Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=9d6e300381558e9186fb70db1814f2275a4ed8b3
commit 9d6e300381558e9186fb70db1814f2275a4ed8b3 Author: kikadf <[email protected]> Date: Fri Dec 12 09:55:01 2014 +0100 pdns-recursor-3.3-9arcturus1-x86_64 * Fix CVE-2014-8601 diff --git a/source/network-extra/pdns-recursor/CVE-2014-8601.patch b/source/network-extra/pdns-recursor/CVE-2014-8601.patch new file mode 100644 index 0000000..a7efb37 --- /dev/null +++ b/source/network-extra/pdns-recursor/CVE-2014-8601.patch @@ -0,0 +1,56 @@ +commit 62d189c81359c70821523d7ba9831d0f6e57b012 +Author: Your Name <[email protected]> +Date: Tue Dec 2 08:50:41 2014 +0000 + + backport query limiter to 3.3 + +diff --git a/pdns_recursor.cc b/pdns_recursor.cc +index 0f9b08f..3bb71e0 100644 +--- a/pdns_recursor.cc ++++ b/pdns_recursor.cc +@@ -522,7 +522,14 @@ void startDoResolve(void *p) + bool variableAnswer = false; + // if there is a PowerDNSLua active, and it 'took' the query in preResolve, we don't launch beginResolve + if(!t_pdl->get() || !(*t_pdl)->preresolve(dc->d_remote, g_listenSocketsAddresses[dc->d_socket], dc->d_mdp.d_qname, QType(dc->d_mdp.d_qtype), ret, res, &variableAnswer)) { +- res = sr.beginResolve(dc->d_mdp.d_qname, QType(dc->d_mdp.d_qtype), dc->d_mdp.d_qclass, ret); ++ try { ++ res = sr.beginResolve(dc->d_mdp.d_qname, QType(dc->d_mdp.d_qtype), dc->d_mdp.d_qclass, ret); ++ } ++ catch(ImmediateServFailException &e) { ++ L<<Logger::Error<<"Sending SERVFAIL during resolve of '"<<dc->d_mdp.d_qname<<"' because: "<<e.reason<<endl; ++ ++ res = RCode::ServFail; ++ } + + if(t_pdl->get()) { + if(res == RCode::NXDomain) +diff --git a/syncres.cc b/syncres.cc +index 4b05acf..08b2930 100644 +--- a/syncres.cc ++++ b/syncres.cc +@@ -874,6 +874,7 @@ int SyncRes::doResolveAt(set<string, CIStringCompare> nameservers, string auth, + } + else { + s_outqueries++; d_outqueries++; ++ if(d_outqueries > 50) throw ImmediateServFailException("more than 50 queries sent while resolving "+qname); + TryTCP: + if(doTCP) { + LOG<<prefix<<qname<<": using TCP with "<< remoteIP->toStringWithPort() <<endl; +diff --git a/syncres.hh b/syncres.hh +index e3249d2..6c151e0 100644 +--- a/syncres.hh ++++ b/syncres.hh +@@ -502,6 +502,13 @@ private: + static AtomicCounter s_currentConnections; //!< total number of current TCP connections + }; + ++class ImmediateServFailException ++{ ++public: ++ ImmediateServFailException(string r){reason=r;}; ++ ++ string reason; //! Print this to tell the user what went wrong ++}; + + struct RemoteKeeper + { diff --git a/source/network-extra/pdns-recursor/FrugalBuild b/source/network-extra/pdns-recursor/FrugalBuild index 3a84a91..aca5f68 100644 --- a/source/network-extra/pdns-recursor/FrugalBuild +++ b/source/network-extra/pdns-recursor/FrugalBuild @@ -5,7 +5,7 @@ pkgname=pdns-recursor pkgver=3.3 -pkgrel=8 +pkgrel=9arcturus1 pkgdesc="Power DNS recursor" url="http://www.powerdns.com/"; depends=('libstdc++') @@ -20,6 +20,12 @@ signatures=("${source[0]}.sig" '' '') _F_systemd_units=(pdns-recursor=) Finclude systemd +# FSA fix *** +source=(${source[@]} CVE-2014-8601.patch) +signatures=(${signatures[@]} '') +# *********** + + build() { Fcd $pkgname-$pkgver _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
