pdns-recursor: T9489: rebuild Debian 4.8.8 with the /etc/hosts fix

With export-etc-hosts enabled, pdns-recursor 4.8.8 only serves the first
line of /etc/hosts for a name. A name that is listed with an IPv4 and an
IPv6 address on two lines, as vyos-hostsd writes it for a DHCP lease and
a static host mapping, resolves only for one of the two address
families. Upstream fixed this in 4.9.0 (PowerDNS pull request 12203).

Build Debian's bookworm packaging of 4.8.8 (4.8.8-1+deb12u1, which
includes the CVE-2024-25590 backport) from salsa with the upstream fix
added as a patch. The commit is pinned, because Debian has no tag for
this version, only the debian/bookworm branch.

This is a bridge. 4.x is end of life upstream. Moving to the 5.4 series
needs a Rust toolchain for the build and a YAML configuration in
vyos-1x, see T9489.

4 files changed, 54 insertions, 0 deletions

diff --git a/scripts/package-build/pdns-recursor/.gitignore b/scripts/package-build/pdns-recursor/.gitignore
new file mode 100644
index 00000000..32fc80dd
--- /dev/null
+++ b/scripts/package-build/pdns-recursor/.gitignore
@@ -0,0 +1 @@
+/pdns-recursor/
diff --git a/scripts/package-build/pdns-recursor/build.py b/scripts/package-build/pdns-recursor/build.py
new file mode 120000
index 00000000..3c76af73
--- /dev/null
+++ b/scripts/package-build/pdns-recursor/build.py
@@ -0,0 +1 @@
+../build.py
\ No newline at end of file
diff --git a/scripts/package-build/pdns-recursor/package.toml b/scripts/package-build/pdns-recursor/package.toml
new file mode 100644
index 00000000..127b3b8c
--- /dev/null
+++ b/scripts/package-build/pdns-recursor/package.toml
@@ -0,0 +1,4 @@
+[[packages]]
+name = "pdns-recursor"
+commit_id = "c24eb42e31172dc71b36e822915e802f489fe9ee" # debian/bookworm, 4.8.8-1+deb12u1
+scm_url = "https://salsa.debian.org/debian/pdns-recursor.git"
diff --git a/scripts/package-build/pdns-recursor/patches/pdns-recursor/0002-Allow-multiple-records-with-same-name-for-etc-hosts.patch b/scripts/package-build/pdns-recursor/patches/pdns-recursor/0002-Allow-multiple-records-with-same-name-for-etc-hosts.patch
new file mode 100644
index 00000000..91878946
--- /dev/null
+++ b/scripts/package-build/pdns-recursor/patches/pdns-recursor/0002-Allow-multiple-records-with-same-name-for-etc-hosts.patch
@@ -0,0 +1,48 @@
+Description: Allow multiple records with the same name for /etc/hosts processing
+ With export-etc-hosts enabled, the recursor only served the first line of
+ /etc/hosts for a name. A name listed with an IPv4 and an IPv6 address on two
+ lines got only the first one, so either the A or the AAAA record was missing.
+ The records of the same name are now added to the same zone.
+Author: Sten Spans <sten@blinkenlights.nl>
+Origin: upstream, https://github.com/PowerDNS/pdns/commit/a867410a2183e64d6abe212c5abcac7cf8a95b6b
+Applied-Upstream: 4.9.0, https://github.com/PowerDNS/pdns/pull/12203
+Forwarded: not-needed
+Last-Update: 2026-10-20
+
+diff --git a/reczones-helpers.cc b/reczones-helpers.cc
+index 8f613ac92fed..daee88e6ffd8 100644
+--- a/reczones-helpers.cc
++++ b/reczones-helpers.cc
+@@ -75,17 +75,30 @@ static void makeNameToIPZone(SyncRes::domainmap_t& newMap,
+                              const ComboAddress& address,
+                              Logr::log_t log)
+ {
++  SyncRes::AuthDomain ad;
+   DNSRecord dr;
++
+   dr.d_name = hostname;
+ 
+-  SyncRes::AuthDomain ad = makeSOAAndNSNodes(dr, "localhost.");
++  if (newMap.count(hostname) != 0) {
++    ad = newMap[hostname];
++  }
++  else {
++    ad = makeSOAAndNSNodes(dr, "localhost.");
++  }
+ 
+   auto recType = address.isIPv6() ? QType::AAAA : QType::A;
+   dr.d_type = recType;
++  dr.d_ttl = 86400;
+   dr.d_content = DNSRecordContent::mastermake(recType, 1, address.toStringNoInterface());
+   ad.d_records.insert(dr);
+ 
+-  addToDomainMap(newMap, ad, dr.d_name, log);
++  if (newMap.count(hostname) != 0) {
++    newMap[ad.d_name] = ad;
++  }
++  else {
++    addToDomainMap(newMap, ad, dr.d_name, log);
++  }
+ }
+ 
+ static void makeIPToNamesZone(SyncRes::domainmap_t& newMap,