please backport pdns-recursor 3.3-2 from Precise

[Imre Gergely]

There is pdns-recursor 3.1.4-6ubuntu1 in Hardy, which has a major security issue (see bug #502987). This bug was fixed in pdns-recursor 3.1.7 and above for every Ubuntu release except Hardy, because it would be too much of a hassle to rewrite the code. Because of this, pdns-recursor will not be included in hardy-security (see comments 19 and 20 of above bug).

I thought at least it could be included in hardy-backports for whoever wants to upgrade. pdns-recursor 3.3 has a LOT of changes and improvements (beside this security fix) since version 3.1, so it would be a benefit to backport it to Hardy (and possibly Lucid for which I'll open a separate bugreport).

I've managed to build it locally with pbuilder and in my PPA (https://launchpad.net/~cemc/+archive/ppa/+packages), without source changes, there are only a couple of (IMHO) minor changes to debian/* . It does need the -backports repo enabled when building because of debhelper >= 7 (which is backported to Hardy). Other than that seems pretty straightforward.
I've build 3.3-1 from Oneiric two months ago, using it since on my Hardy server without problems.

[Evan Broder (broder)]

If this issue was fixed in 3.1.7, would it be acceptable to backport Lucid's pdns-recursor (3.1.7.2-1) to Hardy instead?

In order to ensure that upgrades work after you're installed a backport, we require backports to go to all intermediate releases, so a backport from Precise to Hardy would also require backports to Lucid, Maverick, Natty, and Oneiric, and all of those would require testing as well.

pdns-recursor 3.1.7.2-1 also hadn't been updated to use debhelper 8 or source format 3.0, so it should be backportable with no source changes.

If you're still interested in backporting 3.3-2, that's fine, but please also test the backports to Lucid, Maverick, Natty, and Oneiric. There is a tool in the ubuntu-dev-tools package, backportpackage, that can help with this testing.

[Imre Gergely (cemc)]

Sure thing, I'm interested in backporting 3.3-2 to all releases. Should I open a separate bugreport for every release?

Backporting Lucid's 3.1.7 doesn't make much sense (IMHO), because that would mean we're backporting only for this one security fix, which - as I understand - isn't the main reason to backport packages for. But backportint pdns 3.3 would indeed be a very good reason, a LOT has been rewritten since 3.1 in pdns, lots of new features, etc. It would be a shame not to have that in Lucid and Hardy (as they are LTS releases), still used on many servers.

As far as I can see, version 3.3-2 needs debhelper >=7 which is present in releases Lucid and above. In Hardy it's in -backports.

I've just uploaded pdns 3.3-2 for Lucid to my PPA, and it built ok. I don't expect any problems on Mav, Natty or Oneiric either.

[Evan Broder (broder)]

Sounds good. You don't need to open separate bugs, just add new "tasks" to this bug - which I've gone ahead and done.

Since pdns-recursor doesn't have any reverse-dependencies, all we need from you is verification that the package successfully builds, installs, and runs on each release. And for any releases where you have to modify the source package, please attach the diff to this bug so that we can find it easily.

For Hardy, if the packages you need are all already in -backports, you shouldn't have to modify them - builds should use packages from backports if necessary to resolve build-dependencies. You can test this by going to your PPA, choosing "Edit PPA dependencies" from the top-right, and selecting "Backports" for Ubuntu dependencies. Re-testing a no-change Hardy backport under this configuration would be ideal, as we prefer to do no-change backports when possible.

For each release that you've verified, you can change the status of the bug task to Confirmed, which will let us know that you've done the testing. In the mean time, I'm going to change them to Incomplete, which lets us keep track of which requests haven't been evaluated by the backporters team.

[Imre Gergely (cemc)]

Note on Hardy backport: in pdns-recursor 3.3-2, three things need changing:

- debian/source/format: lowered to 1.0
- debian/control: lowered builddep for debhelper (in Precise there's Build-Dep: debhelper >= 7.0.50~ , but in hardy-backports there's only debhelper 7.0.13 present, so I've changed Build-Dep to debhelper >= 7)
- debian/rules: dropped --parallel option from dh (there's no --parallel option in debhelper 7), but this shouldn't be a problem.

No other changes were made to anything else in the source package.

No other changes were made for Lucid, Mav, Natty, Oneiric backporting.

Everything built OK in my PPA. I'll test the packages to see that they install/upgrade/work and update the bugreport.

[Micah Gersten (micahg)]

Since there are override targets (i.e. override_dh_install) in
debian/rules, you'll need to remove those and revert to the old style
targets since debhelper is < 7.0.50~.

[Evan Broder (broder)]

We can still use dh(1) for debhelper 7.old; it's just the uglier and less-intuitive form of dh(1).

Patch to convert to that syntax attached. I've uploaded a test build to my PPA (https://launchpad.net/~broder/+archive/backports-tests).

[Evan Broder (broder)]

Ah, that didn't work - Hardy is older than I thought :)

Here's a new patch. Same deal - test build has been uploaded; keep an eye on it.

[Evan Broder (broder)]

Ok, apparently quilt didn't work that way back then. So here's take 3. This time I waited until the build finished, so I know that worked. All it needs now is testing.

[Imre Gergely (cemc)]

Tested package from your PPA on Hardy. When installing/upgrading to it, I get the following error:

Preparing to replace pdns-recursor 3.1.4-6ubuntu1 (using .../pdns-recursor_3.3-2~hardy1~ppa3_i386.deb) ...
 * Stopping PowerDNS recursor pdns-recursor [ OK ]
Unpacking replacement pdns-recursor ...
Setting up liblua5.1-0 (5.1.2-4) ...

Setting up pdns-recursor (3.3-2~hardy1~ppa3) ...
Installing new version of config file /etc/powerdns/recursor.conf ...
Installing new version of config file /etc/logcheck/ignore.d.server/pdns-recursor ...
Installing new version of config file /etc/init.d/pdns-recursor ...
update-rc.d: error: codenumber must be a number between 0 and 99
usage: update-rc.d [-n] [-f] <basename> remove
       update-rc.d [-n] <basename> defaults|multiuser [NN | sNN kNN]
       update-rc.d [-n] <basename> start|stop NN runlvl [runlvl] [...] .
                -n: not really
                -f: force
dpkg: error processing pdns-recursor (--configure):
 subprocess post-installation script returned error exit status 1
Processing triggers for libc6 ...
ldconfig deferred processing now taking place
Errors were encountered while processing:
 pdns-recursor
E: Sub-process /usr/bin/dpkg returned an error code (1)

After starting it manually, it runs ok:

root@hhs32-pdns:/etc/powerdns# /etc/init.d/pdns-recursor start
 * Starting PowerDNS recursor pdns-recursor [ OK ]

root@hhs32-pdns:/etc/powerdns# dig +short ubuntu.com @localhost
91.189.94.156

root@hhs32-pdns:/etc/powerdns# dig +short chaos txt version.bind @localhost
"PowerDNS Recursor 3.3 $Id: pdns_recursor.cc 1712 2010-09-11 13:40:03Z ahu $"

root@hhs32-pdns:/etc/powerdns# apt-cache policy pdns-recursor
pdns-recursor:
  Installed: 3.3-2~hardy1~ppa3
  Candidate: 3.3-2~hardy1~ppa3
  Version table:
 *** 3.3-2~hardy1~ppa3 0
        500 http://ppa.launchpad.net hardy/main Packages
        100 /var/lib/dpkg/status
     3.1.4-6ubuntu1 0
        500 http://ro.archive.ubuntu.com hardy/universe Packages

[Imre Gergely (cemc)]

Tested backported package (no-change) from my PPA, it installs/upgrades without issues and it's working OK.

root@lls32-pdns:~# dig +short ubuntu.com @localhost
91.189.94.156

root@lls32-pdns:~# dig +short chaos txt version.bind @localhost
"PowerDNS Recursor 3.3 $Id: pdns_recursor.cc 1712 2010-09-11 13:40:03Z ahu $"

root@lls32-pdns:~# apt-cache policy pdns-recursor
pdns-recursor:
  Installed: 3.3-2~lucid1~ppa1
  Candidate: 3.3-2~lucid1~ppa1
  Version table:
 *** 3.3-2~lucid1~ppa1 0
        500 http://ppa.launchpad.net/cemc/ppa/ubuntu/ lucid/main Packages
        100 /var/lib/dpkg/status
     3.1.7.2-1 0
        500 http://ro.archive.ubuntu.com/ubuntu/ lucid/universe Packages

[Imre Gergely (cemc)]

Tested and working on Maverick, Natty and Oneiric. All packages are no-change backports from Precise (3.3-2)

Maverick:

gimre@mms32-pdns:~$ dig +short ubuntu.com @localhost
91.189.94.156
gimre@mms32-pdns:~$ dig +short chaos txt version.bind @localhost
"PowerDNS Recursor 3.3 $Id: pdns_recursor.cc 1712 2010-09-11 13:40:03Z ahu $"
gimre@mms32-pdns:~$ apt-cache policy pdns-recursor
pdns-recursor:
  Installed: 3.3-2~maverick1~ppa1
  Candidate: 3.3-2~maverick1~ppa1
  Version table:
 *** 3.3-2~maverick1~ppa1 0
        500 http://ppa.launchpad.net/cemc/ppa/ubuntu/ maverick/main i386 Packages
        100 /var/lib/dpkg/status
     3.2-2 0
        500 http://ro.archive.ubuntu.com/ubuntu/ maverick/universe i386 Packages

Natty:

gimre@nns32-pdns:~$ dig +short ubuntu.com @localhost
91.189.94.156
gimre@nns32-pdns:~$ dig +short chaos txt version.bind @localhost
"PowerDNS Recursor 3.3 $Id: pdns_recursor.cc 1712 2010-09-11 13:40:03Z ahu $"
gimre@nns32-pdns:~$ sudo apt-cache policy pdns-recursor
pdns-recursor:
  Installed: 3.3-2~natty1~ppa1
  Candidate: 3.3-2~natty1~ppa1
  Version table:
 *** 3.3-2~natty1~ppa1 0
        500 http://ppa.launchpad.net/cemc/ppa/ubuntu/ natty/main i386 Packages
        100 /var/lib/dpkg/status
     3.2-4 0
        500 http://ro.archive.ubuntu.com/ubuntu/ natty/universe i386 Packages

Oneiric:

gimre@oos32-pdns:~$ dig +short ubuntu.com @localhost
91.189.94.156
gimre@oos32-pdns:~$ dig +short chaos txt version.bind @localhost
"PowerDNS Recursor 3.3 $Id: pdns_recursor.cc 1712 2010-09-11 13:40:03Z ahu $"
gimre@oos32-pdns:~$ sudo apt-cache policy pdns-recursor
pdns-recursor:
  Installed: 3.3-2~oneiric1~ppa1
  Candidate: 3.3-2~oneiric1~ppa1
  Version table:
 *** 3.3-2~oneiric1~ppa1 0
        500 http://ppa.launchpad.net/cemc/ppa/ubuntu/ oneiric/main i386 Packages
        100 /var/lib/dpkg/status
     3.3-1 0
        500 http://ro.archive.ubuntu.com/ubuntu/ oneiric/universe i386 Packages

[Evan Broder (broder)]

Thanks for testing, Imre.

ACK from backporters for Lucid, Maverick, Natty, and Oneiric while we continue to work on what went wrong with Hardy.

[Evan Broder (broder)]

Newest version of the patch corrects my incorrect coding of the old-style dh sequence. Builds are in my PPA.

[Imre Gergely (cemc)]

This time I got no error messages at install/upgrade, and it seems to work ok on Hardy, too.

root@hhs32-pdns:~# dig +short chaos txt version.bind @localhost
"PowerDNS Recursor 3.3 $Id: pdns_recursor.cc 1712 2010-09-11 13:40:03Z ahu $"

root@hhs32-pdns:~# dig +short ubuntu.com @localhost
91.189.94.156

root@hhs32-pdns:~# apt-cache policy pdns-recursor
pdns-recursor:
  Installed: 3.3-2~hardy1~ppa4
  Candidate: 3.3-2~hardy1~ppa4
  Version table:
 *** 3.3-2~hardy1~ppa4 0
        500 http://ppa.launchpad.net hardy/main Packages
        100 /var/lib/dpkg/status
     3.1.4-6ubuntu1 0
        500 http://ro.archive.ubuntu.com hardy/universe Packages

[Steve Langasek (vorlon)]

I: Extracting pdns-recursor_3.3-2.dsc ... done.
I: Building backport of pdns-recursor as 3.3-2~lucid1 ... done.

[Steve Langasek (vorlon)]

I: Extracting pdns-recursor_3.3-2.dsc ... done.
I: Building backport of pdns-recursor as 3.3-2~maverick1 ... done.

[Steve Langasek (vorlon)]

I: Extracting pdns-recursor_3.3-2.dsc ... done.
I: Building backport of pdns-recursor as 3.3-2~natty1 ... done.

[Steve Langasek (vorlon)]

I: Extracting pdns-recursor_3.3-2.dsc ... done.
I: Building backport of pdns-recursor as 3.3-2~oneiric1 ... done.

[Evan Broder (broder)]

The Hardy backport was accepted and published. Thanks to pitti and adconrad for their help.

[Imre Gergely (cemc)]

Thank you all!