The PowerDNS Recursor is a high-end, high-performance resolving
name server which powers the DNS resolution of at least a hundred
million subscribers. Utilizing multiple processors and supporting
the same powerful scripting ability of the Authoritative Server,
the Recursor delivers top performance while retaining the flexibility
modern DNS deployments require:
* IPv4, UDP/TCP
* IPv6, UDP/TCP, 100% compliant
* Remotely pollable statistics for real time graphing
* Full support for all relevant standards
* Advanced anti-spoofing measures
* Reconfiguration without downtime
* Plain BIND zone files for "resolved hosting"
* Internal Lua-based scripted answer generation
* Question interception, answer reconditioning, NXDOMAIN redirection
- Including 'block lists' and security measures
* API for direct control (rec_control)
- Local and remote access
* DNS Response Policy Zones (RPZ)
* DNS64
===> The following configuration options are available for powerdns-recursor-5.4.8:
DNSTAP=off: dnstap support (see dnstap.info)
GNUTLS=off: SSL/TLS support via GnuTLS
NOD=on: Newly Observed Domain Tracking support
SNMP=off: SNMP network protocol support
====> Options available for the single EXTLUA: you have to select exactly one of them
LUA=on: Use lang/lua
LUAJIT=off: Use luajit
===> Use 'make config' to modify these settings
lang/luajit: update to v2.1
Disconnect lang/luajit-devel from the build, will be removed soon.
Bump PORTREVISIONs for the consumers.
Discussed with: adamw
PR: 225342
dns/powerdns-recursor: Update 5.1.1 → 5.1.2 (fix CVE-2024-25590)
PowerDNS Recursor Security Advisory 2024-04:
An attacker can publish a zone containing specific Resource Record Sets.
Repeatedly processing and caching results for these sets can lead to a
denial of service.
CVSS Score: 7.5
https://blog.powerdns.com/2024/10/03/powerdns-recursor-4-9-9-5-0-9-5-1-2-released
PR: 281914
MFH: 2024Q4
dns/powerdns-recursor: update to 5.0.7
ChangeLog:
https://blog.powerdns.com/2024/07/03/powerdns-recursor-4-9-7-5-0-7-released
* Remove potential double SOA records if the target of a dns64 name is NODATA.
* Fix TCP case for policy tags to not produce cached tags in protobuf messages.
* Count substituted remote in case of proxy protocol.¶
PR: 280121
Reported by: tremere@cainites.net (maintainer)
dns/powerdns-recursor: update to 5.0.6
ChangeLog: https://blog.powerdns.com/2024/06/05/powerdns-recursor-5-0-6-released
* YaHTTP: Enforce max # of request fields and max request line size.
* Report error and adjust max-mthreads when linux map limit (vm.max_map_count)
is too low to accomodate resource usage under load.
PR: 279619
Reported by: tremere@cainites.net (maintainer)
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree
- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
Also move conditional flags for non sparc64/arm ARCH to fixed flags.
Reviewed by: brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
dns/powerdns-recursor: update to 4.9.0
ChangeLog: https://blog.powerdns.com/2023/06/30/powerdns-recursor-4-9-0-released
* The performance impact of metrics collection has been reduced by using
lock-free non-atomic thread-local counters.
* The packet cache is sharded and shared by all threads.
* The TTL of negative answers in the packet cache can now be controlled
separately from positive and failure answers.
* The rec_control trace_regex command writes the generated trace information to
a specified file instead of the general log. The trace information contains
more precise timestamps and DNSSEC validation information.
* If extended-resolution-errors is enabled EDNS errors are now generated in
more cases, specifically when authoritative servers for a zone are
unreachable or when synthesising answers by e.g. using the aggressive NSEC
cache.
* The aggressive NSEC cache has been changed not to store NSEC3 entries which
cover only a small fraction of possible names. This also allows switching off
the aggressive cache for NSEC3 only.
* It is now possible to switch off root-refreshing completely.
* Proper handling of security policies that restrict the use of specific DNSSEC
algorithms on RHEL9 derived systems.
PR: 272343
Reported by: tremere@cainites.net (maintainer)
dns/powerdns-recursor: fix build on 14.0-CURRENT (+ OpenSSL 3.0.9)
This fixes the way OpenSSL is detected (it now uses a non-deprecated function),
which is not available anymore on 14.0-CURRENT. Doesn't change anything for
previous versions of FreeBSD.
PR: 272232
Reported by: tremere@cainites.net (maintainer)
dns/powerdns-recursor: update to 4.7.3
ChangeLog:
https://blog.powerdns.com/2022/09/20/powerdns-recursor-4-5-11-4-6-4-and-4-7-3-released/
Improvements
* For zones having many NS records, we are not interested in all so take a
sample.
* Also check qperq limit if throttling happened, as it increases counters.
Bug Fixes
* Failure to retrieve DNSKEYs of an Insecure zone should not be fatal.
* Fix recursor not responsive after Lua config reload.
* Clear the caches after loading authzones.
* Resize answer length to actual received length in udpQueryResponse.¶
PR: 266645
Reported by: tremere@cainites.net (maintainer)
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
dns: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* Aaron Dalton <aaron@FreeBSD.org>
* Akinori MUSHA aka knu <knu@idaemons.org>
* Alex Samorukov <samm@freebsd.org>
* Alexey Dokuchaev <danfe@FreeBSD.org>
* Allan Jude <allanjude@freebsd.org>
* Amar Takhar <verm@drunkmonk.net>
* Anders Nordby <anders@fix.no>
* Andrew Greenwood <greenwood.andy@gmail.com>
* Anton Berezin <tobez@FreeBSD.org>
* Ashish SHUKLA <ashish@FreeBSD.org>
* Attila Nagy <bra@fsn.hu>
(Only the first 15 lines of the commit message are shown above )
