powerdns-recursor: updated to 4.1.11

4.1.11
Since Spectre/Meltdown, system calls have become more expensive. This made exporting a very high number of protobuf messages costly, which is addressed in this release by reducing the number of sycalls per message.

Improvements
Add an option to export only responses over protobuf to the Lua protobufServer() directive.
Reduce systemcall usage in protobuf logging.


4.1.10
This release fixes a bug when trying to build PowerDNS Recursor with protobuf support disabled, thus this release is only relevant to people building PowerDNS Recursor from source and not if you’re installing it as a package from our repositories.

Bug Fixes
PowerDNS Recursor release 4.1.9 introduced a call to the Lua ipfilter() hook that required access to the DNS header, but the corresponding variable was only declared when protobuf support had been enabled.


4.1.9
This release fixes Security Advisory 2019-01 and Security Advisory 2019-02 that were recently discovered, affecting PowerDNS Recursor:
CVE-2019-3806, 2019-01: from 4.1.4 up to and including 4.1.8 ;
CVE-2019-3807, 2019-02: from 4.1.0 up to and including 4.1.8.

The issues are:
CVE-2019-3806, 2019-01: Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua ;
CVE-2019-3807, 2019-02: records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.

Improvements
Try another worker before failing if the first pipe was full

3 files changed, 26 insertions, 7 deletions

diff --git a/net/powerdns-recursor/Makefile b/net/powerdns-recursor/Makefile
index d7366148b8c..2114f98507c 100644
--- a/net/powerdns-recursor/Makefile
+++ b/net/powerdns-recursor/Makefile
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.31 2018/11/30 12:57:41 adam Exp $
+# $NetBSD: Makefile,v 1.32 2019/02/20 12:19:44 adam Exp $
 
-DISTNAME=	pdns-recursor-4.1.8
+DISTNAME=	pdns-recursor-4.1.11
+PKGNAME=	${DISTNAME:S/pdns/powerdns/}
 CATEGORIES=	net
 MASTER_SITES=	http://downloads.powerdns.com/releases/
 EXTRACT_SUFX=	.tar.bz2
@@ -14,6 +15,8 @@ USE_LANGUAGES=		c c++11
 USE_TOOLS+=		gmake pkg-config
 GNU_CONFIGURE=		yes
 CONFIGURE_ARGS+=	--without-net-snmp
+# currently not portable
+CONFIGURE_ENV.NetBSD+=	ac_cv_search_pthread_setaffinity_np=no
 
 RCD_SCRIPTS+=		pdns_recursor
 
diff --git a/net/powerdns-recursor/distinfo b/net/powerdns-recursor/distinfo
index c1321d59189..1641b22d177 100644
--- a/net/powerdns-recursor/distinfo
+++ b/net/powerdns-recursor/distinfo
@@ -1,12 +1,13 @@
-$NetBSD: distinfo,v 1.27 2018/11/30 12:57:42 adam Exp $
+$NetBSD: distinfo,v 1.28 2019/02/20 12:19:44 adam Exp $
 
-SHA1 (pdns-recursor-4.1.8.tar.bz2) = a78c1a7966cab9e2b9032080a7e28227a32a1b3b
-RMD160 (pdns-recursor-4.1.8.tar.bz2) = d98b6881a76fe2caecb8c997996b580779a470af
-SHA512 (pdns-recursor-4.1.8.tar.bz2) = 5c09b8ce3f2f3ed6bb350cbd20e6cad4b66f9db85677605d57eca67187c05ddde5071af246a7398e2821c9ed2e5ff101d2b4928366b3ddf12013020fa9b74e61
-Size (pdns-recursor-4.1.8.tar.bz2) = 1237750 bytes
+SHA1 (pdns-recursor-4.1.11.tar.bz2) = c6fc345f2f1db854b08fac5a218652f37066e53d
+RMD160 (pdns-recursor-4.1.11.tar.bz2) = 15f7a6a82fba8b0e5f3fe0b55a44b2887489f925
+SHA512 (pdns-recursor-4.1.11.tar.bz2) = 6041d31f0a517786f44a7fa22c7bfa94d5d4bdc3a7f349d2b47bc66be87404fe8eaf76f45ca18ef8ab96a45c0271f46fdba93a51fbda2542a3ad96e10f51c1d1
+Size (pdns-recursor-4.1.11.tar.bz2) = 1239986 bytes
 SHA1 (patch-configure) = 5c91dcbc43a51bf30af200e234f18eb9b7458e6f
 SHA1 (patch-dns.hh) = 7e9c1b10a066a605b74ebdbee2d894aed50f6c68
 SHA1 (patch-ext_json11_json11.cpp) = 2de8ea8b51556bd3e3c1a88f681697eff239ab1a
+SHA1 (patch-iputils.cc) = af5fa3942b34ac5e83326aa454ce14793130a4ad
 SHA1 (patch-iputils.hh) = 9de7c58db7468da9fd2a175464becdbe339fac9d
 SHA1 (patch-kqueuemplexer.cc) = ff1685111c98c085e74bd64f27dfaae6fbe1e8b3
 SHA1 (patch-m4_pdns__check__os.m4) = 0e23d942944ad752fbbc0029745789ce47744628
diff --git a/net/powerdns-recursor/patches/patch-iputils.cc b/net/powerdns-recursor/patches/patch-iputils.cc
new file mode 100644
index 00000000000..d1460a7de0c
--- /dev/null
+++ b/net/powerdns-recursor/patches/patch-iputils.cc
@@ -0,0 +1,15 @@
+$NetBSD: patch-iputils.cc,v 1.1 2019/02/20 12:19:44 adam Exp $
+
+Fix buildling.
+
+--- iputils.cc.orig	2019-02-20 10:50:10.609217278 +0000
++++ iputils.cc
+@@ -146,7 +146,7 @@ bool HarvestTimestamp(struct msghdr* msg
+ bool HarvestDestinationAddress(const struct msghdr* msgh, ComboAddress* destination)
+ {
+   destination->reset();
+-  const struct cmsghdr* cmsg;
++  struct cmsghdr* cmsg;
+   for (cmsg = CMSG_FIRSTHDR(msgh); cmsg != NULL; cmsg = CMSG_NXTHDR(const_cast<struct msghdr*>(msgh), const_cast<struct cmsghdr*>(cmsg))) {
+ #if defined(IP_PKTINFO)
+      if ((cmsg->cmsg_level == IPPROTO_IP) && (cmsg->cmsg_type == IP_PKTINFO)) {