Attachment #234414 for bug #264427

View | Details | Raw Unified | Return to bug 264427
Collapse All | Expand All

Lines 1-8 Link Here

(-)b/dns/powerdns-recursor/Makefile (-2 / +1 lines)
1	# Created by: sten@blinkenlights.nl	1	# Created by: sten@blinkenlights.nl
2		2
3	PORTNAME= recursor	3	PORTNAME= recursor
4	DISTVERSION= 4.6.2	4	DISTVERSION= 4.7.0
5	PORTREVISION= 1
6	CATEGORIES= dns	5	CATEGORIES= dns
7	MASTER_SITES= http://downloads.powerdns.com/releases/	6	MASTER_SITES= http://downloads.powerdns.com/releases/
8	PKGNAMEPREFIX= powerdns-	7	PKGNAMEPREFIX= powerdns-

Lines 1-3 Link Here

(-)b/dns/powerdns-recursor/distinfo (-3 / +3 lines)
1	TIMESTAMP = 1649243394	1	TIMESTAMP = 1653936202
2	SHA256 (pdns-recursor-4.6.2.tar.bz2) = da649850739fdd7baf2df645acc97752ccd390973b56b8e25171ea7b0d25ad20	2	SHA256 (pdns-recursor-4.7.0.tar.bz2) = e4872a1b11a35fc363f354d69ccb4ec88047bfc7d9308087497dc2ad3af3498c
3	SIZE (pdns-recursor-4.6.2.tar.bz2) = 1552587	3	SIZE (pdns-recursor-4.7.0.tar.bz2) = 1596954




--- credentials.cc.orig	2021-11-23 18:39:17 UTC
+++ credentials.cc
@@ -28,7 +28,7 @@
 #include <sodium.h>
 #endif
 
-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
 #include <openssl/evp.h>
 #include <openssl/kdf.h>
 #include <openssl/rand.h>
@@ -42,7 +42,7 @@
 #include "credentials.hh"
 #include "misc.hh"
 
-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
 static size_t const pwhash_max_size = 128U; /* maximum size of the output */
 static size_t const pwhash_output_size = 32U; /* size of the hashed output (before base64 encoding) */
 static unsigned int const pwhash_salt_size = 16U; /* size of the salt (before base64 encoding */
@@ -95,7 +95,7 @@ void SensitiveData::clear()
 
 static std::string hashPasswordInternal(const std::string& password, const std::string& salt, uint64_t workFactor, uint64_t parallelFactor, uint64_t blockSize)
 {
-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
   auto pctx = std::unique_ptr<EVP_PKEY_CTX, void (*)(EVP_PKEY_CTX*)>(EVP_PKEY_CTX_new_id(EVP_PKEY_SCRYPT, nullptr), EVP_PKEY_CTX_free);
   if (!pctx) {
     throw std::runtime_error("Error getting a scrypt context to hash the supplied password");
@@ -142,7 +142,7 @@ static std::string hashPasswordInternal(const std::str
 
 static std::string generateRandomSalt()
 {
-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
   /* generate a random salt */
   std::string salt;
   salt.resize(pwhash_salt_size);
@@ -159,7 +159,7 @@ static std::string generateRandomSalt()
 
 std::string hashPassword(const std::string& password, uint64_t workFactor, uint64_t parallelFactor, uint64_t blockSize)
 {
-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
   std::string result;
   result.reserve(pwhash_max_size);
 
@@ -187,7 +187,7 @@ std::string hashPassword(const std::string& password, 
 
 std::string hashPassword(const std::string& password)
 {
-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
   return hashPassword(password, CredentialsHolder::s_defaultWorkFactor, CredentialsHolder::s_defaultParallelFactor, CredentialsHolder::s_defaultBlockSize);
 #else
   throw std::runtime_error("Hashing a password requires scrypt support in OpenSSL, and it is not available");
@@ -196,7 +196,7 @@ std::string hashPassword(const std::string& password)
 
 bool verifyPassword(const std::string& binaryHash, const std::string& salt, uint64_t workFactor, uint64_t parallelFactor, uint64_t blockSize, const std::string& binaryPassword)
 {
-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
   auto expected = hashPasswordInternal(binaryPassword, salt, workFactor, parallelFactor, blockSize);
   return constantTimeStringEquals(expected, binaryHash);
 #else
@@ -207,7 +207,7 @@ bool verifyPassword(const std::string& binaryHash, con
 /* parse a hashed password in PHC string format */
 static void parseHashed(const std::string& hash, std::string& salt, std::string& hashedPassword, uint64_t& workFactor, uint64_t& parallelFactor, uint64_t& blockSize)
 {
-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
   auto parametersEnd = hash.find('$', pwhash_prefix.size());
   if (parametersEnd == std::string::npos || parametersEnd == hash.size()) {
     throw std::runtime_error("Invalid hashed password format, no parameters");
@@ -276,7 +276,7 @@ bool verifyPassword(const std::string& hash, const std
     return false;
   }
 
-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
   std::string salt;
   std::string hashedPassword;
   uint64_t workFactor = 0;
@@ -294,7 +294,7 @@ bool verifyPassword(const std::string& hash, const std
 
 bool isPasswordHashed(const std::string& password)
 {
-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
   if (password.size() < pwhash_prefix_size || password.size() > pwhash_max_size) {
     return false;
   }
@@ -389,7 +389,7 @@ bool CredentialsHolder::matches(const std::string& pas
 
 bool CredentialsHolder::isHashingAvailable()
 {
-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
   return true;
 #else
   return false;




--- pdns_recursor.cc.orig	2020-05-08 09:31:59 UTC
+++ pdns_recursor.cc
@@ -4640,12 +4640,12 @@ int main(int argc, char **argv)
 #define SYSTEMD_SETID_MSG ". When running inside systemd, use the User and Group settings in the unit-file!"
         SYSTEMD_SETID_MSG
 #endif
-        )="";
+        )="pdns";
     ::arg().set("setuid","If set, change user id to this uid for more security"
 #ifdef HAVE_SYSTEMD
         SYSTEMD_SETID_MSG
 #endif
-        )="";
+        )="pdns_recursor";
     ::arg().set("network-timeout", "Wait this number of milliseconds for network i/o")="1500";
     ::arg().set("threads", "Launch this number of threads")="2";
     ::arg().set("distributor-threads", "Launch this number of distributor threads, distributing queries to other threads")="0";




--- rec-main.cc.orig	2022-05-29 14:07:40 UTC
+++ rec-main.cc
@@ -2309,13 +2309,13 @@ int main(int argc, char** argv)
                 SYSTEMD_SETID_MSG
 #endif
                 )
-      = "";
+      = "pdns";
     ::arg().set("setuid", "If set, change user id to this uid for more security"
 #ifdef HAVE_SYSTEMD
                 SYSTEMD_SETID_MSG
 #endif
                 )
-      = "";
+      = "pdns_recursor";
     ::arg().set("network-timeout", "Wait this number of milliseconds for network i/o") = "1500";
     ::arg().set("threads", "Launch this number of threads") = "2";
     ::arg().set("distributor-threads", "Launch this number of distributor threads, distributing queries to other threads") = "0";

Return to bug 264427

Removed Link Here

(-)a/dns/powerdns-recursor/files/patch-credentials.cc (-101 lines)
1	--- credentials.cc.orig 2021-11-23 18:39:17 UTC
2	+++ credentials.cc
3	@@ -28,7 +28,7 @@
4	#include <sodium.h>
5	#endif
6
7	-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
8	+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
9	#include <openssl/evp.h>
10	#include <openssl/kdf.h>
11	#include <openssl/rand.h>
12	@@ -42,7 +42,7 @@
13	#include "credentials.hh"
14	#include "misc.hh"
15
16	-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
17	+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
18	static size_t const pwhash_max_size = 128U; /* maximum size of the output */
19	static size_t const pwhash_output_size = 32U; /* size of the hashed output (before base64 encoding) */
20	static unsigned int const pwhash_salt_size = 16U; /* size of the salt (before base64 encoding */
21	@@ -95,7 +95,7 @@ void SensitiveData::clear()
22
23	static std::string hashPasswordInternal(const std::string& password, const std::string& salt, uint64_t workFactor, uint64_t parallelFactor, uint64_t blockSize)
24	{
25	-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
26	+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
27	auto pctx = std::unique_ptr<EVP_PKEY_CTX, void ()(EVP_PKEY_CTX)>(EVP_PKEY_CTX_new_id(EVP_PKEY_SCRYPT, nullptr), EVP_PKEY_CTX_free);
28	if (!pctx) {
29	throw std::runtime_error("Error getting a scrypt context to hash the supplied password");
30	@@ -142,7 +142,7 @@ static std::string hashPasswordInternal(const std::str
31
32	static std::string generateRandomSalt()
33	{
34	-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
35	+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
36	/* generate a random salt */
37	std::string salt;
38	salt.resize(pwhash_salt_size);
39	@@ -159,7 +159,7 @@ static std::string generateRandomSalt()
40
41	std::string hashPassword(const std::string& password, uint64_t workFactor, uint64_t parallelFactor, uint64_t blockSize)
42	{
43	-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
44	+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
45	std::string result;
46	result.reserve(pwhash_max_size);
47
48	@@ -187,7 +187,7 @@ std::string hashPassword(const std::string& password,
49
50	std::string hashPassword(const std::string& password)
51	{
52	-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
53	+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
54	return hashPassword(password, CredentialsHolder::s_defaultWorkFactor, CredentialsHolder::s_defaultParallelFactor, CredentialsHolder::s_defaultBlockSize);
55	#else
56	throw std::runtime_error("Hashing a password requires scrypt support in OpenSSL, and it is not available");
57	@@ -196,7 +196,7 @@ std::string hashPassword(const std::string& password)
58
59	bool verifyPassword(const std::string& binaryHash, const std::string& salt, uint64_t workFactor, uint64_t parallelFactor, uint64_t blockSize, const std::string& binaryPassword)
60	{
61	-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
62	+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
63	auto expected = hashPasswordInternal(binaryPassword, salt, workFactor, parallelFactor, blockSize);
64	return constantTimeStringEquals(expected, binaryHash);
65	#else
66	@@ -207,7 +207,7 @@ bool verifyPassword(const std::string& binaryHash, con
67	/* parse a hashed password in PHC string format */
68	static void parseHashed(const std::string& hash, std::string& salt, std::string& hashedPassword, uint64_t& workFactor, uint64_t& parallelFactor, uint64_t& blockSize)
69	{
70	-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
71	+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
72	auto parametersEnd = hash.find('$', pwhash_prefix.size());
73	if (parametersEnd == std::string::npos \|\| parametersEnd == hash.size()) {
74	throw std::runtime_error("Invalid hashed password format, no parameters");
75	@@ -276,7 +276,7 @@ bool verifyPassword(const std::string& hash, const std
76	return false;
77	}
78
79	-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
80	+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
81	std::string salt;
82	std::string hashedPassword;
83	uint64_t workFactor = 0;
84	@@ -294,7 +294,7 @@ bool verifyPassword(const std::string& hash, const std
85
86	bool isPasswordHashed(const std::string& password)
87	{
88	-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
89	+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
90	if (password.size() < pwhash_prefix_size \|\| password.size() > pwhash_max_size) {
91	return false;
92	}
93	@@ -389,7 +389,7 @@ bool CredentialsHolder::matches(const std::string& pas
94
95	bool CredentialsHolder::isHashingAvailable()
96	{
97	-#ifdef HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT
98	+#if defined(HAVE_EVP_PKEY_CTX_SET1_SCRYPT_SALT) && defined(EVP_PKEY_SCRYPT)
99	return true;
100	#else
101	return false;

Removed Link Here

(-)a/dns/powerdns-recursor/files/patch-pdns_recursor.cc (-17 lines)
1	--- pdns_recursor.cc.orig 2020-05-08 09:31:59 UTC
2	+++ pdns_recursor.cc
3	@@ -4640,12 +4640,12 @@ int main(int argc, char **argv)
4	#define SYSTEMD_SETID_MSG ". When running inside systemd, use the User and Group settings in the unit-file!"
5	SYSTEMD_SETID_MSG
6	#endif
7	- )="";
8	+ )="pdns";
9	::arg().set("setuid","If set, change user id to this uid for more security"
10	#ifdef HAVE_SYSTEMD
11	SYSTEMD_SETID_MSG
12	#endif
13	- )="";
14	+ )="pdns_recursor";
15	::arg().set("network-timeout", "Wait this number of milliseconds for network i/o")="1500";
16	::arg().set("threads", "Launch this number of threads")="2";
17	::arg().set("distributor-threads", "Launch this number of distributor threads, distributing queries to other threads")="0";

Added Link Here

(-)b/dns/powerdns-recursor/files/patch-rec-main.cc (+18 lines)
1	--- rec-main.cc.orig 2022-05-29 14:07:40 UTC
2	+++ rec-main.cc
3	@@ -2309,13 +2309,13 @@ int main(int argc, char** argv)
4	SYSTEMD_SETID_MSG
5	#endif
6	)
7	- = "";
8	+ = "pdns";
9	::arg().set("setuid", "If set, change user id to this uid for more security"
10	#ifdef HAVE_SYSTEMD
11	SYSTEMD_SETID_MSG
12	#endif
13	)
14	- = "";
15	+ = "pdns_recursor";
16	::arg().set("network-timeout", "Wait this number of milliseconds for network i/o") = "1500";
17	::arg().set("threads", "Launch this number of threads") = "2";
18	::arg().set("distributor-threads", "Launch this number of distributor threads, distributing queries to other threads") = "0";