[pkgsrc/trunk]: pkgsrc/net/dnsdist dnsdist: Update to 1.7.2.

[jperkin <jperkin%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/524493071584
branches:  trunk
changeset: 387170:524493071584
user:      jperkin <jperkin%pkgsrc.org@localhost>
date:      Mon Oct 24 11:08:14 2022 +0000

description:
dnsdist: Update to 1.7.2.

pkgsrc changes:
  * Fix NetBSD rc.d script that cannot have previously worked.
  * Use readline support instead of hardcoding editline, and fix buildlink
    variables that cannot have previously worked.
  * Enable nghttp2 support.

1.7.2
 Released: 14th of June 2022
 * Improvements
   Scan the UDP buckets only when we have outstanding queries
   Only allocate the health-check mplexer when needed
   Add Lua bindings to access the DNS payload as a string
 * Bug Fixes
   Fix invalid proxy protocol payload on a DoH TC to TCP retry
   Fix a crash on a invalid protocol in DoH forwarded-for header
   Add missing descriptions for prometheus metrics

1.7.1
 Released: 25th of April 2022
 * Improvements
   Remove the leak warning with GnuTLS >= 3.7.3
   Fix compilation with OpenSSL 3.0.0
   Docker images: remove capability requirements
   Docker image: install ca-certificates
   Work around a compiler bug seen on OpenBSD/amd64 using clang-13
   Stop using the now deprecated and useless std::binary_function
   Add a ‘getAddressAndPort()’ method to DOHFrontend and TLSFrontend objects
 * Bug Fixes
   Fix the health-check timeout for outgoing DoH connections
   Set Server Name Indication on outgoing TLS connections (DoT, DoH)
   Fix the latency-count metric
   Fix a use-after-free in case of a network error in the middle of a XFR query
   Properly use eBPF when the DynBlock is not set
   Fix ‘inConfigCheck()’
   Use the correct outgoing protocol in our ring buffers
   Raise the number of entries in a packet cache to at least 1
   Fix wrong eBPF values (qtype, counter) being inserted for qnames
   The check interval applies to health-check, not timeouts

1.7.0
 Released: 17th of January 2022
 * Bug Fixes
   Test the correct member in DynBlockRatioRule::warningRatioExceeded (Doug Freed)

1.7.0-rc1
 Released: 22nd of December 2021
 * Improvements
   Reuse and save the TLS session tickets in DoT healthchecks
 * Bug Fixes
   Fix a double-free when a DoH cross-protocol response is dropped
   Check the size of the query when re-sending a DoH query

1.7.0-beta2
 Released: 29th of November 2021
 * Improvements
   Add a function to know how many TLS sessions are currently cached
   Warn that GnuTLS 3.7.x leaks memory when validating certs
   Add a function to set the UDP recv/snd buffer sizes
   Add ‘showWebserverConfig’
 * Bug Fixes
   Fix a memory leak when reusing TLS tickets for outgoing connections
   Fix compiler/static analyzer warnings
   Fix Lua parameters bound checks
   Add missing visibility attribute on dnsdist_ffi_dnsquestion_get_qname_hash

1.7.0-beta1
 Released: 16th of November 2021
 * New Features
   Implement filesystem pinning for eBPF maps, drop and truncate via XDP (Pierre Grié)
   Add range support for dynamic blocks
   Add the ability to retain select capabilities at runtime
 * Improvements
   Read as many DoH responses as possible before yielding
   Stop over-allocating for DoH queries
   Support DoT, DoH and DNSCrypt transports for protobuf and dnstap
   Use the same outgoing TCP connection for different clients
   Convert make_pair to emplace (Rosen Penev)
   Add syslog identifier to service file
   Get rid of make_pair (Rosen Penev)
   Use make_unique instead of new (Rosen Penev)
   Handle existing EDNS content for SetMacAddrAction/SetEDNSOptionAction
 * Bug Fixes
   Keep watching idle DoH backend connections
   Fix the cleaning of TCP, DoT and DoH connections to the backend
   Properly handle I/O exceptions in the health checker
   NetmaskTree: Drop the ‘noexcept’ qualifier on the TreeNode ctor
   Fix build without nghttp2
   Remove debug print line flooding logs (Eugen Mayer)
   Credentials: EVP_PKEY_CTX_set1_scrypt_salt() takes an unsigned char*

1.7.0-alpha2
 Released: 19th of October 2021
 * New Features
   Add lua support for SetEDNSOptionAction
   Rule for basing decisions on outstanding queries in a pool (phonedph1)
 * Improvements
   Disable TLS renegotiation, release buffers for outgoing TLS
   Don’t create SSLKEYLOGFILE files with wide permissions
   Update existing tags when calling setTagAction and setTagResponseAction
   Fix the unit tests to handle v4-only or v6-only connectivity
 * Improve the coverage of the outgoing DoH code
   Allow skipping arbitrary EDNS options when computing packet hash
   Add incoming and outgoing protocols to grepq
   Allow setting the block reason from the SMT callback
   Clear the UDP states of TCP-only backends
   Replace shared by unique ptrs, reduce structs size
 * Bug Fixes
   Better handling of outgoing DoH workers
   Properly cache UDP queries passed to a TCP/DoT/DoH backend
   Use per-thread credentials for GnuTLS client connections
   Only set recursion protection once we know we do not return

1.7.0-alpha1
 Released: 23rd of September 2021
 * New Features
   Implementation of DoH between dnsdist and the backend
   Implement cross-protocol queries, including outgoing DNS over TLS
   Add support for Lua per-thread FFI rules and actions
   Add FFI functions to spoof multiple raw values
   Add support for range-based lookups into a Key-Value store
   Implement SpoofSVCAction to return SVC responses
 * Improvements
   Don’t look up the LMDB dbi by name for every query
   Move to hashed passwords for the web interface
   Fix ‘temporary used in loop’ warnings reported by g++ 11.1.0
   Skip some memory allocations in client mode to reduce memory usage
   Support multiple ip addresses for dnsdist-resolver lua script (Wim)
   Make DNSDist XFR aware when transfer is finished (Dimitrios Mavrommatis)
   Do not report latency metrics of down upstream servers (Holger Hoffstätte)
   Carry the exact incoming protocol (Do53, DNSCrypt, DoT, DoH) in DQ
   Implement ‘reload()’ to rotate Log(Response)Action’s log file
   Document that setECSOverride has its drawbacks (Andreas Jakum)
   Convert dnsdist and the recursor to LockGuarded
   Handle waiting for a descriptor to become readable OR writable
   Clean up a bit of “cast from type […] casts away qualifiers” warnings
   Reorganize the IDState and Rings fields to reduce memory usage
 * Bug Fixes
   Catch FDMultiplexerException in IOStateHandler’s destructor
   Resizing LMDB map size while there might be open transactions is unsafe
   Ignore TCAction over TCP
   Stop raising the number of TCP workers to the number of TCP binds
   Handle exception raised in IOStateGuard’s destructor

1.6.1
 Released: 15th of September 2021
 * New Features
   Add the missing DOHFronted::loadNewCertificatesAndKeys()
   Implement a web endpoint to get metrics for only one pool
 * Bug Fixes
   Set the dnstap/protobuf transport to TCP for DoH queries
   Backport a missing mutex header
   Properly handle ECS for queries with ancount or nscount > 0
   Catch FDMultiplexerException in IOStateHandler’s destructor
   Fix outstanding counter issue on TCP error

1.6.0
 Released: 11th of May 2021

1.5.2
 Released: 10th of May 2021
 * Bug Fixes
   Fix a crash when a DoH responses map is updated at runtime
   Fix SNI on resumed sessions by acknowledging the name sent by the client
   Fix the DNSName move assignment operator
   Fix a typo in prometheus metrics dnsdist_frontend_tlshandshakefailures #9728 (AppliedPrivacy)
   Make: two fixes
   Fix eBPF filtering of long qnames
   Fix a hang when removing a server with more than one socket
   Fix Dynamic Block RCode rules messing up the queries count
   Fix EDNS in ServFail generated when no server is available
   Prevent a crash with DynBPF objects in client mode
   Add missing getEDNSOptions and getDO bindings for DNSResponse

1.6.0-rc2
 Released: 4th of May 2021
 * Improvements
   Make the backend queryLoad and dropRate values atomic
 * Bug Fixes
   Fix missing locks in DNSCrypt certificates management
   Only use eBPF for “drop” actions, clean up more often

1.6.0-rc1
 Released: 20th of April 2021
 * Improvements
   Replace pthread_rwlock with std::shared_mutex
   Also disable PMTU for v6
 * Bug Fixes
   Lua: don’t destroy keys during table iteration
   Add missing getEDNSOptions and getDO bindings for DNSResponse
   Fix some issues reported by Thread Sanitizer

1.6.0-alpha3
 Released: 29th of March 2021
 * Improvements
   Set OpenSSL to release buffers when idle, saves 35 kB per connection
   Unify certificate reloading syntaxes
   Disable TLS renegotiation by default
 * Improve TCP connection reuse, add metrics
   Using DATA to report memory usage is unreliable, start using RES instead, as it seems reliable and relevant
   Add a metric for TCP listen queue full events
   Enable sharding by default, greater pipe buffer sizes
   Add limits for cached TCP connections, metrics
 * Bug Fixes
   Fix the handling of DoH queries with a non-zero ID
   Fix the TCP connect timeout, add metrics

1.6.0-alpha2
 Released: 4th of March 2021
 * New Features
   Add option to spoofRawAction to spoof multiple answers (Sander Hoentjen)
   Add ‘spoof’ and ‘spoofRaw’ Lua bindings
 * Improvements
   Make NetmaskTree::fork() a bit easier to understand
   Do not update the TCP error counters on idle states
   Bind __tostring instead of toString for Lua, so that conversion to string works automatically (Aki Tuomi)
 * Bug Fixes
   Remove forgotten debug line in the web server
   Create TCP worker threads before acceptors ones
   Prevent a crash with DynBPF objects in client mode
   Fix several bugs in the TCP code path, add unit tests
   Fix size check during trailing data addition, regression tests
   Clean up expired entries from all the packet cache’s shards

1.6.0-alpha1
 Released: 2nd of February 2021
 * New Features
   Add per-thread Lua FFI load-balancing policies
   Implement Lua custom web endpoints
   Implement TCP out-of-order
   Add support for incoming Proxy Protocol
   Add SkipCacheResponseAction
 * Improvements
   Use more of systemd’s sandboxing options when available
   Add an option to allow sub-paths for DoH
   Prioritize ChaCha20-Poly1305 when client does (Sukhbir Singh)
   Start all TCP worker threads on startup
   Use protozero for Protocol Buffer operations
   Speed up the round robin policy
   Avoid unnecessary allocations and copies with DNSName::toDNSString()
   Get rid of allocations in the packet cache’s fast path
   Fix the DNSName move assignment operator
   Don’t copy the policy for every query
   UUID: Use the non-cryptographic variant of the boost::uuid
   Use an eBPF filter for Dynamic blocks when available
   Limit the number of concurrent console and web connections
   Add prometheus metrics for top Dynamic Blocks entries
   Add per connection queries count and duration stats for DoH
   Add Lua bindings to get a server’s latency
   Wrap more FILE objects in smart pointers
   Set the default EDNS buffer size on generated answers to 1232
   Add support for FreeBSD’s SO_REUSEPORT_LB
   Accept string in DNSDistPacketCache:expungeByName
   DNSName: add toDNSString convenience function
   Skip EDNS Cookies in the packet cache
   Add the query payload size to the verbose log over TCP
   Add the response code in the packet cache dump
   Add an optional name to rules
   Add the ability to set ACL from a file (Matti Hiljanen)
   Add a Lua binding for the number of queries dropped by a server
   Move to c++17
   Fix warnings on autoconf 2.70
   Reduce diff to upstream yahttp, fixing a few CodeQL reports
   Handle syslog facility as string, document the numerical one
   Deprecate parameters to webserver(), add ‘statsRequireAuthentication’ parameter
   Add a counter for queries truncated because of a rule
   Replace offensive terms in our code and documentation
   Use aligned atomics to prevent false sharing
   Unify non-terminal actions as SetXXXAction()
   Accept a NMG to fill DynBlockRulesGroup ranges
   Silence clang 12 warning
   Fix a few warnings reported by clang’s static analyzer and cppcheck
 * Bug Fixes
   Fix a crash when a DoH responses map is updated at runtime
   Fix SNI on resumed sessions by acknowledging the name sent by the client
   Use toStringWithPort instead of manual addr/port concat (Mischan Toosarani-Hausberger)
   Force a reconnection when a downstream transitions to the UP state (Nuitari, Stephane Bakhos)
   Handle EINTR in DelayPipe
   Handle empty DNSNames in grepq()
   Make: two fixes
   Fix eBPF filtering of long qnames
 * Improve const-correctness of Lua bindings (Georgeto)
   Fix a hang when removing a server with more than one socket
   Appease clang++ 12 ASAN on MacOS
   Bunch of signed vs unsigned warnings
   Send a NotImp answer on empty (qdcount=0) queries
   Don’t apply QPS to backend server on cache hits
   Fix EDNS in ServFail generated when no server is available
 * Removals
   Rename topRule() and friends
   Remove useless second argument for SpoofAction

diffstat:

 net/dnsdist/Makefile               |  21 +++++++++++----------
 net/dnsdist/distinfo               |  10 +++++-----
 net/dnsdist/files/dnsdist.sh       |   4 ++--
 net/dnsdist/files/smf/manifest.xml |   4 ++--
 net/dnsdist/patches/patch-qtype.hh |   8 ++++----
 5 files changed, 24 insertions(+), 23 deletions(-)

diffs (129 lines):

diff -r 6b61ff9b187a -r 524493071584 net/dnsdist/Makefile
--- a/net/dnsdist/Makefile      Mon Oct 24 10:39:09 2022 +0000
+++ b/net/dnsdist/Makefile      Mon Oct 24 11:08:14 2022 +0000
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.17 2022/08/06 17:21:05 he Exp $
+# $NetBSD: Makefile,v 1.18 2022/10/24 11:08:14 jperkin Exp $
 
-DISTNAME=      dnsdist-1.5.1
-PKGREVISION=   3
+DISTNAME=      dnsdist-1.7.2
 CATEGORIES=    net
 MASTER_SITES=  https://downloads.powerdns.com/releases/
 EXTRACT_SUFX=  .tar.bz2
@@ -31,14 +30,16 @@
 
 CONFIGURE_ARGS+=       --enable-dns-over-tls
 CONFIGURE_ARGS+=       --enable-dnscrypt
-CONFIGURE_ARGS+=       --enable-fstrm
+CONFIGURE_ARGS+=       --enable-dnstap
 CONFIGURE_ARGS+=       --with-libsodium
 CONFIGURE_ARGS+=       --with-libssl
-CONFIGURE_ARGS+=       --with-protobuf
+CONFIGURE_ARGS+=       --with-lua
+CONFIGURE_ARGS+=       --with-nghttp2
 CONFIGURE_ARGS+=       --with-re2
 CONFIGURE_ARGS+=       --without-net-snmp
-CONFIGURE_ENV+=                LIBEDIT_CFLAGS="-I${BUILDLINK_PREFIX.libedit}/include"
-CONFIGURE_ENV+=                LIBEDIT_LIBS="-L${BUILDLINK_PREFIX.libedit}/lib -ledit"
+
+CONFIGURE_ENV+=                LIBEDIT_CFLAGS="-I${BUILDLINK_PREFIX.editlinereadline}/include"
+CONFIGURE_ENV+=                LIBEDIT_LIBS="-L${BUILDLINK_PREFIX.editlinereadline}/lib ${BUILDLINK_LDADD.editlinereadline}"
 
 INSTALLATION_DIRS+=    share/examples/dnsdist
 RCD_SCRIPTS+=          dnsdist
@@ -48,12 +49,12 @@
                ${DESTDIR}${PREFIX}/share/examples/dnsdist
 
 .include "../../devel/boost-headers/buildlink3.mk"
-.include "../../devel/editline/buildlink3.mk"
-.include "../../devel/protobuf/buildlink3.mk"
 .include "../../devel/re2/buildlink3.mk"
 .include "../../lang/lua/buildlink3.mk"
+.include "../../mk/atomic64.mk"
+.include "../../mk/readline.buildlink3.mk"
 .include "../../net/fstrm/buildlink3.mk"
 .include "../../security/libsodium/buildlink3.mk"
 .include "../../security/openssl/buildlink3.mk"
-.include "../../mk/atomic64.mk"
+.include "../../www/nghttp2/buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"
diff -r 6b61ff9b187a -r 524493071584 net/dnsdist/distinfo
--- a/net/dnsdist/distinfo      Mon Oct 24 10:39:09 2022 +0000
+++ b/net/dnsdist/distinfo      Mon Oct 24 11:08:14 2022 +0000
@@ -1,10 +1,10 @@
-$NetBSD: distinfo,v 1.12 2021/10/26 11:05:32 nia Exp $
+$NetBSD: distinfo,v 1.13 2022/10/24 11:08:14 jperkin Exp $
 
-BLAKE2s (dnsdist-1.5.1.tar.bz2) = 8dc7c02091a7bb0af51fa23990f8cdac2f360b1d19f40a0a4eb91760b09cc255
-SHA512 (dnsdist-1.5.1.tar.bz2) = 68fe5f55fd081ed80a620933af9f8310be0e21c86ba449a9c557975b5c83f4b64e3002e6032dc002582d081e70e1ec2ff080c5d8389fd46a9896bdafd5a41f9f
-Size (dnsdist-1.5.1.tar.bz2) = 1068061 bytes
+BLAKE2s (dnsdist-1.7.2.tar.bz2) = 0daadb638e58c3142ed9cfe160b2f879fed1dd033aa3e4640e154c3002141fb0
+SHA512 (dnsdist-1.7.2.tar.bz2) = 2048ac0f861547fb103da1a128fd39a35ed689ccbf3c080232a3bd0550c9e7c7e01c95864d61e065e341a9f4111c974d2db2aba73eb8f7cba9bf8273da39b8a6
+Size (dnsdist-1.7.2.tar.bz2) = 1391588 bytes
 SHA1 (patch-dnsdist-console.cc) = 4675ca40e738e3d9e15d9a3c6993e1adce102a30
 SHA1 (patch-dnsdist.cc) = 8d3f167e38b6b67bb4d9b7f06dcc0245cf6c904f
 SHA1 (patch-ext_json11_json11.cpp) = 9fb12578d80103b8b92e984a483cbda98fd83db8
 SHA1 (patch-iputils.hh) = 09207cd894162d634cd832f12209e38a0c253624
-SHA1 (patch-qtype.hh) = 4551be1e303a31d34030c363849398923f5ff987
+SHA1 (patch-qtype.hh) = c4db69a8f0c818789607e190bb400791b3707a50
diff -r 6b61ff9b187a -r 524493071584 net/dnsdist/files/dnsdist.sh
--- a/net/dnsdist/files/dnsdist.sh      Mon Oct 24 10:39:09 2022 +0000
+++ b/net/dnsdist/files/dnsdist.sh      Mon Oct 24 11:08:14 2022 +0000
@@ -1,6 +1,6 @@
 #!@RCD_SCRIPTS_SHELL@
 #
-# $NetBSD: dnsdist.sh,v 1.1 2017/03/31 20:49:51 fhajny Exp $
+# $NetBSD: dnsdist.sh,v 1.2 2022/10/24 11:08:15 jperkin Exp $
 #
 # PROVIDE: dnsdist 
 # REQUIRE: DAEMON network
@@ -13,7 +13,7 @@
 name="dnsdist"
 rcvar=$name
 command="@PREFIX@/bin/dnsdist"
-dnsdist_flags="${dnsdist_flags:- -d -u @DNSDIST_USER@ -g @DNSDIST@ -C @PKG_SYSCONFDIR@/dnsdist.conf}"
+dnsdist_flags="${dnsdist_flags:- -u @DNSDIST_USER@ -g @DNSDIST_GROUP@ -C @PKG_SYSCONFDIR@/dnsdist.conf}"
 
 if [ -f /etc/rc.subr ]; then
         load_rc_config $name
diff -r 6b61ff9b187a -r 524493071584 net/dnsdist/files/smf/manifest.xml
--- a/net/dnsdist/files/smf/manifest.xml        Mon Oct 24 10:39:09 2022 +0000
+++ b/net/dnsdist/files/smf/manifest.xml        Mon Oct 24 11:08:14 2022 +0000
@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">
 <service_bundle type="manifest" name="export">
-  <service name="@SMF_PREFIX@/dnsdist" type="service" version="1">
+  <service name="@SMF_PREFIX@/@SMF_NAME@" type="service" version="1">
     <create_default_instance enabled="false" />
     <single_instance />
     <dependency name="network" grouping="require_all" restart_on="error" type="service">
@@ -10,7 +10,7 @@
     <dependency name="filesystem" grouping="require_all" restart_on="error" type="service">
       <service_fmri value="svc:/system/filesystem/local" />
     </dependency>
-    <exec_method type="method" name="start" exec="@PREFIX@/bin/dnsdist -d -u @DNSDIST_USER@ -g @DNSDIST_GROUP@ -C %{config_file}" timeout_seconds="60" />
+    <exec_method type="method" name="start" exec="@PREFIX@/bin/dnsdist --supervised -u @DNSDIST_USER@ -g @DNSDIST_GROUP@ -C %{config_file}" timeout_seconds="60" />
     <exec_method type="method" name="stop" exec=":kill" timeout_seconds="60" />
     <property_group name="startd" type="framework">
       <propval name="duration" type="astring" value="contract" />
diff -r 6b61ff9b187a -r 524493071584 net/dnsdist/patches/patch-qtype.hh
--- a/net/dnsdist/patches/patch-qtype.hh        Mon Oct 24 10:39:09 2022 +0000
+++ b/net/dnsdist/patches/patch-qtype.hh        Mon Oct 24 11:08:14 2022 +0000
@@ -1,11 +1,11 @@
-$NetBSD: patch-qtype.hh,v 1.1 2017/03/31 20:49:51 fhajny Exp $
+$NetBSD: patch-qtype.hh,v 1.2 2022/10/24 11:08:15 jperkin Exp $
 
 Avoid symbol pollution on SunOS.
 
---- qtype.hh.orig      2017-01-17 08:43:49.000000000 +0000
+--- qtype.hh.orig      2022-06-10 13:48:12.000000000 +0000
 +++ qtype.hh
-@@ -26,6 +26,10 @@
- #include <vector>
+@@ -22,6 +22,10 @@
+ #pragma once
  #include "namespaces.hh"
  
 +#if defined(__sun) && defined(DS)