1 files changed, 52 insertions, 0 deletions
diff --git a/net-dns/pdns-recursor/files/pdns-recursor-3.6.1-CVE-2014-8601.patch b/net-dns/pdns-recursor/files/pdns-recursor-3.6.1-CVE-2014-8601.patch
new file mode 100644
index 000000000000..44ccc2803848
--- /dev/null
+++ b/net-dns/pdns-recursor/files/pdns-recursor-3.6.1-CVE-2014-8601.patch
@@ -0,0 +1,52 @@
+https://downloads.powerdns.com/patches/2014-02/3.6.1.patch
+
+diff --git a/pdns_recursor.cc b/pdns_recursor.cc
+index f1ef93c..8e43d6e 100644
+--- a/pdns_recursor.cc
++++ b/pdns_recursor.cc
+@@ -550,7 +550,14 @@ void startDoResolve(void *p)
+ 
+     // if there is a RecursorLua active, and it 'took' the query in preResolve, we don't launch beginResolve
+     if(!t_pdl->get() || !(*t_pdl)->preresolve(dc->d_remote, g_listenSocketsAddresses[dc->d_socket], dc->d_mdp.d_qname, QType(dc->d_mdp.d_qtype), ret, res, &variableAnswer)) {
+-      res = sr.beginResolve(dc->d_mdp.d_qname, QType(dc->d_mdp.d_qtype), dc->d_mdp.d_qclass, ret);
++       try {
++         res = sr.beginResolve(dc->d_mdp.d_qname, QType(dc->d_mdp.d_qtype), dc->d_mdp.d_qclass, ret);
++       }
++       catch(ImmediateServFailException &e) {
++         L<<Logger::Error<<"Sending SERVFAIL during resolve of '"<<dc->d_mdp.d_qname<<"' because: "<<e.reason<<endl;
++
++         res = RCode::ServFail;
++       }
+ 
+       if(t_pdl->get()) {
+         if(res == RCode::NoError) {
+diff --git a/syncres.cc b/syncres.cc
+index 4dc78b4..d09e44b 100644
+--- a/syncres.cc
++++ b/syncres.cc
+@@ -923,6 +923,7 @@ int SyncRes::doResolveAt(set<string, CIStringCompare> nameservers, string auth,
+           }
+           else {
+             s_outqueries++; d_outqueries++;
++            if(d_outqueries > 50) throw ImmediateServFailException("more than 50 queries sent while resolving "+qname);
+           TryTCP:
+             if(doTCP) {
+               LOG(prefix<<qname<<": using TCP with "<< remoteIP->toStringWithPort() <<endl);
+diff --git a/syncres.hh b/syncres.hh
+index 5182527..b22de89 100644
+--- a/syncres.hh
++++ b/syncres.hh
+@@ -593,6 +593,13 @@ private:
+   static AtomicCounter s_currentConnections; //!< total number of current TCP connections
+ };
+ 
++class ImmediateServFailException
++{
++public:
++  ImmediateServFailException(string r){reason=r;};
++
++  string reason; //! Print this to tell the user what went wrong
++};
+ 
+ struct RemoteKeeper
+ {