diff options
Diffstat (limited to 'net-dns/pdns')
-rw-r--r-- | net-dns/pdns/Manifest | 12 | ||||
-rw-r--r-- | net-dns/pdns/files/CVE-2017-15091-4.0.4.patch | 30 | ||||
-rw-r--r-- | net-dns/pdns/metadata.xml | 1 | ||||
-rw-r--r-- | net-dns/pdns/pdns-4.0.4-r1.ebuild | 157 | ||||
-rw-r--r-- | net-dns/pdns/pdns-4.0.5.ebuild (renamed from net-dns/pdns/pdns-4.1.0_rc3.ebuild) | 4 | ||||
-rw-r--r-- | net-dns/pdns/pdns-4.1.0.ebuild | 153 |
6 files changed, 352 insertions, 5 deletions
diff --git a/net-dns/pdns/Manifest b/net-dns/pdns/Manifest index dff1cc5f3011..97b436375702 100644 --- a/net-dns/pdns/Manifest +++ b/net-dns/pdns/Manifest @@ -1,7 +1,11 @@ +AUX CVE-2017-15091-4.0.4.patch 1127 BLAKE2B 0fd529b76fdfbb0c6f534f46eb1130ea66d349e4241680459bbeb3a87bc34f34e8485850639986754264005de094dca758e9f7c6cf6d8b86184337a918327b37 SHA512 78d991e755ca9e94eea7f027fff2e2cef7a7e290c1fafd74ee2821880b004c55237334e4b1ea307032be5bfd6d20843640d711e2c0b6b9a932786ac571c4eb0a AUX dnsdomain2.schema 6640 BLAKE2B d3efc6bc16390f35979f1184632e7184cf403453422888e2cb44fa4fed7891241919a39c8c6f539a61de032654650a45ea548a6983777ea1bfe029e817f2c315 SHA512 ac16f8d528d6138d3c2cbf997fd8fbb467d388aa63eb6ed4e7780a3dad11ea885b91252ff0809b1d2cf7d5200814b8963aab890af84741ea86d35b2f5955a7ea AUX pdns-r1 2533 BLAKE2B 0d4af8f9cd4568cde40b44c72cb10a29662daa514df1a1d8174dd02f2ad4324cb7c99a05736bac7cbe80e1b9081832cac95d8c482eb4d1a8c344a6b55da623e3 SHA512 6392f59f82b82621b6cab6823f7761cd875bc6818c48db846df289057c02d8119a1024c5ecdf70a5ca8a55c00a2c3c56240d36b42cc038a25e8616ab9b966dd6 -DIST pdns-4.0.4.tar.bz2 1320327 SHA256 d974ab89de69477c7f581a3233bc731eacbb43d479291e472b2c531c83b6d763 SHA512 4ef4705cd990b03976775167c7c37850d45907e198549feda5f5701172e008e3f1f74a35a9bebdb24b63dec15ff63cb2cc9dfc8f92e4e1012e0539c5a88b845b WHIRLPOOL 5ac68a15155424d42fb4b84be1b34eb2e51498ae5193ae104215e4bb52a72845923f82dc6b112ce165444cdbfe3aaf01557d2f6ab42f6531dd525aee15ee1b19 -DIST pdns-4.1.0-rc3.tar.bz2 1112366 SHA256 889e2135ad4fa716afdd762a1c1551881e96f656f4434b0b1dcd57c63e87ffe2 SHA512 19485bf95a68cbe2ac4cc826b44c3a8670f66cedc2ab426c589a3f67d96f70bd6dd297bd95301c29cda10ff9a7e429fa702bdc7368ce08862140d7097013ea7f WHIRLPOOL 2e6e6b0a1b173aaa4ac61ac6b11204b30c2fde527476a218e13e62100d82a14b676075ce76e6b830e4c0e5d7f79c4421df9a4539ff9c0a9c110f9509c2d3a8a4 +DIST pdns-4.0.4.tar.bz2 1320327 BLAKE2B 5c11a0245408f8448b41ed4229718e6f7244e0c8f36b60b07c280f82c7dea0065cce93c3814b3a396666be8d3b012ad4eb646cf55f531d22ce325190e0fd6e22 SHA512 4ef4705cd990b03976775167c7c37850d45907e198549feda5f5701172e008e3f1f74a35a9bebdb24b63dec15ff63cb2cc9dfc8f92e4e1012e0539c5a88b845b +DIST pdns-4.0.5.tar.bz2 1323468 BLAKE2B 7e10cc98177bfa4f81888e2598ab4f0ce83ee45e6349372c065940424a74015302da879536dea8346fe7b86f35c0524a5449489bdf71d1a091b7c6a82fac4b6f SHA512 4b0fa932c1d9caf35b988916447aa21c64ebe2a58bdd84417cf09321a21b264cf1057206dc6993a45a3b591eb1dfa49463710c06b6bdfaf6fb17ae6dec6086d9 +DIST pdns-4.1.0.tar.bz2 1116905 BLAKE2B 91ec0f0cfa70966ff71dfb6302ed01355120ca1429d3c610c4abfb1b964cff78a6332700991bc259387e9095be03d3850da41750e93bb3ffe3db0e23562d156c SHA512 4b2b42f4893f8aac3cf07a6c8a3c999cb728a5907a710f1a5c9c8d08377ecb63e202e5eececbefc069c8f1d97a29b2aa607da7cf2bcc6335a72222418e409e77 +EBUILD pdns-4.0.4-r1.ebuild 4201 BLAKE2B d54e8e387ba8b5d623bf81ac09914ff40b9dcb0cf470ed9ac47c1fafa87d0a8f7bb9a18678b5cef4f891ad229014e574267de5dbcd2a77a197afbfe907a1337f SHA512 bf382471ddb2de96a0ecff1076402c1d5a0f1b5f40d9dd61640049ef979339235549452b75b68de0fed4aac31e5bc038be77b8f8801a244d4f6e6c320c47bf7e EBUILD pdns-4.0.4.ebuild 4144 BLAKE2B a5a33e8b5af9d03165cd3984b4626963d8bec9ea3414164006ced76bf3b2eedf6219f79f4dd4384df819be309641be1e7474ff51bccd950a9cf72aa7fd808830 SHA512 2491bd5013165ef666ca5c077c5d6330d016ba8d87950e6875fbdf780d212624616569a708ab6bdb7016ad10bfee18605d9136541d92166253a50e4ea0729ba0 -EBUILD pdns-4.1.0_rc3.ebuild 4044 BLAKE2B c0e7c5700c5b0e6bae38adfb70b5f1303e0346f7ee7e25f720fd4d372d89c4340cf5144aff4b52d1cf3c4c66da2c3c06af30d07fd6d78f649b49909f431e99d0 SHA512 d2e5892da35209c6aff25ffeb8e93936a382c728f7fdf7ceeb8b1ff5f2844b58f94a8dd5b8220014f69b8c2ee1f485cfe3fb58534133ab89cb9577b899ee6257 -MISC metadata.xml 1372 BLAKE2B 4f3cd59b044cef62a72ffc47b68d56ce471a781dad4dfd7a6a9a8b381cd15deb97b874bebb03c263fce0ba0714ff39fbbeb548b93040da6e44d6ff7a9eb2df5f SHA512 5031d165e37113c51d9c608a6493594825bbef8f35ea6e85eae0c4b515df91522c99c574bc0fac141fdd1d428065a66a45e8367c67b459f730d0171a3bb85080 +EBUILD pdns-4.0.5.ebuild 4122 BLAKE2B 80a41ec242413b88df4097d848fb3d84e6a7596ebb172250fe64b5eb4411ddc463a829d5fb1221556158347840090acfa0bcfd119b04f101553d7bc99a470024 SHA512 8da958850313422f711f05a6b9332f35abd8478249f863e071e69d6f30a38a86b9cb4b59b2d4aa85c83962a168c888167088eacc5fb27aa3d5669a6e7688d830 +EBUILD pdns-4.1.0.ebuild 4139 BLAKE2B 3b1c1baf7910e0b72d4c27ca34efb03e87d0983ac85a400adbe76d071edb5c274c68012365ac51b2af2a0c7442675e0a69a0e18e892b5115960093252076475b SHA512 befcd3c0e7e71a73e7c46e76592b71d843ec9b042029f60c952e6b4c9e1860d85cb910d29b40e7e5740c1e88f2314756fd251dec829c146120aaad9147c47853 +MISC metadata.xml 1451 BLAKE2B 69fede20eb18ba4d8bf397c51528a5b5ea4869802215c9851b21b4f71dd3545f7eb358e5e7581e23e5b5df67b29ec96d7da0caa69719951302d614b87f90f10b SHA512 ea054e8d7bdf7d4251ce00c342fda57fc3785a7ba8a8cd3ccd95c86eb8e1b5fbe155997210b67f65bcddab81e39ae136a99e61adf32de55e066d81f89ea50323 diff --git a/net-dns/pdns/files/CVE-2017-15091-4.0.4.patch b/net-dns/pdns/files/CVE-2017-15091-4.0.4.patch new file mode 100644 index 000000000000..a9506af8ef95 --- /dev/null +++ b/net-dns/pdns/files/CVE-2017-15091-4.0.4.patch @@ -0,0 +1,30 @@ +diff -ru pdns-4.0.4.orig/pdns/ws-auth.cc pdns-4.0.4/pdns/ws-auth.cc +--- pdns-4.0.4.orig/pdns/ws-auth.cc 2017-06-22 22:07:25.000000000 +0200 ++++ pdns-4.0.4/pdns/ws-auth.cc 2017-11-02 18:07:20.986764858 +0100 +@@ -860,7 +860,7 @@ + static void apiServerZoneAxfrRetrieve(HttpRequest* req, HttpResponse* resp) { + DNSName zonename = apiZoneIdToName(req->parameters["id"]); + +- if(req->method != "PUT") ++ if(req->method != "PUT" || ::arg().mustDo("api-readonly")) + throw HttpMethodNotAllowedException(); + + UeberBackend B; +@@ -879,7 +879,7 @@ + static void apiServerZoneNotify(HttpRequest* req, HttpResponse* resp) { + DNSName zonename = apiZoneIdToName(req->parameters["id"]); + +- if(req->method != "PUT") ++ if(req->method != "PUT" || ::arg().mustDo("api-readonly")) + throw HttpMethodNotAllowedException(); + + UeberBackend B; +@@ -1191,7 +1191,7 @@ + } + + void apiServerCacheFlush(HttpRequest* req, HttpResponse* resp) { +- if(req->method != "PUT") ++ if(req->method != "PUT" || ::arg().mustDo("api-readonly")) + throw HttpMethodNotAllowedException(); + + DNSName canon = apiNameToDNSName(req->getvars["domain"]); diff --git a/net-dns/pdns/metadata.xml b/net-dns/pdns/metadata.xml index 264c58531540..03c68c6fd102 100644 --- a/net-dns/pdns/metadata.xml +++ b/net-dns/pdns/metadata.xml @@ -18,6 +18,7 @@ standards documents. Furthermore, PowerDNS interfaces with almost any database. <flag name="opendbx">Use a database supported by <pkg>dev-db/opendbx</pkg> as backend.</flag> <flag name="protobuf">Enable support for <pkg>dev-libs/protobuf</pkg>.</flag> <flag name="remote">Use a generic socket or pipe as a backend (via JSON RPC requests).</flag> + <flag name="sodium">Use <pkg>dev-libs/libsodium</pkg> for cryptography</flag> <flag name="tinydns">Use a TinyDNS CDB database as backend.</flag> <flag name="tools">Build optional tools (dnsscan, dnsscope, etc..).</flag> </use> diff --git a/net-dns/pdns/pdns-4.0.4-r1.ebuild b/net-dns/pdns/pdns-4.0.4-r1.ebuild new file mode 100644 index 000000000000..9fa2350de534 --- /dev/null +++ b/net-dns/pdns/pdns-4.0.4-r1.ebuild @@ -0,0 +1,157 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI="6" + +inherit eutils multilib user toolchain-funcs versionator + +DESCRIPTION="The PowerDNS Daemon" +HOMEPAGE="https://www.powerdns.com/" +SRC_URI="https://downloads.powerdns.com/releases/${P/_/-}.tar.bz2" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~amd64 ~x86" + +# other possible flags: +# db2: we lack the dep +# oracle: dito (need Oracle Client Libraries) +# xdb: (almost) dead, surely not supported + +IUSE="botan debug doc geoip ldap libressl lua luajit mydns mysql opendbx postgres protobuf remote sqlite systemd tools tinydns test" + +REQUIRED_USE="mydns? ( mysql ) ?? ( lua luajit )" + +RDEPEND=" + libressl? ( dev-libs/libressl:= ) + !libressl? ( dev-libs/openssl:= ) + >=dev-libs/boost-1.35:= + botan? ( =dev-libs/botan-1.10*[threads] ) + lua? ( dev-lang/lua:= ) + luajit? ( dev-lang/luajit:= ) + mysql? ( virtual/mysql ) + postgres? ( dev-db/postgresql:= ) + ldap? ( >=net-nds/openldap-2.0.27-r4 ) + sqlite? ( dev-db/sqlite:3 ) + opendbx? ( dev-db/opendbx ) + geoip? ( >=dev-cpp/yaml-cpp-0.5.1 dev-libs/geoip ) + tinydns? ( >=dev-db/tinycdb-0.77 ) + protobuf? ( dev-libs/protobuf )" +DEPEND="${RDEPEND} + virtual/pkgconfig + doc? ( app-doc/doxygen )" + +S="${WORKDIR}"/${P/_/-} + +PATCHES=( + "${FILESDIR}"/CVE-2017-15091-4.0.4.patch +) + +src_configure() { + local dynmodules="pipe bind" # the default backends, always enabled + + #use db2 && dynmodules+=" db2" + use ldap && dynmodules+=" ldap" + use lua && dynmodules+=" lua" + use mydns && dynmodules+=" mydns" + use mysql && dynmodules+=" gmysql" + use opendbx && dynmodules+=" opendbx" + #use oracle && dynmodules+=" goracle oracle" + use postgres && dynmodules+=" gpgsql" + use remote && dynmodules+=" remote" + use sqlite && dynmodules+=" gsqlite3" + use tinydns && dynmodules+=" tinydns" + use geoip && dynmodules+=" geoip" + #use xdb && dynmodules+=" xdb" + + econf \ + --disable-static \ + --sysconfdir=/etc/powerdns \ + --libdir=/usr/$(get_libdir)/powerdns \ + --with-modules= \ + --with-dynmodules="${dynmodules}" \ + --with-pgsql-includes=/usr/include \ + --with-pgsql-lib=/usr/$(get_libdir) \ + --with-mysql-lib=/usr/$(get_libdir) \ + $(use_enable botan botan1.10) \ + $(use_enable debug verbose-logging) \ + $(use_enable test unit-tests) \ + $(use_enable tools) \ + $(use_enable systemd) \ + $(use_with lua) \ + $(use_with luajit) \ + $(use_with protobuf) \ + ${myconf} +} + +src_compile() { + default + use doc && emake -C codedocs codedocs +} + +src_install() { + default + + mv "${D}"/etc/powerdns/pdns.conf{-dist,} + + fperms 0700 /etc/powerdns + fperms 0600 /etc/powerdns/pdns.conf + + # set defaults: setuid=pdns, setgid=pdns + sed -i \ + -e 's/^# set\([ug]\)id=$/set\1id=pdns/g' \ + "${D}"/etc/powerdns/pdns.conf + + newinitd "${FILESDIR}"/pdns-r1 pdns + + keepdir /var/empty + + use doc && dohtml -r codedocs/html/. + + # Install development headers + insinto /usr/include/pdns + doins pdns/*.hh + insinto /usr/include/pdns/backends/gsql + doins pdns/backends/gsql/*.hh + + if use ldap ; then + insinto /etc/openldap/schema + doins "${FILESDIR}"/dnsdomain2.schema + fi + + prune_libtool_files --all +} + +pkg_preinst() { + enewgroup pdns + enewuser pdns -1 -1 /var/empty pdns +} + +pkg_postinst() { + elog "PowerDNS provides multiple instances support. You can create more instances" + elog "by symlinking the pdns init script to another name." + elog + elog "The name must be in the format pdns.<suffix> and PowerDNS will use the" + elog "/etc/powerdns/pdns-<suffix>.conf configuration file instead of the default." + + if use ldap ; then + ewarn "The official LDAP backend module is only compile-tested by upstream." + ewarn "Try net-dns/pdns-ldap-backend if you have problems with it." + fi + + local old + for old in ${REPLACING_VERSIONS}; do + version_compare ${old} 3.2 + [[ $? -eq 1 ]] || continue + + ewarn "To fix a security bug (bug #458018) had the following" + ewarn "files/directories the world-readable bit removed (if set):" + ewarn " ${EPREFIX}/etc/powerdns" + ewarn " ${EPREFIX}/etc/powerdns/pdns.conf" + ewarn "Check if this is correct for your setup" + ewarn "This is a one-time change and will not happen on subsequent updates." + chmod o-rwx "${EPREFIX}"/etc/powerdns/{,pdns.conf} + + break + done +} diff --git a/net-dns/pdns/pdns-4.1.0_rc3.ebuild b/net-dns/pdns/pdns-4.0.5.ebuild index 8ec74d1ac285..891179a4bdbb 100644 --- a/net-dns/pdns/pdns-4.1.0_rc3.ebuild +++ b/net-dns/pdns/pdns-4.0.5.ebuild @@ -11,7 +11,7 @@ SRC_URI="https://downloads.powerdns.com/releases/${P/_/-}.tar.bz2" LICENSE="GPL-2" SLOT="0" -KEYWORDS="~amd64 ~x86" +KEYWORDS="~amd64 x86" # other possible flags: # db2: we lack the dep @@ -66,6 +66,8 @@ src_configure() { --libdir=/usr/$(get_libdir)/powerdns \ --with-modules= \ --with-dynmodules="${dynmodules}" \ + --with-pgsql-includes=/usr/include \ + --with-pgsql-lib=/usr/$(get_libdir) \ --with-mysql-lib=/usr/$(get_libdir) \ $(use_enable botan) \ $(use_enable debug verbose-logging) \ diff --git a/net-dns/pdns/pdns-4.1.0.ebuild b/net-dns/pdns/pdns-4.1.0.ebuild new file mode 100644 index 000000000000..476a969f8a9a --- /dev/null +++ b/net-dns/pdns/pdns-4.1.0.ebuild @@ -0,0 +1,153 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI="6" + +inherit eutils multilib user toolchain-funcs versionator + +DESCRIPTION="The PowerDNS Daemon" +HOMEPAGE="https://www.powerdns.com/" +SRC_URI="https://downloads.powerdns.com/releases/${P/_/-}.tar.bz2" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~amd64 ~x86" + +# other possible flags: +# db2: we lack the dep +# oracle: dito (need Oracle Client Libraries) +# xdb: (almost) dead, surely not supported + +IUSE="botan debug doc geoip ldap libressl lua luajit mydns mysql opendbx postgres protobuf remote sodium sqlite systemd tools tinydns test" + +REQUIRED_USE="mydns? ( mysql ) ?? ( lua luajit )" + +RDEPEND=" + libressl? ( dev-libs/libressl:= ) + !libressl? ( dev-libs/openssl:= ) + >=dev-libs/boost-1.35:= + botan? ( dev-libs/botan:2= ) + lua? ( dev-lang/lua:= ) + luajit? ( dev-lang/luajit:= ) + mysql? ( virtual/mysql ) + postgres? ( dev-db/postgresql:= ) + ldap? ( >=net-nds/openldap-2.0.27-r4 app-crypt/mit-krb5 ) + sqlite? ( dev-db/sqlite:3 ) + opendbx? ( dev-db/opendbx ) + geoip? ( >=dev-cpp/yaml-cpp-0.5.1 dev-libs/geoip ) + sodium? ( dev-libs/libsodium:= ) + tinydns? ( >=dev-db/tinycdb-0.77 ) + protobuf? ( dev-libs/protobuf )" +DEPEND="${RDEPEND} + virtual/pkgconfig + doc? ( app-doc/doxygen )" + +S="${WORKDIR}"/${P/_/-} + +src_configure() { + local dynmodules="pipe bind" # the default backends, always enabled + + #use db2 && dynmodules+=" db2" + use ldap && dynmodules+=" ldap" + use lua && dynmodules+=" lua" + use mydns && dynmodules+=" mydns" + use mysql && dynmodules+=" gmysql" + use opendbx && dynmodules+=" opendbx" + #use oracle && dynmodules+=" goracle oracle" + use postgres && dynmodules+=" gpgsql" + use remote && dynmodules+=" remote" + use sqlite && dynmodules+=" gsqlite3" + use tinydns && dynmodules+=" tinydns" + use geoip && dynmodules+=" geoip" + #use xdb && dynmodules+=" xdb" + + econf \ + --disable-static \ + --sysconfdir=/etc/powerdns \ + --libdir=/usr/$(get_libdir)/powerdns \ + --with-modules= \ + --with-dynmodules="${dynmodules}" \ + --with-mysql-lib=/usr/$(get_libdir) \ + $(use_enable botan) \ + $(use_enable debug verbose-logging) \ + $(use_enable test unit-tests) \ + $(use_enable tools) \ + $(use_enable systemd) \ + $(use_enable sodium libsodium) \ + $(use_with lua) \ + $(use_with luajit) \ + $(use_with protobuf) \ + ${myconf} +} + +src_compile() { + default + use doc && emake -C codedocs codedocs +} + +src_install() { + default + + mv "${D}"/etc/powerdns/pdns.conf{-dist,} + + fperms 0700 /etc/powerdns + fperms 0600 /etc/powerdns/pdns.conf + + # set defaults: setuid=pdns, setgid=pdns + sed -i \ + -e 's/^# set\([ug]\)id=$/set\1id=pdns/g' \ + "${D}"/etc/powerdns/pdns.conf + + newinitd "${FILESDIR}"/pdns-r1 pdns + + keepdir /var/empty + + use doc && dohtml -r codedocs/html/. + + # Install development headers + insinto /usr/include/pdns + doins pdns/*.hh + insinto /usr/include/pdns/backends/gsql + doins pdns/backends/gsql/*.hh + + if use ldap ; then + insinto /etc/openldap/schema + doins "${FILESDIR}"/dnsdomain2.schema + fi + + prune_libtool_files --all +} + +pkg_preinst() { + enewgroup pdns + enewuser pdns -1 -1 /var/empty pdns +} + +pkg_postinst() { + elog "PowerDNS provides multiple instances support. You can create more instances" + elog "by symlinking the pdns init script to another name." + elog + elog "The name must be in the format pdns.<suffix> and PowerDNS will use the" + elog "/etc/powerdns/pdns-<suffix>.conf configuration file instead of the default." + + if use ldap ; then + ewarn "The official LDAP backend module is only compile-tested by upstream." + ewarn "Try net-dns/pdns-ldap-backend if you have problems with it." + fi + + local old + for old in ${REPLACING_VERSIONS}; do + version_compare ${old} 3.2 + [[ $? -eq 1 ]] || continue + + ewarn "To fix a security bug (bug #458018) had the following" + ewarn "files/directories the world-readable bit removed (if set):" + ewarn " ${EPREFIX}/etc/powerdns" + ewarn " ${EPREFIX}/etc/powerdns/pdns.conf" + ewarn "Check if this is correct for your setup" + ewarn "This is a one-time change and will not happen on subsequent updates." + chmod o-rwx "${EPREFIX}"/etc/powerdns/{,pdns.conf} + + break + done +} |