summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorbsiegert <bsiegert>2015-12-17 20:31:35 +0000
committerbsiegert <bsiegert>2015-12-17 20:31:35 +0000
commitf0340cc8cc5f924cccd74a52e0e5533e994e375a (patch)
tree80caa0e25bdedfd9297d2c5c2ef1038be5d5444e
parent1f0b3ced23aa4225aaa3049606939c795d0d2ae9 (diff)
downloadpkgsrc-f0340cc8cc5f924cccd74a52e0e5533e994e375a.tar.gz
Pullup ticket #4871 - requested by taca
net/bind99: security fix Revisions pulled up: - net/bind99/Makefile 1.49-1.50 - net/bind99/distinfo 1.34-1.35 - net/bind99/patches/patch-bin_dig_dighost.c 1.5 - net/bind99/patches/patch-bin_tests_system_Makefile.in 1.6 - net/bind99/patches/patch-configure 1.11 --- Module Name: pkgsrc Committed By: taca Date: Sun Dec 13 17:37:00 UTC 2015 Modified Files: pkgsrc/net/bind99: Makefile distinfo pkgsrc/net/bind99/patches: patch-bin_dig_dighost.c patch-bin_tests_system_Makefile.in patch-configure Log Message: Update bind99 to 9.9.8. Security Fixes * An incorrect boundary check in the OPENPGPKEY rdatatype could trigger an assertion failure. This flaw is disclosed in CVE-2015-5986. [RT #40286] * A buffer accounting error could trigger an assertion failure when parsing certain malformed DNSSEC keys. This flaw was discovered by Hanno Böck of the Fuzzing Project, and is disclosed in CVE-2015-5722. [RT #40212] * A specially crafted query could trigger an assertion failure in message.c. This flaw was discovered by Jonathan Foote, and is disclosed in CVE-2015-5477. [RT #40046] * On servers configured to perform DNSSEC validation, an assertion failure could be triggered on answers from a specially configured server. This flaw was discovered by Breno Silveira Soares, and is disclosed in CVE-2015-4620. [RT #39795] New Features * New quotas have been added to limit the queries that are sent by recursive resolvers to authoritative servers experiencing denial-of-service attacks. When configured, these options can both reduce the harm done to authoritative servers and also avoid the resource exhaustion that can be experienced by recursives when they are being used as a vehicle for such an attack. NOTE: These options are not available by default; use configure --enable-fetchlimit to include them in the build. + fetches-per-server limits the number of simultaneous queries that can be sent to any single authoritative server. The configured value is a starting point; it is automatically adjusted downward if the server is partially or completely non-responsive. The algorithm used to adjust the quota can be configured via the fetch-quota-params option. + fetches-per-zone limits the number of simultaneous queries that can be sent for names within a single domain. (Note: Unlike "fetches-per-server", this value is not self-tuning.) Statistics counters have also been added to track the number of queries affected by these quotas. * An --enable-querytrace configure switch is now available to enable very verbose query tracelogging. This option can only be set at compile time. This option has a negative performance impact and should be used only for debugging. * EDNS COOKIE options content is now displayed as "COOKIE: <hexvalue>". Feature Changes * Large inline-signing changes should be less disruptive. Signature generation is now done incrementally; the number of signatures to be generated in each quantum is controlled by "sig-signing-signatures number;". [RT #37927] * Retrieving the local port range from net.ipv4.ip_local_port_range on Linux is now supported. * Active Directory names of the form gc._msdcs.<forest> are now accepted as valid hostnames when using the check-names option. <forest> is still restricted to letters, digits and hyphens. * Names containing rich text are now accepted as valid hostnames in PTR records in DNS-SD reverse lookup zones, as specified in RFC 6763. [RT #37889] Bug Fixes * Asynchronous zone loads were not handled correctly when the zone load was already in progress; this could trigger a crash in zt.c. [RT #37573] * A race during shutdown or reconfiguration could cause an assertion failure in mem.c. [RT #38979] * Some answer formatting options didn't work correctly with dig +short. [RT #39291] * Malformed records of some types, including NSAP and UNSPEC, could trigger assertion failures when loading text zone files. [RT #40274] [RT #40285] * Fixed a possible crash in ratelimiter.c caused by NOTIFY messages being removed from the wrong rate limiter queue. [RT #40350] * The default rrset-order of random was inconsistently applied. [RT #40456] * BADVERS responses from broken authoritative name servers were not handled correctly. [RT #40427] --- Module Name: pkgsrc Committed By: taca Date: Wed Dec 16 00:32:06 UTC 2015 Modified Files: pkgsrc/net/bind99: Makefile distinfo Log Message: Update bind99 package to 9.9.8pl2 (BIND 9.9.8-P2), security release. --- 9.9.8-P2 released --- 4270. [security] Update allowed OpenSSL versions as named is potentially vulnerable to CVE-2015-3193. 4261. [maint] H.ROOT-SERVERS.NET is 198.97.190.53 and 2001:500:1::53. [RT #40556] 4260. [security] Insufficient testing when parsing a message allowed records with an incorrect class to be be accepted, triggering a REQUIRE failure when those records were subsequently cached. (CVE-2015-8000) [RT #40987] 4253. [security] Address fetch context reference count handling error on socket error. (CVE-2015-8461) [RT#40945] --- 9.9.8-P1 (withdrawn) ---
-rw-r--r--net/bind99/Makefile4
-rw-r--r--net/bind99/distinfo15
-rw-r--r--net/bind99/patches/patch-bin_dig_dighost.c39
-rw-r--r--net/bind99/patches/patch-bin_tests_system_Makefile.in10
-rw-r--r--net/bind99/patches/patch-configure27
5 files changed, 34 insertions, 61 deletions
diff --git a/net/bind99/Makefile b/net/bind99/Makefile
index e4ab0e9b810..887600684e7 100644
--- a/net/bind99/Makefile
+++ b/net/bind99/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.48 2015/09/03 00:35:03 taca Exp $
+# $NetBSD: Makefile,v 1.48.2.1 2015/12/17 20:31:35 bsiegert Exp $
DISTNAME= bind-${BIND_VERSION}
PKGNAME= ${DISTNAME:S/-P/pl/}
@@ -14,7 +14,7 @@ CONFLICTS+= host-[0-9]*
MAKE_JOBS_SAFE= no
-BIND_VERSION= 9.9.7-P3
+BIND_VERSION= 9.9.8-P2
.include "../../mk/bsd.prefs.mk"
diff --git a/net/bind99/distinfo b/net/bind99/distinfo
index df6dfc65cb2..2d567151d6c 100644
--- a/net/bind99/distinfo
+++ b/net/bind99/distinfo
@@ -1,12 +1,13 @@
-$NetBSD: distinfo,v 1.32 2015/09/03 00:35:03 taca Exp $
+$NetBSD: distinfo,v 1.32.2.1 2015/12/17 20:31:35 bsiegert Exp $
-SHA1 (bind-9.9.7-P3.tar.gz) = 44786ddeb1b35eb61d521c9e46375dae7d85f378
-RMD160 (bind-9.9.7-P3.tar.gz) = a6506df81a2a8e7ab81b1eece846d906deac64eb
-Size (bind-9.9.7-P3.tar.gz) = 7939885 bytes
-SHA1 (patch-bin_dig_dighost.c) = a18a3d98c85ce8962024d53e01159fd95f99cae4
-SHA1 (patch-bin_tests_system_Makefile.in) = 483fca89658263f5c1f974ce1151721835355aa8
+SHA1 (bind-9.9.8-P2.tar.gz) = 4e4c8f2bbc20cd93465443e98a42de1bc17722d3
+RMD160 (bind-9.9.8-P2.tar.gz) = 6527b86cbb67e88f879240289231f25b1c35fd2c
+SHA512 (bind-9.9.8-P2.tar.gz) = b3983f380ee27ccae30021087ade817f7d6708f3606c64398ef8d1625591859c2ecf7fe4f67e84bb5af3600a532b1ec045429fd47defe232c61395eae661ca67
+Size (bind-9.9.8-P2.tar.gz) = 7996912 bytes
+SHA1 (patch-bin_dig_dighost.c) = a4bc9558c5dbedcc6bb0f87ea309358ca098d42a
+SHA1 (patch-bin_tests_system_Makefile.in) = 19d90050acfbe3da838dbd4c1436b5581039b71f
SHA1 (patch-config.threads.in) = 227b83efe9cb3e301aaac9b97cf42f1fb8ad06b2
-SHA1 (patch-configure) = d3d9b8e531fbaad3ab42a86735cc01d5d4fbcdf0
+SHA1 (patch-configure) = 1e86fab1a82f237dfc7f1a3c09e4ef6095bf973e
SHA1 (patch-contrib_dlz_config.dlz.in) = f18bec63fbfce7cb2cd72929058ce3770fce458f
SHA1 (patch-lib_dns_rbt.c) = df4b029369d9fa3b250d8505b5f7590e2cd86654
SHA1 (patch-lib_lwres_getaddrinfo.c) = cda91b6d1afa02de2c59d51490090ef4ab7f1a41
diff --git a/net/bind99/patches/patch-bin_dig_dighost.c b/net/bind99/patches/patch-bin_dig_dighost.c
index c6b8acf8ae0..039d20cf541 100644
--- a/net/bind99/patches/patch-bin_dig_dighost.c
+++ b/net/bind99/patches/patch-bin_dig_dighost.c
@@ -1,11 +1,11 @@
-$NetBSD: patch-bin_dig_dighost.c,v 1.4 2015/02/26 10:14:10 taca Exp $
+$NetBSD: patch-bin_dig_dighost.c,v 1.4.6.1 2015/12/17 20:31:35 bsiegert Exp $
* Avoid to use true as variable name.
---- bin/dig/dighost.c.orig 2015-02-18 01:56:06.000000000 +0000
+--- bin/dig/dighost.c.orig 2015-09-09 02:23:50.000000000 +0000
+++ bin/dig/dighost.c
-@@ -4436,7 +4436,7 @@ prepare_lookup(dns_name_t *name)
- isc_result_t result;
+@@ -4429,7 +4429,7 @@ prepare_lookup(dns_name_t *name)
+ isc_buffer_t *b = NULL;
isc_region_t r;
dns_rdataset_t *rdataset = NULL;
- isc_boolean_t true = ISC_TRUE;
@@ -13,7 +13,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.4 2015/02/26 10:14:10 taca Exp $
#endif
memset(namestr, 0, DNS_NAME_FORMATSIZE);
-@@ -4450,7 +4450,7 @@ prepare_lookup(dns_name_t *name)
+@@ -4443,7 +4443,7 @@ prepare_lookup(dns_name_t *name)
result = advanced_rrsearch(&rdataset, &ns.name,
dns_rdatatype_aaaa,
@@ -22,7 +22,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.4 2015/02/26 10:14:10 taca Exp $
if (result == ISC_R_SUCCESS) {
for (result = dns_rdataset_first(rdataset);
result == ISC_R_SUCCESS;
-@@ -4479,7 +4479,7 @@ prepare_lookup(dns_name_t *name)
+@@ -4472,7 +4472,7 @@ prepare_lookup(dns_name_t *name)
rdataset = NULL;
result = advanced_rrsearch(&rdataset, &ns.name, dns_rdatatype_a,
@@ -31,7 +31,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.4 2015/02/26 10:14:10 taca Exp $
if (result == ISC_R_SUCCESS) {
for (result = dns_rdataset_first(rdataset);
result == ISC_R_SUCCESS;
-@@ -4598,11 +4598,11 @@ isc_result_t
+@@ -4591,11 +4591,11 @@ isc_result_t
initialization(dns_name_t *name)
{
isc_result_t result;
@@ -45,7 +45,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.4 2015/02/26 10:14:10 taca Exp $
if (result != ISC_R_SUCCESS) {
printf("\n;; NS RRset is missing to continue validation:"
" FAILED\n\n");
-@@ -4960,7 +4960,7 @@ sigchase_td(dns_message_t *msg)
+@@ -4950,7 +4950,7 @@ sigchase_td(dns_message_t *msg)
isc_result_t result;
dns_name_t *name = NULL;
isc_boolean_t have_answer = ISC_FALSE;
@@ -54,16 +54,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.4 2015/02/26 10:14:10 taca Exp $
if (msg->rcode != dns_rcode_noerror &&
msg->rcode != dns_rcode_nxdomain) {
-@@ -4983,7 +4983,7 @@ sigchase_td(dns_message_t *msg)
- initialization(name);
- return;
- }
-- have_answer = true;
-+ have_answer = isc_true;
- } else {
- if (!current_lookup->trace_root_sigchase) {
- result = dns_message_firstname(msg,
-@@ -5104,7 +5104,7 @@ sigchase_td(dns_message_t *msg)
+@@ -5092,7 +5092,7 @@ sigchase_td(dns_message_t *msg)
dns_rdatatype_rrsig,
current_lookup
->rdtype_sigchase,
@@ -72,7 +63,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.4 2015/02/26 10:14:10 taca Exp $
if (result == ISC_R_FAILURE) {
printf("\n;; RRset is missing to continue"
" validation SHOULD NOT APPEND:"
-@@ -5117,7 +5117,7 @@ sigchase_td(dns_message_t *msg)
+@@ -5105,7 +5105,7 @@ sigchase_td(dns_message_t *msg)
&chase_authority_name,
dns_rdatatype_rrsig,
dns_rdatatype_any,
@@ -81,7 +72,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.4 2015/02/26 10:14:10 taca Exp $
if (result == ISC_R_FAILURE) {
printf("\n;; RRSIG is missing to continue"
" validation SHOULD NOT APPEND:"
-@@ -5193,7 +5193,7 @@ sigchase_td(dns_message_t *msg)
+@@ -5181,7 +5181,7 @@ sigchase_td(dns_message_t *msg)
&chase_authority_name,
dns_rdatatype_rrsig,
dns_rdatatype_ds,
@@ -90,7 +81,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.4 2015/02/26 10:14:10 taca Exp $
if (result != ISC_R_SUCCESS) {
printf("\n;; DSset is missing to continue validation:"
" FAILED\n\n");
-@@ -5281,7 +5281,7 @@ sigchase_td(dns_message_t *msg)
+@@ -5268,7 +5268,7 @@ sigchase_td(dns_message_t *msg)
result = advanced_rrsearch(&chase_rdataset, &chase_name,
current_lookup->rdtype_sigchase,
dns_rdatatype_any ,
@@ -99,7 +90,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.4 2015/02/26 10:14:10 taca Exp $
if (result == ISC_R_FAILURE) {
printf("\n;; RRsig of RRset is missing to continue validation"
" SHOULD NOT APPEND: FAILED\n\n");
-@@ -5324,7 +5324,7 @@ getneededrr(dns_message_t *msg)
+@@ -5311,7 +5311,7 @@ getneededrr(dns_message_t *msg)
dns_name_t *name = NULL;
dns_rdata_t sigrdata = DNS_RDATA_INIT;
dns_rdata_sig_t siginfo;
@@ -108,7 +99,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.4 2015/02/26 10:14:10 taca Exp $
if ((result = dns_message_firstname(msg, DNS_SECTION_ANSWER))
!= ISC_R_SUCCESS) {
-@@ -5340,7 +5340,7 @@ getneededrr(dns_message_t *msg)
+@@ -5327,7 +5327,7 @@ getneededrr(dns_message_t *msg)
if (chase_rdataset == NULL) {
result = advanced_rrsearch(&chase_rdataset, name,
dns_rdatatype_any,
@@ -117,7 +108,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.4 2015/02/26 10:14:10 taca Exp $
if (result != ISC_R_SUCCESS) {
printf("\n;; No Answers: Validation FAILED\n\n");
return (ISC_R_NOTFOUND);
-@@ -5459,7 +5459,7 @@ getneededrr(dns_message_t *msg)
+@@ -5446,7 +5446,7 @@ getneededrr(dns_message_t *msg)
result = advanced_rrsearch(&chase_sigdsrdataset,
&chase_signame,
dns_rdatatype_rrsig,
diff --git a/net/bind99/patches/patch-bin_tests_system_Makefile.in b/net/bind99/patches/patch-bin_tests_system_Makefile.in
index f4f0419564a..57c4d6147d2 100644
--- a/net/bind99/patches/patch-bin_tests_system_Makefile.in
+++ b/net/bind99/patches/patch-bin_tests_system_Makefile.in
@@ -1,15 +1,15 @@
-$NetBSD: patch-bin_tests_system_Makefile.in,v 1.5 2014/10/14 16:21:02 taca Exp $
+$NetBSD: patch-bin_tests_system_Makefile.in,v 1.5.8.1 2015/12/17 20:31:35 bsiegert Exp $
Build fix for DragonFly while linking of driver.so.
---- bin/tests/system/Makefile.in.orig 2014-09-16 19:27:20.000000000 +0000
+--- bin/tests/system/Makefile.in.orig 2015-09-09 02:23:50.000000000 +0000
+++ bin/tests/system/Makefile.in
@@ -19,7 +19,7 @@ top_srcdir = @top_srcdir@
@BIND9_MAKE_INCLUDES@
--SUBDIRS = builtin dlzexternal filter-aaaa lwresd rpz rrl \
-+SUBDIRS = builtin filter-aaaa lwresd rpz rrl \
- rsabigexponent tkey tsiggss
+-SUBDIRS = builtin dlzexternal fetchlimit filter-aaaa lwresd \
++SUBDIRS = builtin fetchlimit filter-aaaa lwresd \
+ statistics rpz rrl rsabigexponent tkey tsiggss
TARGETS =
diff --git a/net/bind99/patches/patch-configure b/net/bind99/patches/patch-configure
index 22a79565a2f..6998d6778ee 100644
--- a/net/bind99/patches/patch-configure
+++ b/net/bind99/patches/patch-configure
@@ -1,30 +1,11 @@
-$NetBSD: patch-configure,v 1.10 2015/02/26 10:14:10 taca Exp $
+$NetBSD: patch-configure,v 1.10.6.1 2015/12/17 20:31:35 bsiegert Exp $
* Add DragonFly support.
* Link proper postgresql library.
-* Avoid using "==" for argument of test(1).
---- configure.orig 2015-02-18 01:56:06.000000000 +0000
+--- configure.orig 2015-09-09 02:23:50.000000000 +0000
+++ configure
-@@ -11691,7 +11691,7 @@ fi
- test -n "$PYTHON" && break
- done
-
-- if test "X$PYTHON" == "X"; then
-+ if test "X$PYTHON" = "X"; then
- continue;
- fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking python module 'argparse'" >&5
-@@ -11706,7 +11706,7 @@ $as_echo "not found" >&6; }
- unset ac_cv_path_PYTHON
- unset PYTHON
- done
-- if test "X$PYTHON" == "X"
-+ if test "X$PYTHON" = "X"
- then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for python support" >&5
- $as_echo_n "checking for python support... " >&6; }
-@@ -14560,6 +14560,8 @@ case $host in
+@@ -14572,6 +14572,8 @@ case $host in
use_threads=false ;;
*-freebsd*)
use_threads=true ;;
@@ -33,7 +14,7 @@ $NetBSD: patch-configure,v 1.10 2015/02/26 10:14:10 taca Exp $
*-bsdi[234]*)
# Thread signals do not work reliably on some versions of BSD/OS.
use_threads=false ;;
-@@ -19923,7 +19925,7 @@ $as_echo "no" >&6; }
+@@ -20162,7 +20164,7 @@ $as_echo "no" >&6; }
fi
if test -n "-L$use_dlz_postgres_lib -lpq"
then