gentoo resync : 23.06.2018

5 files changed, 215 insertions, 2 deletions

diff --git a/net-dns/bind/Manifest b/net-dns/bind/Manifest
index 9620772e9fbc..259909055ea1 100644
--- a/net-dns/bind/Manifest
+++ b/net-dns/bind/Manifest
@@ -1,4 +1,6 @@
 AUX 10bind.env 27 BLAKE2B e5ddb2daced1b9430cb8e4b691bc0f1164f71a6e2032fa4efd18b629a6aeb971336d5eaa38c6474a3143cb34691c22d4564ebb010d9efd00cf6e2634daa8e68c SHA512 8ae5326b158b8a3eeaab667c84dd712fefd25d10832598783fa497285183cbdee554796c22d32fec54cd00461469f29ed473a730304a00aacdf06c1bb6c33d55
+AUX bind-9.11.3-CVE-2018-5738.patch 3925 BLAKE2B cda7036cfe855496b9a073eac7248bdc4743d52af1309cdaec9dc787a2e252e04a91ea367b031b2692e0c5b90f305c9e5187c3d2acbfecbad4a812f9fcb59d5c SHA512 39a8900eb859491dc58b7d15c34455ed7580c3d11f914663f599adfc10ba2c42f04234e7b92d6d350f20e5aa4b397d7e9905881719962d8ea1ebf72c8f47de8a
+AUX bind-9.12.1_p2-CVE-2018-5738.patch 3476 BLAKE2B cc414e207ea8598a56ce6917adb96e243a60c921643bc36ab0a45dd1cae491bd4471f9b0f55e6b4e38c10172929884b039ad437bfbd1ab84a9142f5b083e4af4 SHA512 0a9b4fe8e404e8b68b851b85b5b10c87f3653c81c0cef747bca880a37c8bd64fa1100cc210fa33ac7504197c1e81d064af90cf362dba6897c9bf87b19ea467fe
 AUX generate-rndc-key.sh 183 BLAKE2B 33f2297745ef8e5aed09107cee6d0017d3870ea9db249a17850ae7a55f613b03a136bc61b8ac4526858178a0f8713eabda6c5f30917415f9a3ad6b34668f45ab SHA512 6c611120185c1a61b2b6da228efc28302ebd36c819b97793920543ce2cfff4da84f43ec53ddd072f008b04c7087cc19108c4279cb962d12a7e073b47235d14ee
 AUX localhost.zone-r3 426 BLAKE2B d34cf12d484c6bb705d3bd8bfbf93514e504497a99da983f6176234239cc664131502744f3cd743d938dec0309f0d8df2c1d0c5325b5cb61023ed192d32bbedd SHA512 979d8693046033c24490dca536f0d649795bbdf57eed32017b32d07d7d3c51b35197e4edd79d8258074a1bf14b71376472ba6ae749f62ceaf74d7a6a0559fa89
 AUX named.cache-r3 3316 BLAKE2B 09a17fbb29f2122a61c7e17a8dfc8eef3b0fdaa94e8dbe17a0b188946fe8017c65599fbb84c0f88123f0e0f17faae2b9a1ffbc0ee17bcf62c1cbf34f064b9c36 SHA512 3608f29d356bf853145e14c1f81fdccf7090f63e95573234221711b7b6084fbc806817c41daa5d6072a4955a714f9e1cbd6cdcabd7cd1833c3e5f8387bc1ba20
@@ -12,6 +14,6 @@ DIST bind-9.11.3.tar.gz 9523375 BLAKE2B 978986e02767b8ac9f015b52e87b3bc161a7ea72
 DIST bind-9.12.1_p2.tar.gz 9305005 BLAKE2B 6be328e9e14a26d17c2f789aafc1f83a4690db0b0ae2aeac7dcc4b54a0e5d228692475a39160599fc5c6fd7ed8733d2f0bbac65a20c513f5fa7b6b49ad4b09ae SHA512 de47eef272c437316444c4f585a2f98ae9169fc118fd057464a5cd064bb9079ffc07145dabf388cd240f56a5ad6d3ad78cf8d98fc37609681eba5d87e18a4f9a
 DIST dyndns-samples.tbz2 22866 BLAKE2B 409890653c6536cb9c0e3ba809d2bfde0e0ae73a2a101b4f229b46c01568466bc022bbbc37712171adbd08c572733e93630feab95a0fcd1ac50a7d37da1d1108 SHA512 83b0bf99f8e9ff709e8e9336d8c5231b98a4b5f0c60c10792f34931e32cc638d261967dfa5a83151ec3740977d94ddd6e21e9ce91267b3e279b88affdbc18cac
 EBUILD bind-9.11.2_p1.ebuild 12446 BLAKE2B fe6955788d154964b51fa1fc891070dad6183da778f10d0fb9d0089032e3fe55b7aaf814aacff6de1685c447b44717827a765e47e347bd9c4d1e692e4aebbeb5 SHA512 10bd18014db1837d12398d1978c65a20595de1fed0227b5117c702cc749fbf5b19a37f236e4fe8907e7d50868e4d88fa28103b5c9e7a6c447836c9ddfa658862
-EBUILD bind-9.11.3.ebuild 12103 BLAKE2B 5ee8ee281a2d38c2785330c60e1c0ed434f7d4cc056a8eff93f6b2f0ba7ad4c4a96a2fd0843cbf0fe7f72d90a0f770add672c73a1fe6c90736d364acf25a1383 SHA512 4a09d416fa01b6f41a531908e9615180d4175311b7e7fa7190faa59edd84ab53ed736108598fb464dfc80985f9ed9e40c19444f15d5cc9953ab0a82b9b9b7f55
-EBUILD bind-9.12.1_p2.ebuild 12062 BLAKE2B d9acac75ce778b1d30df9751b919160dd5b62dd729376471ef4f28625e236aced68958291e3a38ef3a5e7ec9417c189dad45285895049b6c3d2c064ba9b130b9 SHA512 5841daabf646ec8dc333e1df81b392b1ba7a22022a8c7905fe0cf677cdd5d8a98bcfd573cc261f1fc6d6b5da18e9b46137a9e7a9609694a148470fa622317a80
+EBUILD bind-9.11.3-r1.ebuild 12181 BLAKE2B 8efe68cae507e1d58df6081419c9db121d7b5d9ef8345defbfb52323390b248b8d3864736df2b6a8dfa393c53534aab0e8b433f21444ec6869d745386e3987de SHA512 cde50f5355c5efc37600c2cae49eed83d296b8fd862fcb512acb8fd4838efd738d890e29d7664a820ac3a93cd23b3844b9357c4f3c0301843876598d8163e8d6
+EBUILD bind-9.12.1_p2-r1.ebuild 12140 BLAKE2B 3c4198382162186541ca90b176b5c3bed82be1e38d48f2e5b2a3d2329e9a9b757b7b69362e5c9276ca158e250a3764d411aad3e55655f21ef92c3bade0dd0890 SHA512 e36ce712b00c80f4518907e7e58e01a1d83b0118544ee3ea5cf15d8906574e09d834831c6af6da23e0cd1884bc1b070720cc85f52a02ff11b13ab3d3b3983236
 MISC metadata.xml 1225 BLAKE2B 731eb2beeb78b21f6dfd01ad2ea13ca45cc26b34e767a0776ef6c6c5370cd7389a9a2670ada393977a9cd887c9e7f09bb64ade83dec6e131a0f7db293a515d7d SHA512 a2e7cc788973055c0aad540eaf2f0bacdc552299ae74e0f80a04bff091e457abd9386aa2a84b7b71fd4f612f960114c5a9c1cc9057bbabff3398737e064d42b8
diff --git a/net-dns/bind/bind-9.11.3.ebuild b/net-dns/bind/bind-9.11.3-r1.ebuild
index 4da95bc7613a..74e4fcd1fc13 100644
--- a/net-dns/bind/bind-9.11.3.ebuild
+++ b/net-dns/bind/bind-9.11.3-r1.ebuild
@@ -109,6 +109,9 @@ src_prepare() {
 			"${i}" || die "sed failed, ${i} doesn't exist"
 	done
 
+	# bug 657654 / CVE-2018-5738
+	epatch "${FILESDIR}/${P}-CVE-2018-5738.patch"
+
 #	if use dlz; then
 #		# sdb-ldap patch as per  bug #160567
 #		# Upstream URL: http://bind9-ldap.bayour.com/
diff --git a/net-dns/bind/bind-9.12.1_p2.ebuild b/net-dns/bind/bind-9.12.1_p2-r1.ebuild
index a8a7a130b53b..3e1a46c7bf05 100644
--- a/net-dns/bind/bind-9.12.1_p2.ebuild
+++ b/net-dns/bind/bind-9.12.1_p2-r1.ebuild
@@ -107,6 +107,9 @@ src_prepare() {
 			"${i}" || die "sed failed, ${i} doesn't exist"
 	done
 
+	# bug 657654 / CVE-2018-5738
+	epatch "${FILESDIR}/${P}-CVE-2018-5738.patch"
+
 #	if use dlz; then
 #		# sdb-ldap patch as per  bug #160567
 #		# Upstream URL: http://bind9-ldap.bayour.com/
diff --git a/net-dns/bind/files/bind-9.11.3-CVE-2018-5738.patch b/net-dns/bind/files/bind-9.11.3-CVE-2018-5738.patch
new file mode 100644
index 000000000000..4a2c7832ebfe
--- /dev/null
+++ b/net-dns/bind/files/bind-9.11.3-CVE-2018-5738.patch
@@ -0,0 +1,110 @@
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 64a5180..41a1826 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -3376,10 +3376,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+		dns_acache_setcachesize(view->acache, max_acache_size);
+	}
+
+-	CHECK(configure_view_acl(vconfig, config, ns_g_config,
+-				 "allow-query", NULL, actx,
+-				 ns_g_mctx, &view->queryacl));
+-
+	/*
+	 * Make the list of response policy zone names for a view that
+	 * is used for real lookups and so cares about hints.
+@@ -4258,9 +4254,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+	INSIST(result == ISC_R_SUCCESS);
+	view->trust_anchor_telemetry = cfg_obj_asboolean(obj);
+
+-	CHECK(configure_view_acl(vconfig, config, ns_g_config,
+-				 "allow-query-cache-on", NULL, actx,
+-				 ns_g_mctx, &view->cacheonacl));
+	/*
+	 * Set sources where additional data and CNAME/DNAME
+	 * targets for authoritative answers may be found.
+@@ -4287,22 +4280,40 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+		view->additionalfromcache = ISC_TRUE;
+	}
+
++	CHECK(configure_view_acl(vconfig, config, ns_g_config,
++				 "allow-query-cache-on", NULL, actx,
++				 ns_g_mctx, &view->cacheonacl));
++
+	/*
+-	 * Set "allow-query-cache", "allow-recursion", and
+-	 * "allow-recursion-on" acls if configured in named.conf.
+-	 * (Ignore the global defaults for now, because these ACLs
+-	 * can inherit from each other when only some of them set at
+-	 * the options/view level.)
++	 * Set the "allow-query", "allow-query-cache", "allow-recursion",
++	 * and "allow-recursion-on" ACLs if configured in named.conf, but
++	 * NOT from the global defaults. This is done by leaving the third
++	 * argument to configure_view_acl() NULL.
++	 *
++	 * We ignore the global defaults here because these ACLs
++	 * can inherit from each other.  If any are still unset after
++	 * applying the inheritance rules, we'll look up the defaults at
++	 * that time.
+	 */
+-	CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache",
+-				 NULL, actx, ns_g_mctx, &view->cacheacl));
++
++	/* named.conf only */
++	CHECK(configure_view_acl(vconfig, config, NULL,
++				 "allow-query", NULL, actx,
++				 ns_g_mctx, &view->queryacl));
++
++	/* named.conf only */
++	CHECK(configure_view_acl(vconfig, config, NULL,
++				 "allow-query-cache", NULL, actx,
++				 ns_g_mctx, &view->cacheacl));
+
+	if (strcmp(view->name, "_bind") != 0 &&
+	    view->rdclass != dns_rdataclass_chaos)
+	{
++		/* named.conf only */
+		CHECK(configure_view_acl(vconfig, config, NULL,
+					 "allow-recursion", NULL, actx,
+					 ns_g_mctx, &view->recursionacl));
++		/* named.conf only */
+		CHECK(configure_view_acl(vconfig, config, NULL,
+					 "allow-recursion-on", NULL, actx,
+					 ns_g_mctx, &view->recursiononacl));
+@@ -4340,18 +4351,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+		 * the global config.
+		 */
+		if (view->recursionacl == NULL) {
++			/* global default only */
+			CHECK(configure_view_acl(NULL, NULL, ns_g_config,
+						 "allow-recursion", NULL,
+						 actx, ns_g_mctx,
+						 &view->recursionacl));
+		}
+		if (view->recursiononacl == NULL) {
++			/* global default only */
+			CHECK(configure_view_acl(NULL, NULL, ns_g_config,
+						 "allow-recursion-on", NULL,
+						 actx, ns_g_mctx,
+						 &view->recursiononacl));
+		}
+		if (view->cacheacl == NULL) {
++			/* global default only */
+			CHECK(configure_view_acl(NULL, NULL, ns_g_config,
+						 "allow-query-cache", NULL,
+						 actx, ns_g_mctx,
+@@ -4365,6 +4379,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+		CHECK(dns_acl_none(mctx, &view->cacheacl));
+	}
+
++	if (view->queryacl == NULL) {
++		/* global default only */
++		CHECK(configure_view_acl(NULL, NULL, ns_g_config,
++					 "allow-query", NULL,
++					 actx, ns_g_mctx,
++					 &view->queryacl));
++	}
++
+	/*
+	 * Ignore case when compressing responses to the specified
+	 * clients. This causes case not always to be preserved,
diff --git a/net-dns/bind/files/bind-9.12.1_p2-CVE-2018-5738.patch b/net-dns/bind/files/bind-9.12.1_p2-CVE-2018-5738.patch
new file mode 100644
index 000000000000..75c98d4f1755
--- /dev/null
+++ b/net-dns/bind/files/bind-9.12.1_p2-CVE-2018-5738.patch
@@ -0,0 +1,95 @@
+diff --git a/bin/named/server.c b/bin/named/server.c
+index f63554e..847c4ff 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -3725,10 +3725,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+	CHECKM(named_config_getport(config, &port), "port");
+	dns_view_setdstport(view, port);
+
+-	CHECK(configure_view_acl(vconfig, config, named_g_config,
+-				 "allow-query", NULL, actx,
+-				 named_g_mctx, &view->queryacl));
+-
+	/*
+	 * Make the list of response policy zone names for a view that
+	 * is used for real lookups and so cares about hints.
+@@ -4692,21 +4688,35 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+				 "allow-query-cache-on", NULL, actx,
+				 named_g_mctx, &view->cacheonacl));
+	/*
+-	 * Set "allow-query-cache", "allow-recursion", and
+-	 * "allow-recursion-on" acls if configured in named.conf.
+-	 * (Ignore the global defaults for now, because these ACLs
+-	 * can inherit from each other when only some of them set at
+-	 * the options/view level.)
++	 * Set the "allow-query", "allow-query-cache", "allow-recursion",
++	 * and "allow-recursion-on" ACLs if configured in named.conf, but
++	 * NOT from the global defaults. This is done by leaving the third
++	 * argument to configure_view_acl() NULL.
++	 *
++	 * We ignore the global defaults here because these ACLs
++	 * can inherit from each other.  If any are still unset after
++	 * applying the inheritance rules, we'll look up the defaults at
++	 * that time.
+	 */
+-	CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache",
+-				 NULL, actx, named_g_mctx, &view->cacheacl));
++
++	/* named.conf only */
++	CHECK(configure_view_acl(vconfig, config, NULL,
++				 "allow-query", NULL, actx,
++				 named_g_mctx, &view->queryacl));
++
++	/* named.conf only */
++	CHECK(configure_view_acl(vconfig, config, NULL,
++				 "allow-query-cache", NULL, actx,
++				 named_g_mctx, &view->cacheacl));
+
+	if (strcmp(view->name, "_bind") != 0 &&
+	    view->rdclass != dns_rdataclass_chaos)
+	{
++		/* named.conf only */
+		CHECK(configure_view_acl(vconfig, config, NULL,
+					 "allow-recursion", NULL, actx,
+					 named_g_mctx, &view->recursionacl));
++		/* named.conf only */
+		CHECK(configure_view_acl(vconfig, config, NULL,
+					 "allow-recursion-on", NULL, actx,
+					 named_g_mctx, &view->recursiononacl));
+@@ -4744,18 +4754,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+		 * the global config.
+		 */
+		if (view->recursionacl == NULL) {
++			/* global default only */
+			CHECK(configure_view_acl(NULL, NULL, named_g_config,
+						 "allow-recursion", NULL,
+						 actx, named_g_mctx,
+						 &view->recursionacl));
+		}
+		if (view->recursiononacl == NULL) {
++			/* global default only */
+			CHECK(configure_view_acl(NULL, NULL, named_g_config,
+						 "allow-recursion-on", NULL,
+						 actx, named_g_mctx,
+						 &view->recursiononacl));
+		}
+		if (view->cacheacl == NULL) {
++			/* global default only */
+			CHECK(configure_view_acl(NULL, NULL, named_g_config,
+						 "allow-query-cache", NULL,
+						 actx, named_g_mctx,
+@@ -4769,6 +4782,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+		CHECK(dns_acl_none(mctx, &view->cacheacl));
+	}
+
++	if (view->queryacl == NULL) {
++		/* global default only */
++		CHECK(configure_view_acl(NULL, NULL, named_g_config,
++					 "allow-query", NULL,
++					 actx, named_g_mctx,
++					 &view->queryacl));
++	}
++
+	/*
+	 * Ignore case when compressing responses to the specified
+	 * clients. This causes case not always to be preserved,