net-dns/pdns-recursor: Revision bump, security bug #638568

Package-Manager: Portage-2.3.14, Repoman-2.3.6
Signed-off-by: Sven Wegener <swegener@gentoo.org>

4 files changed, 175 insertions, 0 deletions

diff --git a/net-dns/pdns-recursor/files/CVE-2017-15090-4.0.6.patch b/net-dns/pdns-recursor/files/CVE-2017-15090-4.0.6.patch
new file mode 100644
index 000000000000..fa0bfd099abf
--- /dev/null
+++ b/net-dns/pdns-recursor/files/CVE-2017-15090-4.0.6.patch
@@ -0,0 +1,15 @@
+diff -ru pdns-recursor-4.0.6.orig/validate-recursor.cc pdns-recursor-4.0.6/validate-recursor.cc
+--- pdns-recursor-4.0.6.orig/validate-recursor.cc	2017-07-04 17:43:07.000000000 +0200
++++ pdns-recursor-4.0.6/validate-recursor.cc	2017-11-02 18:29:16.612520450 +0100
+@@ -87,6 +87,11 @@
+     bool first = true;
+     for(const auto& csp : cspmap) {
+       for(const auto& sig : csp.second.signatures) {
++
++        if (!csp.first.first.isPartOf(sig->d_signer)) {
++          return increaseDNSSECStateCounter(Bogus);
++        }
++
+         vState newState = getKeysFor(sro, sig->d_signer, keys); // XXX check validity here
+ 
+         if (newState == Bogus) // No hope
diff --git a/net-dns/pdns-recursor/files/CVE-2017-15092-4.0.6.patch b/net-dns/pdns-recursor/files/CVE-2017-15092-4.0.6.patch
new file mode 100644
index 000000000000..1425c33586c2
--- /dev/null
+++ b/net-dns/pdns-recursor/files/CVE-2017-15092-4.0.6.patch
@@ -0,0 +1,85 @@
+diff -ru pdns-recursor-4.0.6.orig/html/local.js pdns-recursor-4.0.6/html/local.js
+--- pdns-recursor-4.0.6.orig/html/local.js	2017-07-04 17:43:07.000000000 +0200
++++ pdns-recursor-4.0.6/html/local.js	2017-11-02 18:26:04.624586674 +0100
+@@ -63,7 +63,7 @@
+ 
+ 	$.getJSON(qstring,
+ 		  function(data) {
+-		      var bouw="<table><tr><th>Number</th><th>Domain</th><th>Type</th></tr>";
++		      var table = $('<table><tr><th>Number</th><th>Domain</th><th>Type</th></tr></table>');
+ 		      var num=0;
+ 		      var total=0, rest=0;
+ 		      $.each(data["entries"], function(a,b) {
+@@ -75,12 +75,26 @@
+ 			  if(b[1].length > 25)
+ 			      b[1]=b[1].substring(0,25);
+ 
+-			  bouw=bouw+("<tr><td>"+b[0]+"</td><td>"+b[1]+"</td><td>"+b[2]+"</td></tr>");
+-		      });
+-		      bouw+="<tr><td>"+rest+"</td><td>Rest</td></tr>";
+-		      bouw=bouw+"</table>";
+-		      $("#queryring").html(bouw);
+-
++			  var line = $('<tr />');
++			  var number = $('<td />');
++			  number.text(b[0]);
++			  var domain = $('<td />');
++			  domain.text(b[1]);
++			  var type = $('<td />');
++			  type.text(b[2]);
++			  line.append(number);
++			  line.append(domain);
++			  line.append(type);
++			  table.append(line);
++                      });
++		      var line = $('<tr />');
++		      var number = $('<td />');
++		      number.text(rest);
++		      var label = $('<td>Rest</td>');
++		      line.append(number);
++		      line.append(label);
++		      table.append(line);
++		      $("#queryring").html(table);
+ 		  });
+ 
+ 	filtered=$("#filter2").is(':checked')
+@@ -91,7 +105,7 @@
+ 
+ 	$.getJSON(qstring, 
+ 		  function(data) {
+-		      var bouw="<table><tr><th>Number</th><th>Servfail domain</th><th>Type</th></tr>";
++		      var table = $('<table><tr><th>Number</th><th>Servfail domain</th><th>Type</th></tr></table>');
+ 		      var num=0, total=0, rest=0;
+ 		      $.each(data["entries"], function(a,b) {
+ 			  total+=b[0];
+@@ -101,11 +115,26 @@
+ 			  }
+ 			  if(b[1].length > 25)
+ 			      b[1]=b[1].substring(0,25);
+-			  bouw=bouw+("<tr><td>"+b[0]+"</td><td>"+b[1]+"</td><td>"+b[2]+"</td></tr>");
++			  var line = $('<tr />');
++			  var number = $('<td />');
++			  number.text(b[0]);
++			  var domain = $('<td />');
++			  domain.text(b[1]);
++			  var type = $('<td />');
++			  type.text(b[2]);
++			  line.append(number);
++			  line.append(domain);
++			  line.append(type);
++			  table.append(line);
+ 		      });
+-		      bouw+="<tr><td>"+rest+"</td><td>Rest</td></tr>";
+-		      bouw=bouw+"</table>";
+-		      $("#servfailqueryring").html(bouw);
++		      var line = $('<tr />');
++		      var number = $('<td />');
++		      number.text(rest);
++		      var label = $('<td>Rest</td>');
++		      line.append(number);
++		      line.append(label);
++		      table.append(line);
++		      $("#servfailqueryring").html(table);
+ 
+ 		  });
+ 
diff --git a/net-dns/pdns-recursor/files/CVE-2017-15093-4.0.6.patch b/net-dns/pdns-recursor/files/CVE-2017-15093-4.0.6.patch
new file mode 100644
index 000000000000..2695830b4420
--- /dev/null
+++ b/net-dns/pdns-recursor/files/CVE-2017-15093-4.0.6.patch
@@ -0,0 +1,47 @@
+diff -ru pdns-recursor-4.0.6.orig/ws-recursor.cc pdns-recursor-4.0.6/ws-recursor.cc
+--- pdns-recursor-4.0.6.orig/ws-recursor.cc	2017-07-04 17:43:07.000000000 +0200
++++ pdns-recursor-4.0.6/ws-recursor.cc	2017-11-02 18:13:55.762458134 +0100
+@@ -76,10 +76,11 @@
+       throw ApiException("'value' must be an array");
+     }
+ 
++    NetmaskGroup nmg;
+     for (auto value : jlist.array_items()) {
+       try {
+-        Netmask(value.string_value());
+-      } catch (NetmaskException &e) {
++        nmg.addMask(value.string_value());
++      } catch (const NetmaskException &e) {
+         throw ApiException(e.reason);
+       }
+     }
+@@ -91,9 +92,7 @@
+ 
+     // Clear allow-from, and provide a "parent" value
+     ss << "allow-from=" << endl;
+-    for (auto value : jlist.array_items()) {
+-      ss << "allow-from+=" << value.string_value() << endl;
+-    }
++    ss << "allow-from+=" << nmg.toString() << endl;
+ 
+     apiWriteConfigFile("allow-from", ss.str());
+ 
+@@ -201,10 +200,15 @@
+       if (server == "") {
+         throw ApiException("Forwarded-to server must not be an empty string");
+       }
+-      if (!serverlist.empty()) {
+-        serverlist += ";";
++      try {
++        ComboAddress ca = parseIPAndPort(server, 53);
++        if (!serverlist.empty()) {
++          serverlist += ";";
++        }
++        serverlist += ca.toStringWithPort();
++      } catch (const PDNSException &e) {
++        throw ApiException(e.reason);
+       }
+-      serverlist += server;
+     }
+     if (serverlist == "")
+       throw ApiException("Need at least one upstream server when forwarding");
diff --git a/net-dns/pdns-recursor/files/CVE-2017-15094-4.0.6.patch b/net-dns/pdns-recursor/files/CVE-2017-15094-4.0.6.patch
new file mode 100644
index 000000000000..ee7cf6878d98
--- /dev/null
+++ b/net-dns/pdns-recursor/files/CVE-2017-15094-4.0.6.patch
@@ -0,0 +1,28 @@
+diff -ru pdns-recursor-4.0.6.orig/opensslsigners.cc pdns-recursor-4.0.6/opensslsigners.cc
+--- pdns-recursor-4.0.6.orig/opensslsigners.cc	2017-07-04 17:43:07.000000000 +0200
++++ pdns-recursor-4.0.6/opensslsigners.cc	2017-11-02 18:18:37.489408103 +0100
+@@ -474,7 +474,7 @@
+   if (iqmp == NULL) {
+     RSA_free(key);
+     BN_clear_free(dmq1);
+-    BN_clear_free(iqmp);
++    BN_clear_free(dmp1);
+     throw runtime_error(getName()+" allocation of BIGNUM iqmp failed");
+   }
+   RSA_set0_crt_params(key, dmp1, dmq1, iqmp);
+@@ -562,6 +562,7 @@
+   BIGNUM *n = BN_bin2bn((unsigned char*)modulus.c_str(), modulus.length(), NULL);
+   if (!n) {
+     RSA_free(key);
++    BN_clear_free(e);
+     throw runtime_error(getName()+" error loading n value of public key");
+   }
+ 
+@@ -866,6 +867,7 @@
+ 
+   int ret = EC_POINT_oct2point(d_ecgroup, pub_key, (unsigned char*) ecdsaPoint.c_str(), ecdsaPoint.length(), d_ctx);
+   if (ret != 1) {
++    EC_POINT_free(pub_key);
+     throw runtime_error(getName()+" reading ECP point from binary failed");
+   }
+