Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Powerdns multiple CVE's #32116

Closed
wants to merge 2 commits into from
Closed

Powerdns multiple CVE's #32116

wants to merge 2 commits into from

Conversation

disassembler
Copy link
Member

@disassembler disassembler commented Nov 27, 2017 •
edited

Motivation for this change
  • 2017-03: Insufficient validation of DNSSEC signatures
    (CVE-2017-15090, Recursor >= 4.0.0)
  • 2017-04: Missing check on API operations (CVE-2017-15091, Authoritative)
  • 2017-05: Cross-Site Scripting in the web interface (CVE-2017-15092,
    Recursor >= 4.0.0)
  • 2017-06: Configuration file injection in the API (CVE-2017-15093,
    Recursor)
  • 2017-07: Memory leak in DNSSEC parsing (CVE-2017-15094, Recursor >=
    4.0.0)
Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Fits CONTRIBUTING.md.

@disassembler
Copy link
Member Author

@GrahamcOfBorg build powerdns pdns-recursor

GrahamcOfBorg
GrahamcOfBorg reviewed Nov 27, 2017
View reviewed changes
Copy link

@GrahamcOfBorg GrahamcOfBorg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Failure for system: x86_64-linux

post-installation fixup
shrinking RPATHs of ELF executables and libraries in /nix/store/q2vv8fpnmskvg6z8savpmdjrisd66lhl-pdns-recursor-4.0.7
shrinking /nix/store/q2vv8fpnmskvg6z8savpmdjrisd66lhl-pdns-recursor-4.0.7/bin/rec_control
shrinking /nix/store/q2vv8fpnmskvg6z8savpmdjrisd66lhl-pdns-recursor-4.0.7/sbin/pdns_recursor
gzipping man pages under /nix/store/q2vv8fpnmskvg6z8savpmdjrisd66lhl-pdns-recursor-4.0.7/share/man/
stripping (with flags -S) in /nix/store/q2vv8fpnmskvg6z8savpmdjrisd66lhl-pdns-recursor-4.0.7/bin  /nix/store/q2vv8fpnmskvg6z8savpmdjrisd66lhl-pdns-recursor-4.0.7/sbin 
patching script interpreter paths in /nix/store/q2vv8fpnmskvg6z8savpmdjrisd66lhl-pdns-recursor-4.0.7
checking for references to /tmp/nix-build-pdns-recursor-4.0.7.drv-0 in /nix/store/q2vv8fpnmskvg6z8savpmdjrisd66lhl-pdns-recursor-4.0.7...
moving /nix/store/q2vv8fpnmskvg6z8savpmdjrisd66lhl-pdns-recursor-4.0.7/sbin/* to /nix/store/q2vv8fpnmskvg6z8savpmdjrisd66lhl-pdns-recursor-4.0.7/bin
error: build of ‘/nix/store/ib44vpxk9fifbb968i4smas4gwsv8srm-powerdns-4.0.5.drv’ failed

@disassembler
Copy link
Member Author

@GrahamcOfBorg build powerdns pdns-recursor

GrahamcOfBorg
GrahamcOfBorg reviewed Nov 27, 2017
View reviewed changes
Copy link

@GrahamcOfBorg GrahamcOfBorg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Failure for system: x86_64-linux

g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o auth-carbon.o auth-carbon.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o common_startup.o common_startup.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o communicator.o communicator.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o dnsproxy.o dnsproxy.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o dynhandler.o dynhandler.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o lua-auth.o lua-auth.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o lua-pdns.o lua-pdns.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o lua-iputils.o lua-iputils.cc
building of ‘/nix/store/dfy5qqxik6v5pvl8mpk31h8mniwyd242-powerdns-4.0.5.drv’ timed out after 1800 seconds
error: build of ‘/nix/store/dfy5qqxik6v5pvl8mpk31h8mniwyd242-powerdns-4.0.5.drv’ failed

GrahamcOfBorg
GrahamcOfBorg reviewed Nov 27, 2017
View reviewed changes
Copy link

@GrahamcOfBorg GrahamcOfBorg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Failure for system: x86_64-darwin

error: Package ‘powerdns-4.0.5’ in /tmp/nix-ofborg/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/lnl7-mac/pkgs/servers/dns/powerdns/default.nix:35 is not supported on ‘x86_64-darwin’, refusing to evaluate.

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

@disassembler
Copy link
Member Author

@GrahamcOfBorg build powerdns

GrahamcOfBorg
GrahamcOfBorg reviewed Nov 28, 2017
View reviewed changes
Copy link

@GrahamcOfBorg GrahamcOfBorg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Failure for system: x86_64-linux

g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o lua-auth.o lua-auth.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o lua-pdns.o lua-pdns.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o lua-iputils.o lua-iputils.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o mastercommunicator.o mastercommunicator.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o nameserver.o nameserver.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o packethandler.o packethandler.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o receiver.o receiver.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/9a6kxfh53vgmc8mhcl98hp7qdncqs2cg-openssl-1.0.2m-dev/include    -I/nix/store/9yilybzbk04ijl5w1y97d9s1jk8grvpg-sqlite-3.21.0-dev/include -I/nix/store/xsdf9sc7a1lh4q9qc0w04vrb3hhr69vd-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/4bjh7ac48p06fi5p5fr0khg0sklr6rns-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o responsestats.o responsestats.cc
building of ‘/nix/store/dfy5qqxik6v5pvl8mpk31h8mniwyd242-powerdns-4.0.5.drv’ timed out after 1800 seconds
error: build of ‘/nix/store/dfy5qqxik6v5pvl8mpk31h8mniwyd242-powerdns-4.0.5.drv’ failed

@disassembler
Copy link
Member Author

@GrahamcOfBorg build powerdns

GrahamcOfBorg
GrahamcOfBorg reviewed Dec 4, 2017
View reviewed changes
Copy link

@GrahamcOfBorg GrahamcOfBorg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Failure for system: x86_64-darwin

error: Package ‘powerdns-4.0.5’ in /tmp/nix-ofborg/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/lnl7-mac/pkgs/servers/dns/powerdns/default.nix:35 is not supported on ‘x86_64-darwin’, refusing to evaluate.

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

GrahamcOfBorg
GrahamcOfBorg reviewed Dec 4, 2017
View reviewed changes
Copy link

@GrahamcOfBorg GrahamcOfBorg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Failure for system: x86_64-linux

g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/gbxl8qnazfp2ams8sbvbywlckclyjcln-openssl-1.0.2m-dev/include    -I/nix/store/7d3r6p4g7qqd2650pahqrdr1iqyc94nd-sqlite-3.21.0-dev/include -I/nix/store/mi5fgdqbqrfz9fsw8b5i4fxfp4kizf6s-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o lua-auth.o lua-auth.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/gbxl8qnazfp2ams8sbvbywlckclyjcln-openssl-1.0.2m-dev/include    -I/nix/store/7d3r6p4g7qqd2650pahqrdr1iqyc94nd-sqlite-3.21.0-dev/include -I/nix/store/mi5fgdqbqrfz9fsw8b5i4fxfp4kizf6s-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o lua-pdns.o lua-pdns.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/gbxl8qnazfp2ams8sbvbywlckclyjcln-openssl-1.0.2m-dev/include    -I/nix/store/7d3r6p4g7qqd2650pahqrdr1iqyc94nd-sqlite-3.21.0-dev/include -I/nix/store/mi5fgdqbqrfz9fsw8b5i4fxfp4kizf6s-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o lua-iputils.o lua-iputils.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/gbxl8qnazfp2ams8sbvbywlckclyjcln-openssl-1.0.2m-dev/include    -I/nix/store/7d3r6p4g7qqd2650pahqrdr1iqyc94nd-sqlite-3.21.0-dev/include -I/nix/store/mi5fgdqbqrfz9fsw8b5i4fxfp4kizf6s-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o mastercommunicator.o mastercommunicator.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/gbxl8qnazfp2ams8sbvbywlckclyjcln-openssl-1.0.2m-dev/include    -I/nix/store/7d3r6p4g7qqd2650pahqrdr1iqyc94nd-sqlite-3.21.0-dev/include -I/nix/store/mi5fgdqbqrfz9fsw8b5i4fxfp4kizf6s-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o nameserver.o nameserver.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/gbxl8qnazfp2ams8sbvbywlckclyjcln-openssl-1.0.2m-dev/include    -I/nix/store/7d3r6p4g7qqd2650pahqrdr1iqyc94nd-sqlite-3.21.0-dev/include -I/nix/store/mi5fgdqbqrfz9fsw8b5i4fxfp4kizf6s-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o packethandler.o packethandler.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/gbxl8qnazfp2ams8sbvbywlckclyjcln-openssl-1.0.2m-dev/include    -I/nix/store/7d3r6p4g7qqd2650pahqrdr1iqyc94nd-sqlite-3.21.0-dev/include -I/nix/store/mi5fgdqbqrfz9fsw8b5i4fxfp4kizf6s-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o receiver.o receiver.cc
g++ -DHAVE_CONFIG_H -I. -I..  -I.. -I.. -pthread  -I../ext/json11 -I../ext/yahttp  -I/nix/store/gbxl8qnazfp2ams8sbvbywlckclyjcln-openssl-1.0.2m-dev/include    -I/nix/store/7d3r6p4g7qqd2650pahqrdr1iqyc94nd-sqlite-3.21.0-dev/include -I/nix/store/mi5fgdqbqrfz9fsw8b5i4fxfp4kizf6s-lua-5.2.3/include   -DSYSCONFDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/etc\" -DPKGLIBDIR=\"/nix/store/bl6dvwgfvya3wvv27kb5gzkprs5vl716-powerdns-4.0.5/lib/pdns\" -DLOCALSTATEDIR=\"/var/lib/powerdns\" -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -Wall -g -O2 -c -o responsestats.o responsestats.cc
building of ‘/nix/store/hqx3fk19h6jyfxy3mvs13byhcv1ynyw3-powerdns-4.0.5.drv’ timed out after 1800 seconds
error: build of ‘/nix/store/hqx3fk19h6jyfxy3mvs13byhcv1ynyw3-powerdns-4.0.5.drv’ failed

@fpletz fpletz self-assigned this Dec 11, 2017
@fpletz
Copy link
Member

fpletz commented Dec 11, 2017

I'm gonna test and cherry-pick the powerdns update. pdns-recursor will be done with #32565. Thanks!

@fpletz fpletz closed this in c2e9a1c Dec 11, 2017
fpletz pushed a commit that referenced this pull request Dec 11, 2017
@fpletz
powerdns: 4.0.4 -> 4.0.5 for CVE-2017-15091
e117a6b 
Closes #32116.

(cherry picked from commit c2e9a1c)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@GrahamcOfBorg GrahamcOfBorg GrahamcOfBorg left review comments

Assignees

@fpletz fpletz

Labels
1.severity: security 10.rebuild-darwin: 0 10.rebuild-linux: 1-10
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@disassembler @fpletz @GrahamcOfBorg