sed -i \
+		-e 's/^# set\([ug]\)id=$/set\1id=pdns/g' \
+		"${D}"/etc/powerdns/pdns.conf
+
+	newinitd "${FILESDIR}"/pdns-r1 pdns
+
+	keepdir /var/empty
+
+	use doc && dohtml -r codedocs/html/.
+
+	# Install development headers
+	insinto /usr/include/pdns
+	doins pdns/*.hh
+	insinto /usr/include/pdns/backends/gsql
+	doins pdns/backends/gsql/*.hh
+
+	if use ldap ; then
+		insinto /etc/openldap/schema
+		doins "${FILESDIR}"/dnsdomain2.schema
+	fi
+
+	prune_libtool_files --all
+}
+
+pkg_preinst() {
+	enewgroup pdns
+	enewuser pdns -1 -1 /var/empty pdns
+}
+
+pkg_postinst() {
+	elog "PowerDNS provides multiple instances support. You can create more instances"
+	elog "by symlinking the pdns init script to another name."
+	elog
+	elog "The name must be in the format pdns.<suffix> and PowerDNS will use the"
+	elog "/etc/powerdns/pdns-<suffix>.conf configuration file instead of the default."
+
+	if use ldap ; then
+		ewarn "The official LDAP backend module is only compile-tested by upstream."
+		ewarn "Try net-dns/pdns-ldap-backend if you have problems with it."
+	fi
+
+	local old
+	for old in ${REPLACING_VERSIONS}; do
+		version_compare ${old} 3.2
+		[[ $? -eq 1 ]] || continue
+
+		ewarn "To fix a security bug (bug #458018) had the following"
+		ewarn "files/directories the world-readable bit removed (if set):"
+		ewarn "  ${EPREFIX}/etc/powerdns"
+		ewarn "  ${EPREFIX}/etc/powerdns/pdns.conf"
+		ewarn "Check if this is correct for your setup"
+		ewarn "This is a one-time change and will not happen on subsequent updates."
+		chmod o-rwx "${EPREFIX}"/etc/powerdns/{,pdns.conf}
+
+		break
+	done
+}