[pkgsrc/trunk]: pkgsrc/net/powerdns-recursor powerdns-recursor: updated to 4....

[adam <adam%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/df0e6a4ba346
branches:  trunk
changeset: 391985:df0e6a4ba346
user:      adam <adam%pkgsrc.org@localhost>
date:      Wed Feb 20 12:19:44 2019 +0000

description:
powerdns-recursor: updated to 4.1.11

4.1.11
Since Spectre/Meltdown, system calls have become more expensive. This made exporting a very high number of protobuf messages costly, which is addressed in this release by reducing the number of 
sycalls per message.

Improvements
Add an option to export only responses over protobuf to the Lua protobufServer() directive.
Reduce systemcall usage in protobuf logging.


4.1.10
This release fixes a bug when trying to build PowerDNS Recursor with protobuf support disabled, thus this release is only relevant to people building PowerDNS Recursor from source and not if you?re 
installing it as a package from our repositories.

Bug Fixes
PowerDNS Recursor release 4.1.9 introduced a call to the Lua ipfilter() hook that required access to the DNS header, but the corresponding variable was only declared when protobuf support had been 
enabled.


4.1.9
This release fixes Security Advisory 2019-01 and Security Advisory 2019-02 that were recently discovered, affecting PowerDNS Recursor:
CVE-2019-3806, 2019-01: from 4.1.4 up to and including 4.1.8 ;
CVE-2019-3807, 2019-02: from 4.1.0 up to and including 4.1.8.

The issues are:
CVE-2019-3806, 2019-01: Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua ;
CVE-2019-3807, 2019-02: records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC 
validation.

Improvements
Try another worker before failing if the first pipe was full

diffstat:

 net/powerdns-recursor/Makefile                 |   7 +++++--
 net/powerdns-recursor/distinfo                 |  11 ++++++-----
 net/powerdns-recursor/patches/patch-iputils.cc |  15 +++++++++++++++
 3 files changed, 26 insertions(+), 7 deletions(-)

diffs (63 lines):

diff -r 991e16c23552 -r df0e6a4ba346 net/powerdns-recursor/Makefile
--- a/net/powerdns-recursor/Makefile    Wed Feb 20 11:52:52 2019 +0000
+++ b/net/powerdns-recursor/Makefile    Wed Feb 20 12:19:44 2019 +0000
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.31 2018/11/30 12:57:41 adam Exp $
+# $NetBSD: Makefile,v 1.32 2019/02/20 12:19:44 adam Exp $
 
-DISTNAME=      pdns-recursor-4.1.8
+DISTNAME=      pdns-recursor-4.1.11
+PKGNAME=       ${DISTNAME:S/pdns/powerdns/}
 CATEGORIES=    net
 MASTER_SITES=  http://downloads.powerdns.com/releases/
 EXTRACT_SUFX=  .tar.bz2
@@ -14,6 +15,8 @@
 USE_TOOLS+=            gmake pkg-config
 GNU_CONFIGURE=         yes
 CONFIGURE_ARGS+=       --without-net-snmp
+# currently not portable
+CONFIGURE_ENV.NetBSD+= ac_cv_search_pthread_setaffinity_np=no
 
 RCD_SCRIPTS+=          pdns_recursor
 
diff -r 991e16c23552 -r df0e6a4ba346 net/powerdns-recursor/distinfo
--- a/net/powerdns-recursor/distinfo    Wed Feb 20 11:52:52 2019 +0000
+++ b/net/powerdns-recursor/distinfo    Wed Feb 20 12:19:44 2019 +0000
@@ -1,12 +1,13 @@
-$NetBSD: distinfo,v 1.27 2018/11/30 12:57:42 adam Exp $
+$NetBSD: distinfo,v 1.28 2019/02/20 12:19:44 adam Exp $
 
-SHA1 (pdns-recursor-4.1.8.tar.bz2) = a78c1a7966cab9e2b9032080a7e28227a32a1b3b
-RMD160 (pdns-recursor-4.1.8.tar.bz2) = d98b6881a76fe2caecb8c997996b580779a470af
-SHA512 (pdns-recursor-4.1.8.tar.bz2) = 5c09b8ce3f2f3ed6bb350cbd20e6cad4b66f9db85677605d57eca67187c05ddde5071af246a7398e2821c9ed2e5ff101d2b4928366b3ddf12013020fa9b74e61
-Size (pdns-recursor-4.1.8.tar.bz2) = 1237750 bytes
+SHA1 (pdns-recursor-4.1.11.tar.bz2) = c6fc345f2f1db854b08fac5a218652f37066e53d
+RMD160 (pdns-recursor-4.1.11.tar.bz2) = 15f7a6a82fba8b0e5f3fe0b55a44b2887489f925
+SHA512 (pdns-recursor-4.1.11.tar.bz2) = 6041d31f0a517786f44a7fa22c7bfa94d5d4bdc3a7f349d2b47bc66be87404fe8eaf76f45ca18ef8ab96a45c0271f46fdba93a51fbda2542a3ad96e10f51c1d1
+Size (pdns-recursor-4.1.11.tar.bz2) = 1239986 bytes
 SHA1 (patch-configure) = 5c91dcbc43a51bf30af200e234f18eb9b7458e6f
 SHA1 (patch-dns.hh) = 7e9c1b10a066a605b74ebdbee2d894aed50f6c68
 SHA1 (patch-ext_json11_json11.cpp) = 2de8ea8b51556bd3e3c1a88f681697eff239ab1a
+SHA1 (patch-iputils.cc) = af5fa3942b34ac5e83326aa454ce14793130a4ad
 SHA1 (patch-iputils.hh) = 9de7c58db7468da9fd2a175464becdbe339fac9d
 SHA1 (patch-kqueuemplexer.cc) = ff1685111c98c085e74bd64f27dfaae6fbe1e8b3
 SHA1 (patch-m4_pdns__check__os.m4) = 0e23d942944ad752fbbc0029745789ce47744628
diff -r 991e16c23552 -r df0e6a4ba346 net/powerdns-recursor/patches/patch-iputils.cc
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/net/powerdns-recursor/patches/patch-iputils.cc    Wed Feb 20 12:19:44 2019 +0000
@@ -0,0 +1,15 @@
+$NetBSD: patch-iputils.cc,v 1.1 2019/02/20 12:19:44 adam Exp $
+
+Fix buildling.
+
+--- iputils.cc.orig    2019-02-20 10:50:10.609217278 +0000
++++ iputils.cc
+@@ -146,7 +146,7 @@ bool HarvestTimestamp(struct msghdr* msg
+ bool HarvestDestinationAddress(const struct msghdr* msgh, ComboAddress* destination)
+ {
+   destination->reset();
+-  const struct cmsghdr* cmsg;
++  struct cmsghdr* cmsg;
+   for (cmsg = CMSG_FIRSTHDR(msgh); cmsg != NULL; cmsg = CMSG_NXTHDR(const_cast<struct msghdr*>(msgh), const_cast<struct cmsghdr*>(cmsg))) {
+ #if defined(IP_PKTINFO)
+      if ((cmsg->cmsg_level == IPPROTO_IP) && (cmsg->cmsg_type == IP_PKTINFO)) {