git: 287c9e637e7f - main - dns/powerdns: Security update 5.0.5 => 5.1.2
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 29 Jun 2026 12:15:45 UTC
The branch main has been updated by nxjoseph:
URL: https://cgit.FreeBSD.org/ports/commit/?id=287c9e637e7f0baa9a44f51e56308036925f13e3
commit 287c9e637e7f0baa9a44f51e56308036925f13e3
Author: Ralf van der Enden <tremere@cainites.net>
AuthorDate: 2026-06-07 20:34:01 +0000
Commit: Yusuf Yaman <nxjoseph@FreeBSD.org>
CommitDate: 2026-06-29 12:15:18 +0000
dns/powerdns: Security update 5.0.5 => 5.1.2
Port changes:
- Switch from Autotools to Meson.
- Add new GNUTLS option.
- Fix build with OPENLDAP option by adding dependency on security/krb5.
Upgrade Notes (from 5.0.0 to 5.1.0):
- https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0
Changelogs:
- https://doc.powerdns.com/authoritative/changelog/5.0.html#change-5.0.6
- https://doc.powerdns.com/authoritative/changelog/5.1.html#change-5.1.2
Security Advisories:
- https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2026-05.html
- https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2026-07.html
PR: 296312
Reported by: Jordan Ostreff <jordan@ostreff.info>
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q2
Security: CVE-2026-33257
Security: CVE-2026-33260
Security: CVE-2026-33608
Security: CVE-2026-33609
Security: CVE-2026-33610
Security: CVE-2026-33611
Security: CVE-2026-42005
---
dns/powerdns/Makefile | 96 +++++++++++++---------
dns/powerdns/distinfo | 6 +-
dns/powerdns/files/patch-fix_missing_symbols | 68 +++++++++++++++
.../files/patch-m4_pdns__check__libcrypto.m4 | 15 ----
dns/powerdns/files/patch-m4_pdns__with__lua.m4 | 11 ---
5 files changed, 126 insertions(+), 70 deletions(-)
diff --git a/dns/powerdns/Makefile b/dns/powerdns/Makefile
index 7c7367b4d946..cd56040abe02 100644
--- a/dns/powerdns/Makefile
+++ b/dns/powerdns/Makefile
@@ -1,6 +1,5 @@
PORTNAME= powerdns
-DISTVERSION= 5.0.5
-PORTREVISION= 1
+DISTVERSION= 5.1.2
CATEGORIES= dns
MASTER_SITES= https://downloads.powerdns.com/releases/
DISTNAME= pdns-${DISTVERSION}
@@ -14,47 +13,49 @@ LICENSE= GPLv2
NOT_FOR_ARCHS= i386
NOT_FOR_ARCHS_REASON= archs with 32-bits time_t are no longer supported by upstream
+BUILD_DEPENDS= ${PYTHON_PKGNAMEPREFIX}pyyaml>0:devel/py-pyyaml@${PY_FLAVOR}
LIB_DEPENDS= libboost_program_options.so:devel/boost-libs \
libcurl.so:ftp/curl \
libsodium.so:security/libsodium
-USES= autoreconf compiler:c++11-lib cpe gmake libtool \
- localbase:ldflags pathfix pkgconfig ssl tar:bzip2
+USES= compiler:c++17-lang cpe libtool localbase meson pkgconfig \
+ python:build ssl tar:bzip2
USE_RC_SUBR= pdns
-USE_SUBMAKE= yes
-
-GNU_CONFIGURE= yes
-CONFIGURE_ARGS= --disable-static \
- --docdir="${PREFIX}/share/doc/powerdns" \
- --sysconfdir="${PREFIX}/etc/pdns" \
- --with-boost="${LOCALBASE}" \
- --with-dynmodules="pipe bind ${MODULES}" \
- --with-libsodium=yes \
- --with-modules=""
-
-SCRIPTS_ENV= CURDIR2="${.CURDIR}" \
- DISTNAME="${DISTNAME}" \
- MKDIR="${MKDIR}" \
- POWERDNS_OPTIONS="${POWERDNS_OPTIONS}" \
- WRKDIRPREFIX="${WRKDIRPREFIX}"
-INSTALL_TARGET= install-strip
+
+MESON_ARGS= --datadir=${PREFIX}/share/doc \
+ --libdir=${PREFIX}/lib \
+ --sysconfdir=${PREFIX}/etc/pdns \
+ -Ddns-over-tls=enabled \
+ -Dhardening=disabled \
+ -Dipcipher=enabled \
+ -Dmodule-bind=dynamic \
+ -Dsigners-libcrypto-path=${OPENSSLBASE} \
+ -Dsigners-libcrypto=enabled \
+ -Dsigners-libsodium=enabled \
+ -Dsystemd-service=disabled \
+ -Dtls-libssl-dir=${OPENSSLBASE} \
+ -Dtls-libssl=enabled
+
+DOCSDIR= ${PREFIX}/share/doc/pdns
+BINARY_ALIAS= python3=${PYTHON_CMD}
SUB_FILES= pkg-message
USERS= pdns
GROUPS= pdns
-OPTIONS_DEFINE= DOCS EXAMPLES GEOIP IXFRDIST LMDB LUABACKEND MYSQL \
- OPENLDAP PGSQL REMOTE SQLITE3 TINYDNS TOOLS UNIXODBC \
- ZEROMQ
+OPTIONS_DEFINE= DOCS EXAMPLES GEOIP GNUTLS IXFRDIST LMDB LUABACKEND \
+ MYSQL OPENLDAP PGSQL REMOTE SQLITE3 TINYDNS TOOLS \
+ UNIXODBC ZEROMQ
OPTIONS_DEFAULT= LMDB LUA MYSQL PGSQL SQLITE3
OPTIONS_SINGLE= EXTLUA
OPTIONS_SINGLE_EXTLUA= LUA LUAJIT
-OPTIONS_SUB= yes
+OPTIONS_SUB= yes
EXTLUA_DESC= Lua library
GEOIP_DESC= GeoIP backend (GeoIP2 DB)
+GNUTLS_DESC= DoT support via GnuTLS (sdig only)
IXFRDIST_DESC= Build ixfrdist
LMDB_DESC= LMDB backend
LUABACKEND_DESC= Lua2 backend
@@ -71,58 +72,71 @@ ZEROMQ_DESC= Enable ZeroMQ connector (Implies REMOTE enabled)
GEOIP_LIB_DEPENDS= libmaxminddb.so:net/libmaxminddb \
libyaml-cpp.so:devel/yaml-cpp
+GEOIP_MESON_ON= -Dmodule-geoip=dynamic
GEOIP_VARS= MODULES+=geoip
+GNUTLS_LIB_DEPENDS= libgnutls.so:security/gnutls
+GNUTLS_MESON_ENABLED= tls-gnutls
+
IXFRDIST_LIB_DEPENDS= libyaml-cpp.so:devel/yaml-cpp
-IXFRDIST_CONFIGURE_ENABLE= ixfrdist
+IXFRDIST_MESON_TRUE= tools-ixfrdist
-LMDB_LIB_DEPENDS= liblmdb.so:databases/lmdb \
- libboost_serialization.so:devel/boost-libs
-LMDB_CONFIGURE_ON= --with-lmdb=${LOCALBASE}
-LMDB_CONFIGURE_OFF= --without-lmdb
+LMDB_LIB_DEPENDS= libboost_serialization.so:devel/boost-libs \
+ liblmdb.so:databases/lmdb
+LMDB_MESON_ON= -Dmodule-lmdb=dynamic
LMDB_VARS= MODULES+=lmdb
+LUABACKEND_MESON_ON= -Dmodule-lua2=dynamic
+LUABACKEND_MESON_TRUE= lua-records
LUABACKEND_VARS= MODULES+=lua2
LUAJIT_USES= luajit
-LUAJIT_CONFIGURE_ON= --with-lua=luajit
+LUAJIT_MESON_ON= -Dlua=luajit
-LUA_USES= lua
+LUA_USES= lua
+LUA_MESON_ON= -Dlua=lua
MYSQL_LIB_DEPENDS= libunwind.so:devel/libunwind
MYSQL_USES= mysql
-MYSQL_CONFIGURE_ON= --with-mysql=${LOCALBASE}
-MYSQL_CONFIGURE_OFF= --without-mysql
+MYSQL_MESON_ON= -Dmodule-gmysql=dynamic
MYSQL_VARS= MODULES+=gmysql
+OPENLDAP_BUILD_DEPENDS= krb5>=0:security/krb5
+OPENLDAP_LIB_DEPENDS= libkrb5.so:security/krb5
OPENLDAP_USES= ldap
+OPENLDAP_MESON_ON= -Dmodule-ldap=dynamic
OPENLDAP_CXXFLAGS= -DLDAP_DEPRECATED=1
OPENLDAP_VARS= MODULES+=ldap
-PGSQL_USES= pgsql
-PGSQL_CONFIGURE_ON= --with-pg-config=${LOCALBASE}/bin/pg_config
-PGSQL_VARS= MODULES+=gpgsql
+PGSQL_USES= pgsql
+PGSQL_MESON_ON= -Dmodule-gpgsql=dynamic
+PGSQL_VARS= MODULES+=gpgsql
+REMOTE_MESON_ON= -Dmodule-remote=dynamic
REMOTE_VARS= MODULES+=remote
SQLITE3_USES= sqlite:3
+SQLITE3_MESON_ON= -Dmodule-gsqlite3=dynamic
SQLITE3_VARS= MODULES+=gsqlite3
TINYDNS_LIB_DEPENDS= libcdb.so:databases/tinycdb
-TINYDNS_CONFIGURE_ON= CDB_CFLAGS="-I${LOCALBASE}/include" \
- CDB_LIBS="-L${LOCALBASE}/lib -lcdb"
+TINYDNS_MESON_ON= -Dmodule-tinydns=dynamic
TINYDNS_VARS= MODULES+=tinydns
-TOOLS_CONFIGURE_ENABLE= tools
+TOOLS_MESON_TRUE= tools
UNIXODBC_LIB_DEPENDS= libodbc.so:databases/unixODBC
+UNIXODBC_MESON_ON= -Dmodule-godbc=dynamic
UNIXODBC_VARS= MODULES+=godbc
ZEROMQ_IMPLIES= REMOTE
ZEROMQ_LIB_DEPENDS= libzmq.so:net/libzmq4
-ZEROMQ_CONFIGURE_ON= --enable-remotebackend-zeromq
+ZEROMQ_MESON_TRUE= module-remote-zeromq
post-install::
+.for bin in dnsdemog kvresp
+ @${RM} ${STAGEDIR}${PREFIX}/bin/${bin}
+.endfor
@${MKDIR} ${STAGEDIR}${EXAMPLESDIR} ${STAGEDIR}/var/run/pdns
@${STAGEDIR}${PREFIX}/sbin/pdns_server --module-dir=${STAGEDIR}${PREFIX}/lib/pdns \
--launch="pipe bind ${MODULES}" --config > ${STAGEDIR}${EXAMPLESDIR}/pdns.conf
diff --git a/dns/powerdns/distinfo b/dns/powerdns/distinfo
index 06248d0b87a6..8712da5a1a45 100644
--- a/dns/powerdns/distinfo
+++ b/dns/powerdns/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1779540801
-SHA256 (pdns-5.0.5.tar.bz2) = c144feb23cfc2cd47ebf335132aea0afab605adb4ff4f30955be3445034e0def
-SIZE (pdns-5.0.5.tar.bz2) = 1490386
+TIMESTAMP = 1782380258
+SHA256 (pdns-5.1.2.tar.bz2) = 6855967a54ad7b5de89f910f05e348e317b2ed839eb498f96c38c1af7a1eaf38
+SIZE (pdns-5.1.2.tar.bz2) = 1549581
diff --git a/dns/powerdns/files/patch-fix_missing_symbols b/dns/powerdns/files/patch-fix_missing_symbols
new file mode 100644
index 000000000000..553813ee7634
--- /dev/null
+++ b/dns/powerdns/files/patch-fix_missing_symbols
@@ -0,0 +1,68 @@
+--- meson.build.orig 2026-06-10 08:51:36 UTC
++++ meson.build
+@@ -458,6 +458,14 @@ endif
+ )
+ endif
+
++libpdns_sqlbackend = declare_dependency(
++ link_whole: static_library(
++ 'pdns-sqlbackend',
++ sources: files(src_dir / 'backends' / 'gsql' / 'gsqlbackend.cc', src_dir / 'backends' / 'gsql' / 'gsqlbackend.hh', src_dir / 'backends' / 'gsql' / 'ssql.hh'),
++ dependencies: deps,
++ )
++)
++
+ # This needs to be link_whole'd because it's needed by auth backends.
+ libpdns_ssqlite3 = dependency('', required: false)
+ if dep_sqlite3.found()
+@@ -465,7 +473,7 @@ if dep_sqlite3.found()
+ link_whole: static_library(
+ 'pdns-ssqlite3',
+ sources: files(src_dir / 'ssqlite3.cc', src_dir / 'ssqlite3.hh'),
+- dependencies: deps,
++ dependencies: [deps, libpdns_sqlbackend],
+ )
+ )
+ endif
+@@ -497,9 +505,6 @@ common_sources += files(
+ src_dir / 'auth-zonecache.hh',
+ src_dir / 'axfr-retriever.cc',
+ src_dir / 'axfr-retriever.hh',
+- src_dir / 'backends' / 'gsql' / 'gsqlbackend.cc', # TODO Move to a separate module.
+- src_dir / 'backends' / 'gsql' / 'gsqlbackend.hh', # TODO Move to a separate module.
+- src_dir / 'backends' / 'gsql' / 'ssql.hh', # TODO Move to a separate module.
+ src_dir / 'base32.cc',
+ src_dir / 'base32.hh',
+ src_dir / 'base64.cc',
+--- modules/gmysqlbackend/meson.build.orig 2026-06-10 08:51:36 UTC
++++ modules/gmysqlbackend/meson.build
+@@ -19,4 +19,4 @@ module_resources = files(
+ 'schema.mysql.sql',
+ )
+
+-module_deps = [deps, dep_mysql]
++module_deps = [deps, dep_mysql, libpdns_sqlbackend]
+--- modules/godbcbackend/meson.build.orig 2026-06-10 08:51:36 UTC
++++ modules/godbcbackend/meson.build
+@@ -15,4 +15,4 @@ module_resources = files(
+ '4.3.0_to_4.7.0_schema.mssql.sql',
+ )
+
+-module_deps = [deps, dep_odbc]
++module_deps = [deps, dep_odbc, libpdns_sqlbackend]
+--- modules/gpgsqlbackend/meson.build.orig 2026-06-10 08:51:36 UTC
++++ modules/gpgsqlbackend/meson.build
+@@ -18,4 +18,4 @@ module_resources = files(
+ '4.3.0_to_4.7.0_schema.pgsql.sql',
+ )
+
+-module_deps = [deps, dep_pgsql]
++module_deps = [deps, dep_pgsql, libpdns_sqlbackend]
+--- modules/gsqlite3backend/meson.build.orig 2026-06-10 08:51:36 UTC
++++ modules/gsqlite3backend/meson.build
+@@ -17,4 +17,4 @@ module_resources = files(
+ 'schema.sqlite3.sql',
+ )
+
+-module_deps = [deps, dep_sqlite3]
++module_deps = [deps, dep_sqlite3, libpdns_ssqlite3]
diff --git a/dns/powerdns/files/patch-m4_pdns__check__libcrypto.m4 b/dns/powerdns/files/patch-m4_pdns__check__libcrypto.m4
deleted file mode 100644
index 93d52cf80054..000000000000
--- a/dns/powerdns/files/patch-m4_pdns__check__libcrypto.m4
+++ /dev/null
@@ -1,15 +0,0 @@
---- m4/pdns_check_libcrypto.m4.orig 2025-08-22 07:51:37 UTC
-+++ m4/pdns_check_libcrypto.m4
-@@ -75,8 +75,10 @@ AC_DEFUN([PDNS_CHECK_LIBCRYPTO], [
- for ssldir in $ssldirs; do
- AC_MSG_CHECKING([for openssl/crypto.h in $ssldir])
- if test -f "$ssldir/include/openssl/crypto.h"; then
-- LIBCRYPTO_INCLUDES="-I$ssldir/include"
-- LIBCRYPTO_LDFLAGS="-L$ssldir/lib"
-+ if test $ssldir != /usr; then
-+ LIBCRYPTO_INCLUDES="-I$ssldir/include"
-+ LIBCRYPTO_LDFLAGS="-L$ssldir/lib"
-+ fi
- LIBCRYPTO_LIBS="-lcrypto"
- found=true
- AC_MSG_RESULT([yes])
diff --git a/dns/powerdns/files/patch-m4_pdns__with__lua.m4 b/dns/powerdns/files/patch-m4_pdns__with__lua.m4
deleted file mode 100644
index bafc55a676d8..000000000000
--- a/dns/powerdns/files/patch-m4_pdns__with__lua.m4
+++ /dev/null
@@ -1,11 +0,0 @@
---- m4/pdns_with_lua.m4.orig 2025-09-05 09:28:15 UTC
-+++ m4/pdns_with_lua.m4
-@@ -40,7 +40,7 @@ AC_DEFUN([PDNS_WITH_LUA],[
- ], [ : ])
- AS_IF([test -z "$LUAPC"], [
- found_lua=n
-- m4_foreach_w([luapc], [lua5.3 lua-5.3 lua53 lua5.2 lua-5.2 lua52 lua5.1 lua-5.1 lua51 lua], [
-+ m4_foreach_w([luapc], [lua5.4 lua5.3 lua-5.4 lua-5.3 lua54 lua53 lua5.2 lua-5.2 lua52 lua5.1 lua-5.1 lua51 lua], [
- AS_IF([test "$found_lua" != "y"], [
- PKG_CHECK_MODULES([LUA], [luapc >= ${lua_min_version}], [
- AC_DEFINE([HAVE_LUA], [1], [Define to 1 if you have lua])