1 |
idl0r 11/11/17 17:20:35 |
2 |
|
3 |
Modified: ChangeLog |
4 |
Added: bind-9.7.4_p1.ebuild bind-9.8.1_p1.ebuild |
5 |
Log: |
6 |
Version bump, fixes a serious security issue, CVE-2011-4313 / bug 390753. |
7 |
|
8 |
(Portage version: 2.2.0_alpha75/cvs/Linux x86_64) |
9 |
|
10 |
Revision Changes Path |
11 |
1.356 net-dns/bind/ChangeLog |
12 |
|
13 |
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-dns/bind/ChangeLog?rev=1.356&view=markup |
14 |
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-dns/bind/ChangeLog?rev=1.356&content-type=text/plain |
15 |
diff : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-dns/bind/ChangeLog?r1=1.355&r2=1.356 |
16 |
|
17 |
Index: ChangeLog |
18 |
=================================================================== |
19 |
RCS file: /var/cvsroot/gentoo-x86/net-dns/bind/ChangeLog,v |
20 |
retrieving revision 1.355 |
21 |
retrieving revision 1.356 |
22 |
diff -u -r1.355 -r1.356 |
23 |
--- ChangeLog 25 Sep 2011 18:26:13 -0000 1.355 |
24 |
+++ ChangeLog 17 Nov 2011 17:20:34 -0000 1.356 |
25 |
@@ -1,6 +1,13 @@ |
26 |
# ChangeLog for net-dns/bind |
27 |
# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 |
28 |
-# $Header: /var/cvsroot/gentoo-x86/net-dns/bind/ChangeLog,v 1.355 2011/09/25 18:26:13 idl0r Exp $ |
29 |
+# $Header: /var/cvsroot/gentoo-x86/net-dns/bind/ChangeLog,v 1.356 2011/11/17 17:20:34 idl0r Exp $ |
30 |
+ |
31 |
+*bind-9.8.1_p1 (17 Nov 2011) |
32 |
+*bind-9.7.4_p1 (17 Nov 2011) |
33 |
+ |
34 |
+ 17 Nov 2011; Christian Ruppert <idl0r@g.o> +bind-9.7.4_p1.ebuild, |
35 |
+ +bind-9.8.1_p1.ebuild: |
36 |
+ Version bump, fixes a serious security issue, CVE-2011-4313 / bug 390753. |
37 |
|
38 |
25 Sep 2011; Christian Ruppert <idl0r@g.o> bind-9.8.1.ebuild: |
39 |
Remove obsolete warning. |
40 |
|
41 |
|
42 |
|
43 |
1.1 net-dns/bind/bind-9.7.4_p1.ebuild |
44 |
|
45 |
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-dns/bind/bind-9.7.4_p1.ebuild?rev=1.1&view=markup |
46 |
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-dns/bind/bind-9.7.4_p1.ebuild?rev=1.1&content-type=text/plain |
47 |
|
48 |
Index: bind-9.7.4_p1.ebuild |
49 |
=================================================================== |
50 |
# Copyright 1999-2011 Gentoo Foundation |
51 |
# Distributed under the terms of the GNU General Public License v2 |
52 |
# $Header: /var/cvsroot/gentoo-x86/net-dns/bind/bind-9.7.4_p1.ebuild,v 1.1 2011/11/17 17:20:34 idl0r Exp $ |
53 |
|
54 |
EAPI="3" |
55 |
|
56 |
inherit eutils autotools toolchain-funcs flag-o-matic |
57 |
|
58 |
MY_PV="${PV/_p/-P}" |
59 |
MY_P="${PN}-${MY_PV}" |
60 |
|
61 |
SDB_LDAP_VER="1.1.0-fc14" |
62 |
|
63 |
GEOIP_PV=1.3 |
64 |
#GEOIP_PV_AGAINST="${MY_PV}" |
65 |
GEOIP_PV_AGAINST="9.7.2-P2" |
66 |
GEOIP_P="bind-geoip-${GEOIP_PV}" |
67 |
GEOIP_PATCH_A="${GEOIP_P}-${GEOIP_PV_AGAINST}.patch" |
68 |
GEOIP_DOC_A="${GEOIP_P}-readme.txt" |
69 |
GEOIP_SRC_URI_BASE="http://bind-geoip.googlecode.com/" |
70 |
|
71 |
DESCRIPTION="BIND - Berkeley Internet Name Domain - Name Server" |
72 |
HOMEPAGE="http://www.isc.org/software/bind" |
73 |
SRC_URI="ftp://ftp.isc.org/isc/bind9/${MY_PV}/${MY_P}.tar.gz |
74 |
doc? ( mirror://gentoo/dyndns-samples.tbz2 ) |
75 |
geoip? ( ${GEOIP_SRC_URI_BASE}/files/${GEOIP_DOC_A} |
76 |
${GEOIP_SRC_URI_BASE}/files/${GEOIP_PATCH_A} ) |
77 |
sdb-ldap? ( http://ftp.disconnected-by-peer.at/pub/bind-sdb-ldap-${SDB_LDAP_VER}.patch.bz2 )" |
78 |
|
79 |
LICENSE="as-is" |
80 |
SLOT="0" |
81 |
KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86" |
82 |
IUSE="ssl ipv6 doc dlz postgres berkdb mysql odbc ldap selinux idn threads |
83 |
resolvconf urandom xml geoip gssapi sdb-ldap" |
84 |
|
85 |
DEPEND="ssl? ( >=dev-libs/openssl-0.9.6g ) |
86 |
mysql? ( >=virtual/mysql-4.0 ) |
87 |
odbc? ( >=dev-db/unixODBC-2.2.6 ) |
88 |
ldap? ( net-nds/openldap ) |
89 |
idn? ( net-dns/idnkit ) |
90 |
postgres? ( dev-db/postgresql-base ) |
91 |
threads? ( >=sys-libs/libcap-2.1.0 ) |
92 |
xml? ( dev-libs/libxml2 ) |
93 |
geoip? ( >=dev-libs/geoip-1.4.6 ) |
94 |
gssapi? ( virtual/krb5 ) |
95 |
sdb-ldap? ( net-nds/openldap )" |
96 |
|
97 |
RDEPEND="${DEPEND} |
98 |
selinux? ( sec-policy/selinux-bind ) |
99 |
resolvconf? ( net-dns/openresolv ) |
100 |
sys-process/psmisc" |
101 |
|
102 |
S="${WORKDIR}/${MY_P}" |
103 |
|
104 |
pkg_setup() { |
105 |
use threads && { |
106 |
ewarn |
107 |
ewarn "If you're in vserver enviroment, you're probably want to" |
108 |
ewarn "disable threads support because of linux capabilities dependency" |
109 |
ewarn |
110 |
} |
111 |
|
112 |
ebegin "Creating named group and user" |
113 |
enewgroup named 40 |
114 |
enewuser named 40 -1 /etc/bind named |
115 |
eend ${?} |
116 |
} |
117 |
|
118 |
src_prepare() { |
119 |
# Adjusting PATHs in manpages |
120 |
for i in bin/{named/named.8,check/named-checkconf.8,rndc/rndc.8} ; do |
121 |
sed -i \ |
122 |
-e 's:/etc/named.conf:/etc/bind/named.conf:g' \ |
123 |
-e 's:/etc/rndc.conf:/etc/bind/rndc.conf:g' \ |
124 |
-e 's:/etc/rndc.key:/etc/bind/rndc.key:g' \ |
125 |
"${i}" || die "sed failed, ${i} doesn't exist" |
126 |
done |
127 |
|
128 |
if use dlz; then |
129 |
# bind fails to reconnect to MySQL5 databases, bug #180720, patch by Nicolas Brousse |
130 |
# (http://www.shell-tips.com/2007/09/04/bind-950-patch-dlz-mysql-5-for-auto-reconnect/) |
131 |
if use mysql && has_version ">=dev-db/mysql-5"; then |
132 |
epatch "${FILESDIR}"/bind-dlzmysql5-reconnect.patch |
133 |
fi |
134 |
|
135 |
if use odbc; then |
136 |
epatch "${FILESDIR}/bind-9.7.3-odbc-dlz-detect.patch" |
137 |
fi |
138 |
fi |
139 |
|
140 |
# should be installed by bind-tools |
141 |
sed -i -r -e "s:(nsupdate|dig) ::g" bin/Makefile.in || die |
142 |
|
143 |
# sdb-ldap patch as per bug #160567 |
144 |
# Upstream URL: http://bind9-ldap.bayour.com/ |
145 |
# New patch take from bug 302735 |
146 |
if use sdb-ldap; then |
147 |
epatch "${WORKDIR}"/${PN}-sdb-ldap-${SDB_LDAP_VER}.patch |
148 |
cp -fp contrib/sdb/ldap/ldapdb.[ch] bin/named |
149 |
cp -fp contrib/sdb/ldap/{ldap2zone.1,ldap2zone.c} bin/tools |
150 |
cp -fp contrib/sdb/ldap/{zone2ldap.1,zone2ldap.c} bin/tools |
151 |
fi |
152 |
|
153 |
if use geoip; then |
154 |
cp "${DISTDIR}"/${GEOIP_PATCH_A} "${S}" || die |
155 |
sed -i -e 's:RELEASEVER=2:RELEASEVER=1:' \ |
156 |
${GEOIP_PATCH_A} || die |
157 |
epatch ${GEOIP_PATCH_A} |
158 |
fi |
159 |
|
160 |
# bug #220361 |
161 |
rm {aclocal,libtool}.m4 |
162 |
WANT_AUTOCONF=2.5 AT_NO_RECURSIVE=1 eautoreconf |
163 |
|
164 |
# remove useless c++ checks |
165 |
epunt_cxx |
166 |
} |
167 |
|
168 |
src_configure() { |
169 |
local myconf="" |
170 |
|
171 |
use dlz && { |
172 |
myconf="${myconf} --with-dlz-filesystem --with-dlz-stub" |
173 |
use postgres && myconf="${myconf} --with-dlz-postgres" |
174 |
use mysql && myconf="${myconf} --with-dlz-mysql" |
175 |
use berkdb && myconf="${myconf} --with-dlz-bdb" |
176 |
use ldap && myconf="${myconf} --with-dlz-ldap" |
177 |
use odbc && myconf="${myconf} --with-dlz-odbc" |
178 |
} |
179 |
|
180 |
if use threads; then |
181 |
if use dlz && use mysql; then |
182 |
ewarn |
183 |
ewarn "MySQL uses thread local storage in its C api. Thus MySQL" |
184 |
ewarn "requires that each thread of an application execute a MySQL" |
185 |
ewarn "\"thread initialization\" to setup the thread local storage." |
186 |
ewarn "This is impossible to do safely while staying within the DLZ" |
187 |
ewarn "driver API. This is a limitation caused by MySQL, and not" |
188 |
ewarn "the DLZ API." |
189 |
ewarn "Because of this BIND MUST only run with a single thread when" |
190 |
ewarn "using the MySQL driver." |
191 |
ewarn |
192 |
myconf="${myconf} --disable-linux-caps --disable-threads" |
193 |
ewarn "Threading support disabled" |
194 |
else |
195 |
myconf="${myconf} --enable-linux-caps --enable-threads" |
196 |
einfo "Threading support enabled" |
197 |
fi |
198 |
else |
199 |
myconf="${myconf} --disable-linux-caps --disable-threads" |
200 |
fi |
201 |
|
202 |
if use urandom; then |
203 |
myconf="${myconf} --with-randomdev=/dev/urandom" |
204 |
else |
205 |
myconf="${myconf} --with-randomdev=/dev/random" |
206 |
fi |
207 |
|
208 |
use geoip && myconf="${myconf} --with-geoip" |
209 |
|
210 |
# bug #158664 |
211 |
gcc-specs-ssp && replace-flags -O[23s] -O |
212 |
|
213 |
export BUILD_CC=$(tc-getBUILD_CC) |
214 |
econf \ |
215 |
--sysconfdir=/etc/bind \ |
216 |
--localstatedir=/var \ |
217 |
--with-libtool \ |
218 |
$(use_with ssl openssl) \ |
219 |
$(use_with idn) \ |
220 |
$(use_enable ipv6) \ |
221 |
$(use_with xml libxml2) \ |
222 |
$(use_with gssapi) \ |
223 |
${myconf} |
224 |
|
225 |
# bug #151839 |
226 |
echo '#undef SO_BSDCOMPAT' >> config.h |
227 |
} |
228 |
|
229 |
src_install() { |
230 |
emake DESTDIR="${D}" install || die |
231 |
|
232 |
dodoc CHANGES FAQ README |
233 |
|
234 |
if use idn; then |
235 |
dodoc contrib/idn/README.idnkit || die |
236 |
fi |
237 |
|
238 |
if use doc; then |
239 |
dodoc doc/arm/Bv9ARM.pdf || die |
240 |
|
241 |
docinto misc |
242 |
dodoc doc/misc/* || die |
243 |
|
244 |
# might a 'html' useflag make sense? |
245 |
docinto html |
246 |
dohtml -r doc/arm/* || die |
247 |
|
248 |
docinto draft |
249 |
dodoc doc/draft/* || die |
250 |
|
251 |
docinto rfc |
252 |
dodoc doc/rfc/* || die |
253 |
|
254 |
docinto contrib |
255 |
dodoc contrib/named-bootconf/named-bootconf.sh \ |
256 |
contrib/nanny/nanny.pl || die |
257 |
|
258 |
# some handy-dandy dynamic dns examples |
259 |
cd "${D}"/usr/share/doc/${PF} |
260 |
tar xf "${DISTDIR}"/dyndns-samples.tbz2 || die |
261 |
fi |
262 |
|
263 |
use geoip && dodoc "${DISTDIR}"/${GEOIP_DOC_A} |
264 |
|
265 |
insinto /etc/bind |
266 |
newins "${FILESDIR}"/named.conf-r5 named.conf || die |
267 |
|
268 |
# ftp://ftp.rs.internic.net/domain/named.cache: |
269 |
insinto /var/bind |
270 |
doins "${FILESDIR}"/named.cache || die |
271 |
|
272 |
insinto /var/bind/pri |
273 |
newins "${FILESDIR}"/127.zone-r1 127.zone || die |
274 |
newins "${FILESDIR}"/localhost.zone-r3 localhost.zone || die |
275 |
|
276 |
newinitd "${FILESDIR}"/named.init-r11 named || die |
277 |
newconfd "${FILESDIR}"/named.confd-r6 named || die |
278 |
|
279 |
newenvd "${FILESDIR}"/10bind.env 10bind || die |
280 |
|
281 |
# Let's get rid of those tools and their manpages since they're provided by bind-tools |
282 |
rm -f "${D}"/usr/share/man/man1/{dig,host,nslookup}.1* |
283 |
rm -f "${D}"/usr/share/man/man8/{dnssec-keygen,nsupdate}.8* |
284 |
rm -f "${D}"/usr/bin/{dig,host,nslookup,dnssec-keygen,nsupdate} |
285 |
rm -f "${D}"/usr/sbin/{dig,host,nslookup,dnssec-keygen,nsupdate} |
286 |
|
287 |
dosym /var/bind/named.cache /var/bind/root.cache || die |
288 |
dosym /var/bind/pri /etc/bind/pri || die |
289 |
dosym /var/bind/sec /etc/bind/sec || die |
290 |
dosym /var/bind/dyn /etc/bind/dyn || die |
291 |
keepdir /var/bind/{pri,sec,dyn} |
292 |
|
293 |
dodir /var/{run,log}/named || die |
294 |
|
295 |
fowners root:named /{etc,var}/bind /var/{run,log}/named /var/bind/{sec,pri,dyn} |
296 |
fowners root:named /var/bind/named.cache /var/bind/pri/{127,localhost}.zone /etc/bind/{bind.keys,named.conf} |
297 |
fperms 0640 /var/bind/named.cache /var/bind/pri/{127,localhost}.zone /etc/bind/{bind.keys,named.conf} |
298 |
fperms 0750 /etc/bind /var/bind/pri |
299 |
fperms 0770 /var/{run,log}/named /var/bind/{,sec,dyn} |
300 |
} |
301 |
|
302 |
pkg_postinst() { |
303 |
if [ ! -f '/etc/bind/rndc.key' ]; then |
304 |
if use urandom; then |
305 |
einfo "Using /dev/urandom for generating rndc.key" |
306 |
/usr/sbin/rndc-confgen -r /dev/urandom -a |
307 |
echo |
308 |
else |
309 |
einfo "Using /dev/random for generating rndc.key" |
310 |
/usr/sbin/rndc-confgen -a |
311 |
echo |
312 |
fi |
313 |
chown root:named /etc/bind/rndc.key |
314 |
chmod 0640 /etc/bind/rndc.key |
315 |
fi |
316 |
|
317 |
einfo |
318 |
einfo "You can edit /etc/conf.d/named to customize named settings" |
319 |
einfo |
320 |
use mysql || use postgres || use ldap && { |
321 |
elog "If your named depends on MySQL/PostgreSQL or LDAP," |
322 |
elog "uncomment the specified rc_named_* lines in your" |
323 |
elog "/etc/conf.d/named config to ensure they'll start before bind" |
324 |
einfo |
325 |
} |
326 |
einfo "If you'd like to run bind in a chroot AND this is a new" |
327 |
einfo "install OR your bind doesn't already run in a chroot:" |
328 |
einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named." |
329 |
einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`" |
330 |
einfo |
331 |
|
332 |
CHROOT=$(source /etc/conf.d/named 2>/dev/null; echo ${CHROOT}) |
333 |
if [[ -n ${CHROOT} ]]; then |
334 |
elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!" |
335 |
elog "To enable the old behaviour (without using mount) uncomment the" |
336 |
elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config." |
337 |
elog "If you decide to use the new/default method, ensure to make backup" |
338 |
elog "first and merge your existing configs/zones to /etc/bind and" |
339 |
elog "/var/bind because bind will now mount the needed directories into" |
340 |
elog "the chroot dir." |
341 |
fi |
342 |
|
343 |
ewarn |
344 |
ewarn "NOTE: /var/bind/named.ca has been renamed to /var/bind/named.cache" |
345 |
ewarn "you may need to fix your named.conf!" |
346 |
ewarn |
347 |
ewarn "NOTE: If you upgrade from <net-dns/bind-9.4.3_p5-r1, you may encounter permission problems" |
348 |
ewarn "To fix the permissions do:" |
349 |
ewarn "chown root:named /{etc,var}/bind /var/{run,log}/named /var/bind/{sec,pri,dyn}" |
350 |
ewarn "chown root:named /var/bind/named.cache /var/bind/pri/{127,localhost}.zone /etc/bind/{bind.keys,named.conf}" |
351 |
ewarn "chmod 0640 /var/bind/named.cache /var/bind/pri/{127,localhost}.zone /etc/bind/{bind.keys,named.conf}" |
352 |
ewarn "chmod 0750 /etc/bind /var/bind/pri" |
353 |
ewarn "chmod 0770 /var/{run,log}/named /var/bind/{,sec,dyn}" |
354 |
ewarn |
355 |
} |
356 |
|
357 |
pkg_config() { |
358 |
CHROOT=$(source /etc/conf.d/named; echo ${CHROOT}) |
359 |
CHROOT_NOMOUNT=$(source /etc/conf.d/named; echo ${CHROOT_NOMOUNT}) |
360 |
CHROOT_GEOIP=$(source /etc/conf.d/named; echo ${CHROOT_GEOIP}) |
361 |
|
362 |
if [[ -z "${CHROOT}" ]]; then |
363 |
eerror "This config script is designed to automate setting up" |
364 |
eerror "a chrooted bind/named. To do so, please first uncomment" |
365 |
eerror "and set the CHROOT variable in '/etc/conf.d/named'." |
366 |
die "Unset CHROOT" |
367 |
fi |
368 |
if [[ -d "${CHROOT}" ]]; then |
369 |
ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!" |
370 |
ewarn "To enable the old behaviour (without using mount) uncomment the" |
371 |
ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config." |
372 |
ewarn |
373 |
ewarn "${CHROOT} already exists... some things might become overridden" |
374 |
ewarn "press CTRL+C if you don't want to continue" |
375 |
sleep 10 |
376 |
fi |
377 |
|
378 |
echo; einfo "Setting up the chroot directory..." |
379 |
|
380 |
mkdir -m 0750 -p ${CHROOT} |
381 |
mkdir -m 0755 -p ${CHROOT}/{dev,etc,var/{run,log}} |
382 |
mkdir -m 0750 -p ${CHROOT}/etc/bind |
383 |
mkdir -m 0770 -p ${CHROOT}/var/{bind,{run,log}/named} |
384 |
chown root:named ${CHROOT} ${CHROOT}/var/{bind,{run,log}/named} ${CHROOT}/etc/bind |
385 |
|
386 |
mknod ${CHROOT}/dev/null c 1 3 |
387 |
chmod 0666 ${CHROOT}/dev/null |
388 |
|
389 |
mknod ${CHROOT}/dev/zero c 1 5 |
390 |
chmod 0666 ${CHROOT}/dev/zero |
391 |
|
392 |
if use urandom; then |
393 |
mknod ${CHROOT}/dev/urandom c 1 9 |
394 |
chmod 0666 ${CHROOT}/dev/urandom |
395 |
else |
396 |
mknod ${CHROOT}/dev/random c 1 8 |
397 |
chmod 0666 ${CHROOT}/dev/random |
398 |
fi |
399 |
|
400 |
if [ "${CHROOT_NOMOUNT:-0}" -ne 0 ]; then |
401 |
cp -a /etc/bind ${CHROOT}/etc/ |
402 |
cp -a /var/bind ${CHROOT}/var/ |
403 |
fi |
404 |
|
405 |
if [ "${CHROOT_GEOIP:-0}" -eq 1 ]; then |
406 |
mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP |
407 |
fi |
408 |
|
409 |
elog "You may need to add the following line to your syslog-ng.conf:" |
410 |
elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };" |
411 |
} |
412 |
|
413 |
|
414 |
|
415 |
1.1 net-dns/bind/bind-9.8.1_p1.ebuild |
416 |
|
417 |
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-dns/bind/bind-9.8.1_p1.ebuild?rev=1.1&view=markup |
418 |
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-dns/bind/bind-9.8.1_p1.ebuild?rev=1.1&content-type=text/plain |
419 |
|
420 |
Index: bind-9.8.1_p1.ebuild |
421 |
=================================================================== |
422 |
# Copyright 1999-2011 Gentoo Foundation |
423 |
# Distributed under the terms of the GNU General Public License v2 |
424 |
# $Header: /var/cvsroot/gentoo-x86/net-dns/bind/bind-9.8.1_p1.ebuild,v 1.1 2011/11/17 17:20:34 idl0r Exp $ |
425 |
|
426 |
# Re dlz/mysql and threads, needs to be verified.. |
427 |
# MySQL uses thread local storage in its C api. Thus MySQL |
428 |
# requires that each thread of an application execute a MySQL |
429 |
# thread initialization to setup the thread local storage. |
430 |
# This is impossible to do safely while staying within the DLZ |
431 |
# driver API. This is a limitation caused by MySQL, and not the DLZ API. |
432 |
# Because of this BIND MUST only run with a single thread when |
433 |
# using the MySQL driver. |
434 |
|
435 |
EAPI="4" |
436 |
|
437 |
inherit eutils autotools toolchain-funcs flag-o-matic multilib |
438 |
|
439 |
MY_PV="${PV/_p/-P}" |
440 |
MY_PV="${MY_PV/_rc/rc}" |
441 |
MY_P="${PN}-${MY_PV}" |
442 |
|
443 |
SDB_LDAP_VER="1.1.0-fc14" |
444 |
|
445 |
# bind-9.8.0-P1-geoip-1.3.patch |
446 |
GEOIP_PV=1.3 |
447 |
#GEOIP_PV_AGAINST="${MY_PV}" |
448 |
GEOIP_PV_AGAINST="9.8.0-P1" |
449 |
GEOIP_P="bind-${GEOIP_PV_AGAINST}-geoip-${GEOIP_PV}" |
450 |
GEOIP_PATCH_A="${GEOIP_P}.patch" |
451 |
GEOIP_DOC_A="bind-geoip-1.3-readme.txt" |
452 |
GEOIP_SRC_URI_BASE="http://bind-geoip.googlecode.com/" |
453 |
|
454 |
DESCRIPTION="BIND - Berkeley Internet Name Domain - Name Server" |
455 |
HOMEPAGE="http://www.isc.org/software/bind" |
456 |
SRC_URI="ftp://ftp.isc.org/isc/bind9/${MY_PV}/${MY_P}.tar.gz |
457 |
doc? ( mirror://gentoo/dyndns-samples.tbz2 ) |
458 |
geoip? ( ${GEOIP_SRC_URI_BASE}/files/${GEOIP_DOC_A} |
459 |
${GEOIP_SRC_URI_BASE}/files/${GEOIP_PATCH_A} ) |
460 |
sdb-ldap? ( http://ftp.disconnected-by-peer.at/pub/bind-sdb-ldap-${SDB_LDAP_VER}.patch.bz2 )" |
461 |
|
462 |
LICENSE="as-is" |
463 |
SLOT="0" |
464 |
KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86" |
465 |
IUSE="berkdb caps dlz doc geoip gost gssapi idn ipv6 ldap mysql odbc pkcs11 postgres rpz sdb-ldap |
466 |
selinux ssl threads urandom xml" |
467 |
|
468 |
REQUIRED_USE="postgres? ( dlz ) |
469 |
berkdb? ( dlz ) |
470 |
mysql? ( dlz !threads ) |
471 |
odbc? ( dlz ) |
472 |
ldap? ( dlz ) |
473 |
sdb-ldap? ( dlz ) |
474 |
gost? ( ssl )" |
475 |
|
476 |
DEPEND="ssl? ( >=dev-libs/openssl-0.9.6g ) |
477 |
mysql? ( >=virtual/mysql-4.0 ) |
478 |
odbc? ( >=dev-db/unixODBC-2.2.6 ) |
479 |
ldap? ( net-nds/openldap ) |
480 |
idn? ( net-dns/idnkit ) |
481 |
postgres? ( dev-db/postgresql-base ) |
482 |
caps? ( >=sys-libs/libcap-2.1.0 ) |
483 |
xml? ( dev-libs/libxml2 ) |
484 |
geoip? ( >=dev-libs/geoip-1.4.6 ) |
485 |
gssapi? ( virtual/krb5 ) |
486 |
sdb-ldap? ( net-nds/openldap ) |
487 |
gost? ( >=dev-libs/openssl-1.0.0 )" |
488 |
|
489 |
RDEPEND="${DEPEND} |
490 |
selinux? ( sec-policy/selinux-bind ) |
491 |
sys-process/psmisc" |
492 |
|
493 |
S="${WORKDIR}/${MY_P}" |
494 |
|
495 |
pkg_setup() { |
496 |
ebegin "Creating named group and user" |
497 |
enewgroup named 40 |
498 |
enewuser named 40 -1 /etc/bind named |
499 |
eend ${?} |
500 |
} |
501 |
|
502 |
src_prepare() { |
503 |
# Adjusting PATHs in manpages |
504 |
for i in bin/{named/named.8,check/named-checkconf.8,rndc/rndc.8} ; do |
505 |
sed -i \ |
506 |
-e 's:/etc/named.conf:/etc/bind/named.conf:g' \ |
507 |
-e 's:/etc/rndc.conf:/etc/bind/rndc.conf:g' \ |
508 |
-e 's:/etc/rndc.key:/etc/bind/rndc.key:g' \ |
509 |
"${i}" || die "sed failed, ${i} doesn't exist" |
510 |
done |
511 |
|
512 |
if use dlz; then |
513 |
# bug 382269 |
514 |
epatch "${FILESDIR}/${P}-sdlz_helper.patch" |
515 |
|
516 |
# bind fails to reconnect to MySQL5 databases, bug #180720, patch by Nicolas Brousse |
517 |
# (http://www.shell-tips.com/2007/09/04/bind-950-patch-dlz-mysql-5-for-auto-reconnect/) |
518 |
if use mysql && has_version ">=dev-db/mysql-5"; then |
519 |
epatch "${FILESDIR}"/bind-dlzmysql5-reconnect.patch |
520 |
fi |
521 |
|
522 |
if use odbc; then |
523 |
epatch "${FILESDIR}/${PN}-9.7.3-odbc-dlz-detect.patch" |
524 |
fi |
525 |
|
526 |
# sdb-ldap patch as per bug #160567 |
527 |
# Upstream URL: http://bind9-ldap.bayour.com/ |
528 |
# New patch take from bug 302735 |
529 |
if use sdb-ldap; then |
530 |
epatch "${WORKDIR}"/${PN}-sdb-ldap-${SDB_LDAP_VER}.patch |
531 |
cp -fp contrib/sdb/ldap/ldapdb.[ch] bin/named/ |
532 |
cp -fp contrib/sdb/ldap/{ldap2zone.1,ldap2zone.c} bin/tools/ |
533 |
cp -fp contrib/sdb/ldap/{zone2ldap.1,zone2ldap.c} bin/tools/ |
534 |
fi |
535 |
fi |
536 |
|
537 |
# should be installed by bind-tools |
538 |
sed -i -r -e "s:(nsupdate|dig) ::g" bin/Makefile.in || die |
539 |
|
540 |
if use geoip; then |
541 |
cp "${DISTDIR}"/${GEOIP_PATCH_A} "${S}" || die |
542 |
epatch ${GEOIP_PATCH_A} |
543 |
fi |
544 |
|
545 |
# bug #220361 |
546 |
rm {aclocal,libtool}.m4 |
547 |
eautoreconf |
548 |
} |
549 |
|
550 |
src_configure() { |
551 |
local myconf="" |
552 |
|
553 |
if use urandom; then |
554 |
myconf="${myconf} --with-randomdev=/dev/urandom" |
555 |
else |
556 |
myconf="${myconf} --with-randomdev=/dev/random" |
557 |
fi |
558 |
|
559 |
use geoip && myconf="${myconf} --with-geoip" |
560 |
|
561 |
# bug #158664 |
562 |
# gcc-specs-ssp && replace-flags -O[23s] -O |
563 |
|
564 |
export BUILD_CC=$(tc-getBUILD_CC) |
565 |
econf \ |
566 |
--sysconfdir=/etc/bind \ |
567 |
--localstatedir=/var \ |
568 |
--with-libtool \ |
569 |
$(use_enable threads) \ |
570 |
$(use_with dlz dlopen) \ |
571 |
$(use_with dlz dlz-filesystem) \ |
572 |
$(use_with dlz dlz-stub) \ |
573 |
$(use_with postgres dlz-postgres) \ |
574 |
$(use_with mysql dlz-mysql) \ |
575 |
$(use_with berkdb dlz-bdb) \ |
576 |
$(use_with ldap dlz-ldap) \ |
577 |
$(use_with odbc dlz-odbc) \ |
578 |
$(use_with ssl openssl) \ |
579 |
$(use_with idn) \ |
580 |
$(use_enable ipv6) \ |
581 |
$(use_with xml libxml2) \ |
582 |
$(use_with gssapi) \ |
583 |
$(use_enable rpz rpz-nsip) \ |
584 |
$(use_enable rpz rpz-nsdname) \ |
585 |
$(use_with pkcs11) \ |
586 |
$(use_enable caps linux-caps) \ |
587 |
$(use_with gost) \ |
588 |
${myconf} |
589 |
|
590 |
# bug #151839 |
591 |
echo '#undef SO_BSDCOMPAT' >> config.h |
592 |
} |
593 |
|
594 |
src_install() { |
595 |
emake DESTDIR="${D}" install || die |
596 |
|
597 |
dodoc CHANGES FAQ README |
598 |
|
599 |
if use idn; then |
600 |
dodoc contrib/idn/README.idnkit || die |
601 |
fi |
602 |
|
603 |
if use doc; then |
604 |
dodoc doc/arm/Bv9ARM.pdf || die |
605 |
|
606 |
docinto misc |
607 |
dodoc doc/misc/* || die |
608 |
|
609 |
# might a 'html' useflag make sense? |
610 |
docinto html |
611 |
dohtml -r doc/arm/* || die |
612 |
|
613 |
docinto draft |
614 |
dodoc doc/draft/* || die |
615 |
|
616 |
docinto rfc |
617 |
dodoc doc/rfc/* || die |
618 |
|
619 |
docinto contrib |
620 |
dodoc contrib/named-bootconf/named-bootconf.sh \ |
621 |
contrib/nanny/nanny.pl || die |
622 |
|
623 |
# some handy-dandy dynamic dns examples |
624 |
cd "${D}"/usr/share/doc/${PF} |
625 |
tar xf "${DISTDIR}"/dyndns-samples.tbz2 || die |
626 |
fi |
627 |
|
628 |
use geoip && dodoc "${DISTDIR}"/${GEOIP_DOC_A} |
629 |
|
630 |
insinto /etc/bind |
631 |
newins "${FILESDIR}"/named.conf-r5 named.conf || die |
632 |
|
633 |
# ftp://ftp.rs.internic.net/domain/named.cache: |
634 |
insinto /var/bind |
635 |
doins "${FILESDIR}"/named.cache || die |
636 |
|
637 |
insinto /var/bind/pri |
638 |
newins "${FILESDIR}"/127.zone-r1 127.zone || die |
639 |
newins "${FILESDIR}"/localhost.zone-r3 localhost.zone || die |
640 |
|
641 |
newinitd "${FILESDIR}"/named.init-r11 named || die |
642 |
newconfd "${FILESDIR}"/named.confd-r6 named || die |
643 |
|
644 |
if use gost; then |
645 |
sed -i -e 's/^OPENSSL_LIBGOST=${OPENSSL_LIBGOST:-0}$/OPENSSL_LIBGOST=${OPENSSL_LIBGOST:-1}/' "${D}/etc/init.d/named" || die |
646 |
else |
647 |
sed -i -e 's/^OPENSSL_LIBGOST=${OPENSSL_LIBGOST:-1}$/OPENSSL_LIBGOST=${OPENSSL_LIBGOST:-0}/' "${D}/etc/init.d/named" || die |
648 |
fi |
649 |
|
650 |
newenvd "${FILESDIR}"/10bind.env 10bind || die |
651 |
|
652 |
# Let's get rid of those tools and their manpages since they're provided by bind-tools |
653 |
rm -f "${D}"/usr/share/man/man1/{dig,host,nslookup}.1* |
654 |
rm -f "${D}"/usr/share/man/man8/{dnssec-keygen,nsupdate}.8* |
655 |
rm -f "${D}"/usr/bin/{dig,host,nslookup,dnssec-keygen,nsupdate} |
656 |
rm -f "${D}"/usr/sbin/{dig,host,nslookup,dnssec-keygen,nsupdate} |
657 |
|
658 |
dosym /var/bind/named.cache /var/bind/root.cache || die |
659 |
dosym /var/bind/pri /etc/bind/pri || die |
660 |
dosym /var/bind/sec /etc/bind/sec || die |
661 |
dosym /var/bind/dyn /etc/bind/dyn || die |
662 |
keepdir /var/bind/{pri,sec,dyn} |
663 |
|
664 |
dodir /var/{run,log}/named || die |
665 |
|
666 |
fowners root:named /{etc,var}/bind /var/{run,log}/named /var/bind/{sec,pri,dyn} |
667 |
fowners root:named /var/bind/named.cache /var/bind/pri/{127,localhost}.zone /etc/bind/{bind.keys,named.conf} |
668 |
fperms 0640 /var/bind/named.cache /var/bind/pri/{127,localhost}.zone /etc/bind/{bind.keys,named.conf} |
669 |
fperms 0750 /etc/bind /var/bind/pri |
670 |
fperms 0770 /var/{run,log}/named /var/bind/{,sec,dyn} |
671 |
} |
672 |
|
673 |
pkg_postinst() { |
674 |
if [ ! -f '/etc/bind/rndc.key' ]; then |
675 |
if use urandom; then |
676 |
einfo "Using /dev/urandom for generating rndc.key" |
677 |
/usr/sbin/rndc-confgen -r /dev/urandom -a |
678 |
echo |
679 |
else |
680 |
einfo "Using /dev/random for generating rndc.key" |
681 |
/usr/sbin/rndc-confgen -a |
682 |
echo |
683 |
fi |
684 |
chown root:named /etc/bind/rndc.key |
685 |
chmod 0640 /etc/bind/rndc.key |
686 |
fi |
687 |
|
688 |
einfo |
689 |
einfo "You can edit /etc/conf.d/named to customize named settings" |
690 |
einfo |
691 |
use mysql || use postgres || use ldap && { |
692 |
elog "If your named depends on MySQL/PostgreSQL or LDAP," |
693 |
elog "uncomment the specified rc_named_* lines in your" |
694 |
elog "/etc/conf.d/named config to ensure they'll start before bind" |
695 |
einfo |
696 |
} |
697 |
einfo "If you'd like to run bind in a chroot AND this is a new" |
698 |
einfo "install OR your bind doesn't already run in a chroot:" |
699 |
einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named." |
700 |
einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`" |
701 |
einfo |
702 |
|
703 |
CHROOT=$(source /etc/conf.d/named 2>/dev/null; echo ${CHROOT}) |
704 |
if [[ -n ${CHROOT} ]]; then |
705 |
elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!" |
706 |
elog "To enable the old behaviour (without using mount) uncomment the" |
707 |
elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config." |
708 |
elog "If you decide to use the new/default method, ensure to make backup" |
709 |
elog "first and merge your existing configs/zones to /etc/bind and" |
710 |
elog "/var/bind because bind will now mount the needed directories into" |
711 |
elog "the chroot dir." |
712 |
fi |
713 |
|
714 |
ewarn |
715 |
ewarn "NOTE: /var/bind/named.ca has been renamed to /var/bind/named.cache" |
716 |
ewarn "you may need to fix your named.conf!" |
717 |
ewarn |
718 |
ewarn "NOTE: If you upgrade from <net-dns/bind-9.4.3_p5-r1, you may encounter permission problems" |
719 |
ewarn "To fix the permissions do:" |
720 |
ewarn "chown root:named /{etc,var}/bind /var/{run,log}/named /var/bind/{sec,pri,dyn}" |
721 |
ewarn "chown root:named /var/bind/named.cache /var/bind/pri/{127,localhost}.zone /etc/bind/{bind.keys,named.conf}" |
722 |
ewarn "chmod 0640 /var/bind/named.cache /var/bind/pri/{127,localhost}.zone /etc/bind/{bind.keys,named.conf}" |
723 |
ewarn "chmod 0750 /etc/bind /var/bind/pri" |
724 |
ewarn "chmod 0770 /var/{run,log}/named /var/bind/{,sec,dyn}" |
725 |
ewarn |
726 |
} |
727 |
|
728 |
pkg_config() { |
729 |
CHROOT=$(source /etc/conf.d/named; echo ${CHROOT}) |
730 |
CHROOT_NOMOUNT=$(source /etc/conf.d/named; echo ${CHROOT_NOMOUNT}) |
731 |
CHROOT_GEOIP=$(source /etc/conf.d/named; echo ${CHROOT_GEOIP}) |
732 |
|
733 |
if [[ -z "${CHROOT}" ]]; then |
734 |
eerror "This config script is designed to automate setting up" |
735 |
eerror "a chrooted bind/named. To do so, please first uncomment" |
736 |
eerror "and set the CHROOT variable in '/etc/conf.d/named'." |
737 |
die "Unset CHROOT" |
738 |
fi |
739 |
if [[ -d "${CHROOT}" ]]; then |
740 |
ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!" |
741 |
ewarn "To enable the old behaviour (without using mount) uncomment the" |
742 |
ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config." |
743 |
ewarn |
744 |
ewarn "${CHROOT} already exists... some things might become overridden" |
745 |
ewarn "press CTRL+C if you don't want to continue" |
746 |
sleep 10 |
747 |
fi |
748 |
|
749 |
echo; einfo "Setting up the chroot directory..." |
750 |
|
751 |
mkdir -m 0750 -p ${CHROOT} |
752 |
mkdir -m 0755 -p ${CHROOT}/{dev,etc,var/{run,log}} |
753 |
mkdir -m 0750 -p ${CHROOT}/etc/bind |
754 |
mkdir -m 0770 -p ${CHROOT}/var/{bind,{run,log}/named} |
755 |
# As of bind 9.8.0 |
756 |
if has_version net-dns/bind[gost]; then |
757 |
if [ "$(get_libdir)" = "lib64" ]; then |
758 |
mkdir -m 0755 -p ${CHROOT}/usr/lib64/engines |
759 |
ln -s lib64 ${CHROOT}/usr/lib |
760 |
else |
761 |
mkdir -m 0755 -p ${CHROOT}/usr/lib/engines |
762 |
fi |
763 |
fi |
764 |
chown root:named ${CHROOT} ${CHROOT}/var/{bind,{run,log}/named} ${CHROOT}/etc/bind |
765 |
|
766 |
mknod ${CHROOT}/dev/null c 1 3 |
767 |
chmod 0666 ${CHROOT}/dev/null |
768 |
|
769 |
mknod ${CHROOT}/dev/zero c 1 5 |
770 |
chmod 0666 ${CHROOT}/dev/zero |
771 |
|
772 |
if use urandom; then |
773 |
mknod ${CHROOT}/dev/urandom c 1 9 |
774 |
chmod 0666 ${CHROOT}/dev/urandom |
775 |
else |
776 |
mknod ${CHROOT}/dev/random c 1 8 |
777 |
chmod 0666 ${CHROOT}/dev/random |
778 |
fi |
779 |
|
780 |
if [ "${CHROOT_NOMOUNT:-0}" -ne 0 ]; then |
781 |
cp -a /etc/bind ${CHROOT}/etc/ |
782 |
cp -a /var/bind ${CHROOT}/var/ |
783 |
fi |
784 |
|
785 |
if [ "${CHROOT_GEOIP:-0}" -eq 1 ]; then |
786 |
mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP |
787 |
fi |
788 |
|
789 |
elog "You may need to add the following line to your syslog-ng.conf:" |
790 |
elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };" |
791 |
} |