From f284088e8df7357159c49a70693e7a332f51d26a Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Thu, 25 Jun 2026 21:58:55 +0200
Subject: [PATCH] nsd: 4.12.0 -> 4.14.3

We were severely behind on NSD, update to the latest version. 4.14.3 is
a security release that fixes several CVEs, but all of them were
introduced after 4.12.0, so to my knowledge there are no known security
issues with the previous packaged version, so landing this change is not
security-sensitive.

Upstream added a new configure option, --enable-dnstap, which is enabled
by default, so I enabled it by default here too. I didn't tie it to a
NixOS configuration setting because I don't personally use that part and
there is a todo about it, so let's keep the change surface minimal.
---
 pkgs/by-name/ns/nsd/package.nix | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/ns/nsd/package.nix b/pkgs/by-name/ns/nsd/package.nix
index e60228f1b7ce..7955413208a5 100644
--- a/pkgs/by-name/ns/nsd/package.nix
+++ b/pkgs/by-name/ns/nsd/package.nix
@@ -2,9 +2,12 @@
   lib,
   stdenv,
   fetchurl,
+  fstrm,
   libevent,
   openssl,
   pkg-config,
+  protobuf,
+  protobufc,
   systemdMinimal,
   nixosTests,
   config,
@@ -14,37 +17,42 @@
   bind8Stats ? config.nsd.bind8Stats or false,
   checking ? config.nsd.checking or false,
   ipv6 ? config.nsd.ipv6 or true,
-  mmap ? config.nsd.mmap or false,
   minimalResponses ? config.nsd.minimalResponses or true,
+  mmap ? config.nsd.mmap or false,
   nsec3 ? config.nsd.nsec3 or true,
   ratelimit ? config.nsd.ratelimit or false,
   recvmmsg ? config.nsd.recvmmsg or false,
   rootServer ? config.nsd.rootServer or false,
   rrtypes ? config.nsd.rrtypes or false,
   zoneStats ? config.nsd.zoneStats or false,
+  withDnstap ? true,
   withSystemd ? config.nsd.withSystemd or (lib.meta.availableOn stdenv.hostPlatform systemdMinimal),
   configFile ? config.nsd.configFile or "/etc/nsd/nsd.conf",
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nsd";
-  version = "4.12.0";
+  version = "4.14.3";
 
   src = fetchurl {
     url = "https://www.nlnetlabs.nl/downloads/nsd/nsd-${finalAttrs.version}.tar.gz";
-    hash = "sha256-+ezCz3m6UFgPLfYpGO/EQAhMW/EQV9tEwZqpZDzUteg=";
+    hash = "sha256-limtZNnBsBm74iKW1RSNeuZfWIziZaZCR1B0DwUrsSs=";
   };
 
   nativeBuildInputs = [
     pkg-config
-  ];
+  ]
+  ++ lib.optionals withDnstap [ protobuf ];
 
   buildInputs = [
     libevent
     openssl
   ]
-  ++ lib.optionals withSystemd [
-    systemdMinimal
+  ++ lib.optionals withSystemd [ systemdMinimal ]
+  ++ lib.optionals withDnstap [
+    fstrm
+    # NSD links against libprotobuf-c, it's not just a build-time dependency.
+    protobufc
   ];
 
   enableParallelBuilding = true;
@@ -73,6 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ edf rootServer "root-server"
     ++ edf rrtypes "draft-rrtypes"
     ++ edf zoneStats "zone-stats"
+    ++ edf withDnstap "dnstap"
     ++ edf withSystemd "systemd"
     ++ [
       "--with-ssl=${openssl.dev}"