Log message:
powerdns-recursor: updated to 4.1.8

Recursor 4.1.8
Crafted query can cause a denial of service (CVE-2018-16855)

Recursor 4.1.7
Revert ‘Keep the EDNS status of a server on FormErr with EDNS’
Refuse queries for all meta-types

Recursor 4.1.6
Revert “rec: Authority records in AA=1 CNAME answer are authoritative”.

Recursor 4.1.5

PowerDNS Security Advisory 2018-04 (CVE-2018-10851)
PowerDNS Security Advisory 2018-06 (CVE-2018-14626)
PowerDNS Security Advisory 2018-07 (CVE-2018-14644)

Improvements
Add pdnslog to lua configuration scripts (Chris Hofstaedtler)
Fix compilation with libressl 2.7.0+
Export outgoing ECS value and server ID in protobuf (if any)
Switch to devtoolset 7 for el6
Allow the signature inception to be off by a number of seconds (Kees Monshouwer)

Bug Fixes
Crafted answer can cause a denial of service (CVE-2018-10851)
Packet cache pollution via crafted query (CVE-2018-14626)
Crafted query for meta-types can cause a denial of service (CVE-2018-14644)
Delay the creation of rpz threads until we have dropped privileges
Cleanup the netmask trees used for the ecs index on removals
Make sure that the ecs scope from the auth is < to the source
Authority records in aa=1 cname answer are authoritative
Avoid a memory leak in catch-all exception handler
Don’t require authoritative answers for forward-recurse zones
Release memory in case of error in the openssl ecdsa constructor
Convert a few uses to toLogString to print DNSName’s that may be empty in a \ 
safer manner
Avoid a crash on DEC Alpha systems
Clear all caches on (N)TA changes

Log message:
net/powerdns-recursor: Update to 4.1.4.

Improvements

- Split pdns_enable_unit_tests.
- Add a new max-udp-queries-per-round setting.
- Fix warnings reported by gcc 8.1.0.
- Tests: replace awk command by perl.
- Allow the snmp thread to retrieve statistics.

Bug Fixes

- Don’t account chained queries more than once.
- Make rec_control respect include-dir.
- Load lua scripts only in worker threads.
- Purge all auth/forward zone data including subtree.

Log message:
net/powerdns-recursor: Update to 4.1.3.

Improvements
- Add a subtree option to the API cache flush endpoint.
- Use a separate, non-blocking pipe to distribute queries.
- Move carbon/webserver/control/stats handling to a separate thread.
- Add _raw versions for QName / ComboAddresses to the FFI API.
- Update copyright years to 2018
- Fix a warning on botan >= 2.5.0.

Bug Fixes
- Count a lookup into an internal auth zone as a cache miss.
- Don’t increase the DNSSEC validations counters when running with
  process-no-validate.
- Respect the AXFR timeout while connecting to the RPZ server.
- Increase MTasker stacksize to avoid crash in exception unwinding
- Use the SyncRes time in our unit tests when checking cache validity
- Add -rdynamic to C{,XX}FLAGS when we build with LuaJIT.
- Delay the loading of RPZ zones until the parsing is done, fixing a
  race condition.
- Reorder includes to avoid boost L conflict.

Log message:
net/powerdns-recursor: Update to 4.1.2.

New Features
- Add FFI version of gettag().

Improvements
- Add the option to set the AXFR timeout for RPZs.
- IXFR: correct behavior of dealing with DNS Name with multiple
  records and speed up IXFR transaction.
- Add RPZ statistics endpoint to the API.

Bug Fixes
- Retry loading RPZ zones from server when they fail initially.
- Fix ECS-based cache entry refresh code.
- Fix ECS-specific NS AAAA not being returned from the cache.

Log message:
Update net/powerdns-recursor to 4.1.1.

Improvements
- Don't process records for another class than IN

Bug Fixes
- Correctly handle ancestor delegation NSEC{,3} for children.
  (CVE-2018-1000003)
- Fix the computation of the closest encloser for positive answers.
- Pass the correct buffer size to arecvfrom().
- Fix to make primeHints threadsafe, otherwise there's a small chance
  on startup that the root-server IPs will be incorrect.
- Don't validate signature for "glue" CNAME, since anything else than
  the initial CNAME can't be considered authoritative.

Log message:
Update net/powerdns-recursor to 4.1.0.
Lua support no longer optional.

PowerDNS Recursor 4.1.0
===========================================================

- Improved DNSSEC support
- Improved documentation
- Improved RPZ support
- Improved EDNS Client Subnet support
- Support for Botan 2.x (and removal of support for Botan 1.10)
- SNMP support
- Lua engine has gained access to more parts of the recursor
- CPU affinity can now be specified
- TCP Fast Open support
- New performance metrics

Full changelog:

  https://doc.powerdns.com/recursor/changelog/4.1.html

PowerDNS Recursor 4.0.7
===========================================================

- Insufficient validation of DNSSEC signatures (CVE-2017-15090)
- Cross-Site Scripting in the web interface (CVE-2017-15092)
- Configuration file injection in the API (CVE-2017-15093)
- Memory leak in DNSSEC parsing (CVE-2017-15094)

Bug fixes
- Update rec_control manpage
- Check in the detected OpenSSL/libcrypto for ECDSA
- Make more specific Netmasks < to less specific ones
- Fix validation at the exact RRSIG inception or expiration time
- Lowercase all outgoing qnames when lowercase-outgoing is set
- Fix libatomic detection on ppc64
- Edit configname definition to include the 'config-name' argument

Improvements
- Extract nested exception from Luawrapper
- Use explicit yes for default-enabled settings
- Throw an error when lua-conf-file can't be loaded
- get-remote-ring's "other" report should only have two items.
- PowerDNS sdig does not truncate trailing bits of EDNS Client Subnet
  mask
- Only increase no-packet-error on the first read
- Add support for Botan 2.x
- Add more information to recursor cache dumps
- Fix typo in two log messages
- Add help text on autodetecting systemd support
- Be more resilient with broken auths
- Remove pdns.PASS and pdns.TRUNCATE
- Improve dnsbulktest experience in travis for more robustness
- Create socket-dir from init-script
- b.root renumbering, effective 2017-10-24
- Don't retry security polling too often when it fails

Log message:
Follow some redirects.

Log message:
Update net/powerdns-recursor to 4.0.6

Bug fixes
- Use the incoming ECS for cache lookup if use-incoming-edns-subnet is
  set
- when making a netmask from a comboaddress, we neglected to zero the
  port. This could lead to a proliferation of netmasks.
- Don't take the initial ECS source for a scope one if EDNS is off
- also set d_requestor without Lua: the ECS logic needs it
- Fix IXFR skipping the additions part of the last sequence
- Treat requestor's payload size lower than 512 as equal to 512
- make URI integers 16 bits, fixes ticket #5443
- unbreak quoting

Improvements
- EDNS Client Subnet becomes compatible with the packet cache, using
  the existing variable answer facility.
- Remove just enough entries from the cache, not one more than asked
- Move expired cache entries to the front so they are expunged
- changed IPv6 addr of b.root-servers.net
- e.root-servers.net has IPv6 now
- hello decaf signers (ED25519 and ED448)
- don't use the libdecaf ed25519 signer when libsodium is enabled
  (Kees Monshouwer)
- do not hash the message in the ed25519 signer (Kees Monshouwer)
- Disable use-incoming-edns-subnet by default

Log message:
Make Bart write "I will not ignore autoconf warnings" a thousand times.
While here, don't include the configure arguments in the binary to avoid
the wrkdir references.

Log message:
Update net/powerdns-recursor to 4.0.5.

Enhancements
- Add the 2017 DNSSEC root key
- Add support for RPZ wildcarded target names.
- Speed up RPZ zone loading and add a zoneSizeHint parameter to
  rpzFile and rpzMaster for faster reloads
- Make the RPZ summary consistent and log additions/removals at debug
  level, not info
- Update Ed25519 algorithm number and mnemonic and hook up to the
  Recursor
- Add use-incoming-edns-subnet option to process and pass along ECS
  and fix some ECS bugs in the process
- Refuse to start with chroot set in a systemd env
- Handle exceptions raised by closesocket() to prevent process
  termination
- Document missing top-pub-queries and top-pub-servfail-queries
  commands for rec_control
- IPv6 address for g.root-servers.net added
- Log outgoing queries / incoming responses via protobuf

Bug fixes
- Correctly lowercase the TSIG algorithm name in hash computation
- Clear the RPZ NS IP table when clearing the policy, this prevents
  false positives
- Fix cache-only queries against a forward-zone
- Only delegate if NSes are below apex in auth-zones
- Remove hardcoding of port 53 for TCP/IP forwarded zones in recursor
- Make sure labelsToAdd is not empty in getZoneCuts()
- Wait until after daemonizing to start the outgoing protobuf thread,
  prevents hangs when the protobuf server is not available
- Ensure (re)priming the root never fails
- Don't age the root, fixes a regression from 3.x
- Fix exception when sending a protobuf message for an empty question
- LuaWrapper: Allow embedded NULs in strings received from Lua
- Fix coredumps on illumos/SmartOS
- StateHolder: Allocate (and copy if needed) before taking the lock
- SuffixMatchNode: Fix insertion issue for an existing node
- Fix negative port detection for IPv6 addresses on 32-bit systems