From 90c813529cf48d93e4391892338b91db74af5936 Mon Sep 17 00:00:00 2001 From: shibby Date: Wed, 25 Nov 2015 00:04:54 +0700 Subject: [PATCH] dnsmasq: update to 2.73 (23.06.2015) Source: https://github.com/guns/dnsmasq This commit include all changes between 9 Dec 2014 and 15 Jun 2015 --- release/src/router/Makefile | 2 +- release/src/router/dnsmasq/.gitignore | 2 +- release/src/router/dnsmasq/CHANGELOG | 134 +- release/src/router/dnsmasq/Makefile | 21 +- release/src/router/dnsmasq/PKGBUILD | 38 + release/src/router/dnsmasq/README.markdown | 13 + release/src/router/dnsmasq/VERSION | 2 +- release/src/router/dnsmasq/bld/Android.mk | 2 +- release/src/router/dnsmasq/bld/get-version | 7 +- .../src/router/dnsmasq/contrib/guns/cache/Rakefile | 116 + .../router/dnsmasq/contrib/guns/conf/dnsmasq.conf | 54 + .../router/dnsmasq/contrib/guns/conf/resolv.conf | 12 + release/src/router/dnsmasq/contrib/guns/dnsmasq.rc | 36 + .../router/dnsmasq/contrib/guns/dnsmasq.service | 13 + .../src/router/dnsmasq/contrib/reverse-dns/README | 18 + .../dnsmasq/contrib/reverse-dns/reverse_replace.sh | 125 + .../src/router/dnsmasq/contrib/wrt/dhcp_release.c | 5 + release/src/router/dnsmasq/dbus/DBus-interface | 74 + release/src/router/dnsmasq/debian/changelog | 23 +- release/src/router/dnsmasq/debian/control | 2 - release/src/router/dnsmasq/debian/copyright | 2 +- release/src/router/dnsmasq/debian/init | 4 +- release/src/router/dnsmasq/debian/rules | 30 +- release/src/router/dnsmasq/debian/systemd.service | 12 +- release/src/router/dnsmasq/dnsmasq.conf.example | 18 + release/src/router/dnsmasq/dnsmasq.install | 9 + release/src/router/dnsmasq/doc.html | 4 +- release/src/router/dnsmasq/man/dnsmasq.8 | 76 +- release/src/router/dnsmasq/man/es/dnsmasq.8 | 12 +- release/src/router/dnsmasq/man/fr/dnsmasq.8 | 4715 ++++++++++---------- release/src/router/dnsmasq/po/de.po | 1401 +++--- release/src/router/dnsmasq/po/es.po | 926 ++-- release/src/router/dnsmasq/po/fi.po | 913 ++-- release/src/router/dnsmasq/po/fr.po | 928 ++-- release/src/router/dnsmasq/po/id.po | 941 ++-- release/src/router/dnsmasq/po/it.po | 914 ++-- release/src/router/dnsmasq/po/no.po | 925 ++-- release/src/router/dnsmasq/po/pl.po | 1724 +++---- release/src/router/dnsmasq/po/pt_BR.po | 913 ++-- release/src/router/dnsmasq/po/ro.po | 1345 +++--- release/src/router/dnsmasq/src/auth.c | 73 +- release/src/router/dnsmasq/src/blockdata.c | 2 +- release/src/router/dnsmasq/src/bpf.c | 4 +- release/src/router/dnsmasq/src/cache.c | 193 +- release/src/router/dnsmasq/src/config.h | 18 +- release/src/router/dnsmasq/src/conntrack.c | 2 +- release/src/router/dnsmasq/src/dbus.c | 197 +- release/src/router/dnsmasq/src/dhcp-common.c | 6 +- release/src/router/dnsmasq/src/dhcp-protocol.h | 2 +- release/src/router/dnsmasq/src/dhcp.c | 62 +- release/src/router/dnsmasq/src/dhcp6-protocol.h | 2 +- release/src/router/dnsmasq/src/dhcp6.c | 40 +- release/src/router/dnsmasq/src/dns-protocol.h | 24 +- release/src/router/dnsmasq/src/dnsmasq.c | 183 +- release/src/router/dnsmasq/src/dnsmasq.h | 80 +- release/src/router/dnsmasq/src/dnssec.c | 563 ++- release/src/router/dnsmasq/src/domain.c | 2 +- release/src/router/dnsmasq/src/forward.c | 576 ++- release/src/router/dnsmasq/src/helper.c | 2 +- release/src/router/dnsmasq/src/inotify.c | 238 + release/src/router/dnsmasq/src/ip6addr.h | 2 +- release/src/router/dnsmasq/src/ipset.c | 8 +- release/src/router/dnsmasq/src/lease.c | 10 +- release/src/router/dnsmasq/src/log.c | 2 +- release/src/router/dnsmasq/src/loop.c | 7 +- release/src/router/dnsmasq/src/netlink.c | 10 +- release/src/router/dnsmasq/src/network.c | 23 +- release/src/router/dnsmasq/src/option.c | 158 +- release/src/router/dnsmasq/src/outpacket.c | 2 +- release/src/router/dnsmasq/src/radv-protocol.h | 2 +- release/src/router/dnsmasq/src/radv.c | 151 +- release/src/router/dnsmasq/src/rfc1035.c | 190 +- release/src/router/dnsmasq/src/rfc2131.c | 86 +- release/src/router/dnsmasq/src/rfc3315.c | 19 +- release/src/router/dnsmasq/src/slaac.c | 2 +- release/src/router/dnsmasq/src/tables.c | 2 +- release/src/router/dnsmasq/src/tftp.c | 4 +- release/src/router/dnsmasq/src/util.c | 75 +- 78 files changed, 11380 insertions(+), 8153 deletions(-) create mode 100644 release/src/router/dnsmasq/PKGBUILD create mode 100644 release/src/router/dnsmasq/README.markdown create mode 100644 release/src/router/dnsmasq/contrib/guns/cache/Rakefile create mode 100644 release/src/router/dnsmasq/contrib/guns/conf/dnsmasq.conf create mode 100644 release/src/router/dnsmasq/contrib/guns/conf/resolv.conf create mode 100644 release/src/router/dnsmasq/contrib/guns/dnsmasq.rc create mode 100644 release/src/router/dnsmasq/contrib/guns/dnsmasq.service create mode 100644 release/src/router/dnsmasq/contrib/reverse-dns/README create mode 100644 release/src/router/dnsmasq/contrib/reverse-dns/reverse_replace.sh create mode 100644 release/src/router/dnsmasq/dnsmasq.install rewrite release/src/router/dnsmasq/man/fr/dnsmasq.8 (74%) create mode 100644 release/src/router/dnsmasq/src/inotify.c diff --git a/release/src/router/Makefile b/release/src/router/Makefile index d6896e2446..e8f10546fa 100644 --- a/release/src/router/Makefile +++ b/release/src/router/Makefile @@ -696,7 +696,7 @@ bridge-install: dnsmasq: @$(SEP) @$(MAKE) -C dnsmasq \ - COPTS="$(if $(TCONFIG_IPV6),-DUSE_IPV6,-DNO_IPV6 -DNO_IPSET) -DHAVE_BROKEN_RTC -DHAVE_TOMATO $(EXTRACFLAGS) -ffunction-sections -fdata-sections" \ + COPTS="$(if $(TCONFIG_IPV6),-DUSE_IPV6,-DNO_IPV6 -DNO_IPSET) -DNO_INOTIFY -DHAVE_BROKEN_RTC -DHAVE_TOMATO $(EXTRACFLAGS) -ffunction-sections -fdata-sections" \ LDFLAGS="-ffunction-sections -fdata-sections -Wl,--gc-sections -fPIC" dnsmasq-install: diff --git a/release/src/router/dnsmasq/.gitignore b/release/src/router/dnsmasq/.gitignore index fcdbcbd135..23f11488ab 100644 --- a/release/src/router/dnsmasq/.gitignore +++ b/release/src/router/dnsmasq/.gitignore @@ -3,7 +3,7 @@ src/*.mo src/dnsmasq.pot src/dnsmasq src/dnsmasq_baseline -src/.configured +src/.copts_* contrib/wrt/dhcp_lease_time contrib/wrt/dhcp_release debian/base/ diff --git a/release/src/router/dnsmasq/CHANGELOG b/release/src/router/dnsmasq/CHANGELOG index e6d4a97356..99793e5db8 100644 --- a/release/src/router/dnsmasq/CHANGELOG +++ b/release/src/router/dnsmasq/CHANGELOG @@ -2,8 +2,140 @@ version 2.73 Fix crash at startup when an empty suffix is supplied to --conf-dir, also trivial memory leak. Thanks to Tomas Hozza for spotting this. + + Remove floor of 4096 on advertised EDNS0 packet size when + DNSSEC in use, the original rationale for this has long gone. + Thanks to Anders Kaseorg for spotting this. + + Use inotify for checking on updates to /etc/resolv.conf and + friends under Linux. This fixes race conditions when the files are + updated rapidly and saves CPU by noy polling. To build + a binary that runs on old Linux kernels without inotify, + use make COPTS=-DNO_INOTIFY + + Fix breakage of --domain=,,local - only reverse + queries were intercepted. THis appears to have been broken + since 2.69. Thanks to Josh Stone for finding the bug. + + Eliminate IPv6 privacy addresses and deprecated addresses from + the answers given by --interface-name. Note that reverse queries + (ie looking for names, given addresses) are not affected. + Thanks to Michael Gorbach for the suggestion. + + Fix crash in DNSSEC code with long RRs. Thanks to Marco Davids + for the bug report. + + Add --ignore-address option. Ignore replies to A-record + queries which include the specified address. No error is + generated, dnsmasq simply continues to listen for another + reply. This is useful to defeat blocking strategies which + rely on quickly supplying a forged answer to a DNS + request for certain domains, before the correct answer can + arrive. Thanks to Glen Huang for the patch. + Revisit the part of DNSSEC validation which determines if an + unsigned answer is legit, or is in some part of the DNS + tree which should be signed. Dnsmasq now works from the + DNS root downward looking for the limit of signed + delegations, rather than working bottom up. This is + both more correct, and less likely to trip over broken + nameservers in the unsigned parts of the DNS tree + which don't respond well to DNSSEC queries. + + Add --log-queries=extra option, which makes logs easier + to search automatically. + + Add --min-cache-ttl option. I've resisted this for a long + time, on the grounds that disbelieving TTLs is never a + good idea, but I've been persuaded that there are + sometimes reasons to do it. (Step forward, GFW). + To avoid misuse, there's a hard limit on the TTL + floor of one hour. Thansk to RinSatsuki for the patch. + + Cope with multiple interfaces with the same link-local + address. (IPv6 addresses are scoped, so this is allowed.) + Thanks to Cory Benfield for help with this. + + Add --dhcp-hostsdir. This allows addition of new host + configurations to a running dnsmasq instance much more + cheaply than having dnsmasq re-read all its existing + configuration each time. + + Don't reply to DHCPv6 SOLICIT messages if we're not + configured to do stateful DHCPv6. Thanks to Win King Wan + for the patch. + + Fix broken DNSSEC validation of ECDSA signatures. + + Add --dnssec-timestamp option, which provides an automatic + way to detect when the system time becomes valid after + boot on systems without an RTC, whilst allowing DNS + queries before the clock is valid so that NTP can run. + Thanks to Kevin Darbyshire-Bryant for developing this idea. + + Add --tftp-no-fail option. Thanks to Stefan Tomanek for + the patch. + Fix crash caused by looking up servers.bind, CHAOS text + record, when more than about five --servers= lines are + in the dnsmasq config. This causes memory corruption + which causes a crash later. Thanks to Matt Coddington for + sterling work chasing this down. + + Fix crash on receipt of certain malformed DNS requests. + Thanks to Nick Sampanis for spotting the problem. + Note that this is could allow the dnsmasq process's + memory to be read by an attacker under certain + circumstances, so it has a CVE, CVE-2015-3294 + + Fix crash in authoritative DNS code, if a .arpa zone + is declared as authoritative, and then a PTR query which + is not to be treated as authoritative arrived. Normally, + directly declaring .arpa zone as authoritative is not + done, so this crash wouldn't be seen. Instead the + relevant .arpa zone should be specified as a subnet + in the auth-zone declaration. Thanks to Johnny S. Lee + for the bugreport and initial patch. + + Fix authoritative DNS code to correctly reply to NS + and SOA queries for .arpa zones for which we are + declared authoritative by means of a subnet in auth-zone. + Previously we provided correct answers to PTR queries + in such zones (including NS and SOA) but not direct + NS and SOA queries. Thanks to Johnny S. Lee for + pointing out the problem. + + Fix logging of DHCPREPLY which should be suppressed + by quiet-dhcp6. Thanks to J. Pablo Abonia for + spotting the problem. + + Try and handle net connections with broken fragmentation + that lose large UDP packets. If a server times out, + reduce the maximum UDP packet size field in the EDNS0 + header to 1280 bytes. If it then answers, make that + change permanent. + + Check IPv4-mapped IPv6 addresses when --stop-rebind + is active. Thanks to Jordan Milne for spotting this. + + Allow DHCPv4 options T1 and T2 to be set using --dhcp-option. + Thanks to Kevin Benton for patches and work on this. + + Fix code for DHCPCONFIRM DHCPv6 messages to confirm addresses + in the correct subnet, even of not in dynamic address + allocation range. Thanks to Steve Hirsch for spotting + the problem. + + Add AddDhcpLease and DeleteDhcpLease DBus methods. Thanks + to Nicolas Cavallari for the patch. + + Allow configuration of router advertisements without the + "on-link" bit set. Thanks to Neil Jerram for the patch. + + Extend --bridge-interface to DHCPv6 and router + advertisements. Thanks to Neil Jerram for the patch. + + version 2.72 Add ra-advrouter mode, for RFC-3775 mobile IPv6 support. @@ -47,7 +179,7 @@ version 2.72 Fix problem with --local-service option on big-endian platforms Thanks to Richard Genoud for the patch. - + version 2.71 Subtle change to error handling to help DNSSEC validation when servers fail to provide NODATA answers for diff --git a/release/src/router/dnsmasq/Makefile b/release/src/router/dnsmasq/Makefile index 76aad7ca29..59750bcb74 100644 --- a/release/src/router/dnsmasq/Makefile +++ b/release/src/router/dnsmasq/Makefile @@ -1,4 +1,4 @@ -# dnsmasq is Copyright (c) 2000-2014 Simon Kelley +# dnsmasq is Copyright (c) 2000-2015 Simon Kelley # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by @@ -65,11 +65,16 @@ gmp_libs = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC NO_GMP --cop sunos_libs = `if uname | grep SunOS >/dev/null 2>&1; then echo -lsocket -lnsl -lposix4; fi` version = -DVERSION='\"`$(top)/bld/get-version $(top)`\"' +sum?=$(shell $(CC) -DDNSMASQ_COMPILE_OPTS $(COPTS) -E $(top)/$(SRC)/dnsmasq.h | ( md5sum 2>/dev/null || md5 ) | cut -f 1 -d ' ') +sum!=$(CC) -DDNSMASQ_COMPILE_OPTS $(COPTS) -E $(top)/$(SRC)/dnsmasq.h | ( md5sum 2>/dev/null || md5 ) | cut -f 1 -d ' ' +copts_conf = .copts_$(sum) + objs = cache.o rfc1035.o util.o option.o forward.o network.o \ dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o \ helper.o tftp.o log.o conntrack.o dhcp6.o rfc3315.o \ dhcp-common.o outpacket.o radv.o slaac.o auth.o ipset.o \ - domain.o dnssec.o blockdata.o tables.o loop.o + domain.o dnssec.o blockdata.o tables.o loop.o inotify.o + hdrs = dnsmasq.h config.h dhcp-protocol.h dhcp6-protocol.h \ dns-protocol.h radv-protocol.h ip6addr.h @@ -82,7 +87,7 @@ all : $(BUILDDIR) mostly_clean : rm -f $(BUILDDIR)/*.mo $(BUILDDIR)/*.pot - rm -f $(BUILDDIR)/.configured $(BUILDDIR)/*.o $(BUILDDIR)/dnsmasq.a $(BUILDDIR)/dnsmasq + rm -f $(BUILDDIR)/.copts_* $(BUILDDIR)/*.o $(BUILDDIR)/dnsmasq.a $(BUILDDIR)/dnsmasq clean : mostly_clean rm -f $(BUILDDIR)/dnsmasq_baseline @@ -112,7 +117,7 @@ install-i18n : all-i18n install-common cd $(MAN); ../bld/install-man $(DESTDIR)$(MANDIR) $(INSTALL) merge : - @cd $(BUILDDIR) && $(MAKE) -f $(top)/Makefile dnsmasq.pot + @cd $(BUILDDIR) && $(MAKE) top="$(top)" -f $(top)/Makefile dnsmasq.pot for f in `cd $(PO); echo *.po`; do \ echo -n msgmerge $(PO)/$$f && $(MSGMERGE) --no-wrap -U $(PO)/$$f $(BUILDDIR)/dnsmasq.pot; \ done @@ -138,17 +143,19 @@ bloatcheck : $(BUILDDIR)/dnsmasq_baseline mostly_clean all # rules below are targets in recusive makes with cwd=$(BUILDDIR) -.configured: $(hdrs) - @rm -f *.o +$(copts_conf): $(hdrs) + @rm -f *.o .copts_* @touch $@ $(objs:.o=.c) $(hdrs): ln -s $(top)/$(SRC)/$@ . +$(objs): $(copts_conf) $(hdrs) + .c.o: $(CC) $(CFLAGS) $(COPTS) $(i18n) $(build_cflags) $(RPM_OPT_FLAGS) -c $< -dnsmasq : .configured $(hdrs) $(objs) +dnsmasq : $(objs) $(CC) $(LDFLAGS) -o $@ $(objs) $(build_libs) $(LIBS) dnsmasq.pot : $(objs:.o=.c) $(hdrs) diff --git a/release/src/router/dnsmasq/PKGBUILD b/release/src/router/dnsmasq/PKGBUILD new file mode 100644 index 0000000000..c98e3b3885 --- /dev/null +++ b/release/src/router/dnsmasq/PKGBUILD @@ -0,0 +1,38 @@ +# Maintainer: Sung Pae +pkgname=dnsmasq-nerv +pkgver= +pkgrel=1 +pkgdesc="Custom dnsmasq build" +arch=('x86_64') +url="https://github.com/guns/dnsmasq" +license=('GPL') +groups=('nerv') +backup=('etc/dnsmasq/Rakefile' + 'etc/dnsmasq/dnsmasq.conf' + 'etc/dnsmasq/hosts' + 'etc/dnsmasq/resolv.conf') +depends=('glibc' 'libidn') +install=dnsmasq.install +makedepends=('git') +provides=('dnsmasq') +conflicts=('dnsmasq') +replaces=('dnsmasq-guns') + +envmake() { + DESTDIR="$pkgdir/" PREFIX=/usr BINDIR=/usr/bin RCDIR= \ + make -e -j $(grep -c ^processor /proc/cpuinfo) "$@" +} + +pkgver() { + printf %s "$(git describe --long | tr - .)" +} + +build() { + cd "$startdir" + envmake all-i18n +} + +package() { + cd "$startdir" + envmake install +} diff --git a/release/src/router/dnsmasq/README.markdown b/release/src/router/dnsmasq/README.markdown new file mode 100644 index 0000000000..0529e6fa8c --- /dev/null +++ b/release/src/router/dnsmasq/README.markdown @@ -0,0 +1,13 @@ +This is a __personal fork__ of dnsmasq, and is updated by hand. Simon Kelley's +official homepage for dnsmasq is located at: + +http://www.thekelleys.org.uk/dnsmasq/doc.html + +and the official repository may be cloned with + +``` +git clone git://thekelleys.org.uk/dnsmasq.git +``` + +Please do not clone or use this repository if you are not interested in my +personal alterations. You will be better served by tracking the URL above. diff --git a/release/src/router/dnsmasq/VERSION b/release/src/router/dnsmasq/VERSION index cd08c7d802..c3d7d43687 100644 --- a/release/src/router/dnsmasq/VERSION +++ b/release/src/router/dnsmasq/VERSION @@ -1 +1 @@ -v2.72+ December 9 2014 +v2.73 Jun 23, 2015 diff --git a/release/src/router/dnsmasq/bld/Android.mk b/release/src/router/dnsmasq/bld/Android.mk index d1e80afa29..6ea604faae 100644 --- a/release/src/router/dnsmasq/bld/Android.mk +++ b/release/src/router/dnsmasq/bld/Android.mk @@ -10,7 +10,7 @@ LOCAL_SRC_FILES := bpf.c cache.c dbus.c dhcp.c dnsmasq.c \ dhcp6.c rfc3315.c dhcp-common.c outpacket.c \ radv.c slaac.c auth.c ipset.c domain.c \ dnssec.c dnssec-openssl.c blockdata.c tables.c \ - loop.c + loop.c inotify.c LOCAL_MODULE := dnsmasq diff --git a/release/src/router/dnsmasq/bld/get-version b/release/src/router/dnsmasq/bld/get-version index c246a3cc6a..5372869c08 100755 --- a/release/src/router/dnsmasq/bld/get-version +++ b/release/src/router/dnsmasq/bld/get-version @@ -11,8 +11,9 @@ # If there is more than one v[0-9].* tag, sort them and use the # first. This favours, eg v2.63 over 2.63rc6. -if which git >/dev/null 2>&1 && [ -d $1/.git ]; then - cd $1; git describe | sed 's/^v//' +if which git >/dev/null 2>&1 && \ + ([ -d $1/.git ] || grep '^gitdir:' $1/.git >/dev/null 2>&1); then + cd $1; git describe | sed 's/^v//' elif grep '\$Format:%d\$' $1/VERSION >/dev/null 2>&1; then # unsubstituted VERSION, but no git available. echo UNKNOWN @@ -20,7 +21,7 @@ else vers=`cat $1/VERSION | sed 's/[(), ]/,/ g' | tr ',' '\n' | grep ^v[0-9]` if [ $? -eq 0 ]; then - echo "${vers}" | sort | head -n 1 | sed 's/^v//' + echo "${vers}" | sort -r | head -n 1 | sed 's/^v//' else cat $1/VERSION fi diff --git a/release/src/router/dnsmasq/contrib/guns/cache/Rakefile b/release/src/router/dnsmasq/contrib/guns/cache/Rakefile new file mode 100644 index 0000000000..63cd183f9d --- /dev/null +++ b/release/src/router/dnsmasq/contrib/guns/cache/Rakefile @@ -0,0 +1,116 @@ +# -*- encoding: utf-8 -*- + +task :default => :dump + +desc 'Dump and merge dnsmasq host cache' +task :dump do + require 'set' + require 'etc' + require 'fileutils' + + pid = %x(ps axo pid,ucomm).lines.find { |l| l.strip =~ /\bdnsmasq\z/ }.to_i + return if pid.zero? + + # Create a table of hostnames to addresses, eliding any aliases of localhost + parse_hosts = lambda do |buf| + hosts, locals = {}, Set.new(%w[127.0.0.1 ::1 0.0.0.0 ::]) + buf.lines.each do |l| + addr, host = l.chomp.split "\t" + next if locals.include? addr + hosts[host] ||= Set.new + hosts[host] << addr + end + hosts + end + + # Record current cache + cache = File.expand_path 'hosts.cache' + hosts = File.exists?(cache) ? parse_hosts.call(File.read cache) : {} + + # Send USR1 and wait for dnsmasq to close the cache file + user = Etc.getpwnam 'dnsmasq' + FileUtils.touch cache + File.chown user.uid, user.gid, cache + Process.kill 'SIGUSR1', pid + sleep 0.1 until %x(lsof -p #{pid} 2>/dev/null).lines.grep(Regexp.new cache).empty? + + # Merge old cache records with new ones so we don't lose any records + hosts.merge! parse_hosts.call(File.read cache) + File.open cache, 'w' do |f| + f.puts hosts.sort.reduce('') { |buf, (host, addrs)| + buf << addrs.sort.map { |a| "#{a}\t#{host}\n" }.join + } + end +end + +def blacklisted? blacklist, host + h0, h1, h2, _ = host + blacklist.each do |bhost| + b0, b1, b2, _ = bhost + case host.size + when 1 then return true if b0 === h0 + when 2 then return true if b0 === h0 and b1 === h1 + else return true if b0 === h0 and b1 === h1 and b2 === h2 + end + end + false +end + +def name host + host.reverse.join '.' +end + +desc 'Create a dnsmasq whitelist conf file from hosts.cache' +task :whitelist do + require 'set' + + # Host to direct whitelisted DNS queries + nameserver = '192.168.1.1' + + # Domains that should never enter the whitelist. + # + # Each entry must be an array of three case matchers (i.e. match is done + # with ===) that correspond to the top three levels of a domain name in + # hierarchical order. + blacklist = [ + # ['com', 'google', /\A(www|images|video)\z/], + # ['xxx', /./, /./] + ] + + # Cached hosts as arrays of hierarchical domains + hosts = File.readlines('hosts.cache').map do |l| + l.strip.split.last.split('.').reverse + end + + oldlist = if File.exists? 'whitelist.conf' + File.readlines('whitelist.conf').map { |l| l[%r{/(.*)/}, 1] } + else + [] + end + + # Reduce cached hosts to a set of secondary domains. If the secondary domain + # is blacklisted and the tertiary domain is not, then the tertiary domain is + # added instead. + whitelist = hosts.reduce Set.new(oldlist) do |s, host| + # Don't add TLDs + if host.size < 2 + warn "Rejecting #{name host}" + s + # Try the secondary first + elsif blacklisted? blacklist, host.take(2) + # Then try the tertiary (when in doubt, use brute force) + if blacklisted? blacklist, host.take(3) + warn "Rejecting #{name host}" + s + else + s << name(host.take 3) + end + else + s << name(host.take 2) + end + end + + File.open 'whitelist.conf', 'w' do |f| + f.puts whitelist.map { |host| "server=/#{host}/#{nameserver}" }.sort + end +end diff --git a/release/src/router/dnsmasq/contrib/guns/conf/dnsmasq.conf b/release/src/router/dnsmasq/contrib/guns/conf/dnsmasq.conf new file mode 100644 index 0000000000..5b41cbd6c5 --- /dev/null +++ b/release/src/router/dnsmasq/contrib/guns/conf/dnsmasq.conf @@ -0,0 +1,54 @@ +# _________ +# ______ /_________________ __________ ____________ _ +# _ __ / __ \_ ___/ __ `__ \ __ `/ ___/ __ `/ +# / /_/ / / / /(__ ) / / / / // /_/ /(__ )/ /_/ / +# \__,_//_/ /_//____//_/ /_/ /_/ \__,_//____/ \__, / +# /_/ +# guns + +user=dnsmasq +group=dnsmasq + +# Binding rules +# listen-address=127.0.0.1 +# listen-address=10.10.10.1 +no-dhcp-interface=lo +bind-dynamic # Either dynamically bind interfaces (Linux only) +# bind-interfaces # Or bind them statically + +# Caching +cache-size=65536 +hosts-cache=/var/cache/dnsmasq/hosts.cache + +# +# DNS +# + +resolv-file=/etc/dnsmasq/resolv.conf +addn-hosts=/etc/dnsmasq/hosts +no-poll # Don't poll resolv files +domain-needed # Don't forward plain names +bogus-priv # Deny private reverse lookups +local-ttl=86400 # TTL for answers from hosts files and dhcp lease files +stop-dns-rebind # Reject private answers from upstream servers +dns-loop-detect # Detect DNS forwarding loops + +# Domain rules +address=/dev/127.0.0.1 +# server=/lan/192.168.1.1 +# rebind-domain-ok=lan + +# IP sets +# ipset=/hostname/setname + +# Addresses to convert to NXDOMAIN +bogus-nxdomain=64.94.110.11 # Verisign +bogus-nxdomain=67.215.65.132 # OpenDNS guide +bogus-nxdomain=208.67.219.135 # OpenDNS blocked pages + +# +# DHCP +# + +# dhcp-range = set:private, 10.10.10.100, 10.10.10.199, 12h +# dhcp-option = tag:private, option:mtu, 9000 diff --git a/release/src/router/dnsmasq/contrib/guns/conf/resolv.conf b/release/src/router/dnsmasq/contrib/guns/conf/resolv.conf new file mode 100644 index 0000000000..234413087b --- /dev/null +++ b/release/src/router/dnsmasq/contrib/guns/conf/resolv.conf @@ -0,0 +1,12 @@ +### dnsmasq resolvers file + +# Google DNS +# nameserver 8.8.4.4 +# nameserver 8.8.8.8 + +# OpenDNS +# nameserver 208.67.220.220 +# nameserver 208.67.222.222 + +# dnscrypt-proxy +# nameserver 127.0.0.53 diff --git a/release/src/router/dnsmasq/contrib/guns/dnsmasq.rc b/release/src/router/dnsmasq/contrib/guns/dnsmasq.rc new file mode 100644 index 0000000000..9b9ca91c4d --- /dev/null +++ b/release/src/router/dnsmasq/contrib/guns/dnsmasq.rc @@ -0,0 +1,36 @@ +#!/usr/bin/env bash + +NAME='dnsmasq' +PROGRAM="%%BINDIR%%/$NAME" +PIDFILE="/var/run/$NAME.pid" +OPTIONS=() + +run() { echo "$@"; "$@"; } +alive() { [[ -e "$PIDFILE" ]] && kill -0 "$(cat "$PIDFILE")" &>/dev/null; } + +start() { + if alive; then + echo "$NAME is already running." + return 1 + elif ! "$PROGRAM" --test; then + return 1 + else + run "$PROGRAM" "${OPTIONS[@]}" + fi +} + +stop() { + if alive; then + run kill $(cat $PIDFILE) + else + echo "$NAME is not running." + return 1 + fi +} + +case $1 in +start) start;; +stop) stop;; +restart) stop; while alive; do sleep 1; done; start;; +*) echo "Usage: ${0##*/} start|stop|restart"; exit 1 +esac diff --git a/release/src/router/dnsmasq/contrib/guns/dnsmasq.service b/release/src/router/dnsmasq/contrib/guns/dnsmasq.service new file mode 100644 index 0000000000..045dcd2c8d --- /dev/null +++ b/release/src/router/dnsmasq/contrib/guns/dnsmasq.service @@ -0,0 +1,13 @@ +[Unit] +Description=A lightweight DHCP and caching DNS server +Requires=network.target +After=network.target + +[Service] +Type=simple +ExecStartPre=%%BINDIR%%/dnsmasq --test +ExecStart=%%BINDIR%%/dnsmasq --keep-in-foreground --listen-address=127.0.0.1 +ExecReload=/usr/bin/kill -HUP $MAINPID + +[Install] +WantedBy=multi-user.target diff --git a/release/src/router/dnsmasq/contrib/reverse-dns/README b/release/src/router/dnsmasq/contrib/reverse-dns/README new file mode 100644 index 0000000000..2ec4df1f95 --- /dev/null +++ b/release/src/router/dnsmasq/contrib/reverse-dns/README @@ -0,0 +1,18 @@ +The script reads stdin and replaces all IP addresses with names before +outputting it again. IPs from private networks are reverse looked up +via dns. Other IP adresses are searched for in the dnsmasq query log. +This gives names (CNAMEs if I understand DNS correctly) that are closer +to the name the client originally asked for then the names obtained by +reverse lookup. Just run + +netstat -n -4 | ./reverse_replace.sh + +to see what it does. It needs + +log-queries +log-facility=/var/log/dnsmasq.log + +in the dnsmasq configuration. + +The script runs on debian (with ash installed) and on busybox. + diff --git a/release/src/router/dnsmasq/contrib/reverse-dns/reverse_replace.sh b/release/src/router/dnsmasq/contrib/reverse-dns/reverse_replace.sh new file mode 100644 index 0000000000..5b4aebd714 --- /dev/null +++ b/release/src/router/dnsmasq/contrib/reverse-dns/reverse_replace.sh @@ -0,0 +1,125 @@ +#!/bin/ash +# $Id: reverse_replace.sh 18 2015-03-01 16:12:35Z jo $ +# +# Usage e.g.: netstat -n -4 | reverse_replace.sh +# Parses stdin for IP4 addresses and replaces them +# with names retrieved by parsing the dnsmasq log. +# This currently only gives CNAMEs. But these +# usually tell ou more than the mones from reverse +# lookups. +# +# This has been tested on debian and asuswrt. Plese +# report successful tests on other platforms. +# +# Author: Joachim Zobel +# License: Consider this MIT style licensed. You can +# do as you ike, but you must not remove my name. +# + +LOG=/var/log/dnsmasq.log +MAX_LINES=15000 + +# sed regex do match IPs +IP_regex='[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' +# private IP ranges +IP_private='\(^127\.\)\|\(^192\.168\.\)\|\(^10\.\)\|\(^172\.1[6-9]\.\)\|\(^172\.2[0-9]\.\)\|\(^172\.3[0-1]\.\)' + +####################################################################### +# Find Commands + +HOST=nslookup +if type host > /dev/null 2>&1; then + # echo "No need for nslookup, host is there" + HOST=host +fi + +####################################################################### +# Functions + +# Use shell variables for an (IP) lookup table +create_lookup_table() +{ + # Parse log into lookup table + local CMDS="$( tail -"$MAX_LINES" "$LOG" | \ + grep " is $IP_regex" | \ + sed "s#.* \([^ ]*\) is \($IP_regex\).*#set_val \2 \1;#" )" + + local IFS=' +' + for CMD in $CMDS + do + eval $CMD + done +} + +set_val() +{ + local _IP=$(echo $1 | tr . _) + local KEY="__IP__$_IP" + eval "$KEY"=$2 +} + +get_val() +{ + local _IP=$(echo $1 | tr . _) + local KEY="__IP__$_IP" + eval echo -n '${'"$KEY"'}' +} + +dns_lookup() +{ + local IP=$1 + + local RTN="$($HOST $IP | \ + sed 's#\s\+#\n#g' | \ + grep -v '^$' | \ + tail -1 | tr -d '\n' | \ + sed 's#\.$##')" + if echo $RTN | grep -q NXDOMAIN; then + echo -n $IP + else + echo -n "$RTN" + fi +} + +reverse_dns() +{ + local IP=$1 + + # Skip if it is not an IP + if ! echo $IP | grep -q "^$IP_regex$"; then + echo -n $IP + return + fi + + # Do a dns lookup, if it is a local IP + if echo $IP | grep -q $IP_private; then + dns_lookup $IP + return + fi + + local NAME="$(get_val $IP)" + + if [ -z "$NAME" ]; then + echo -n $IP + else + echo -n $NAME + fi +} + +####################################################################### +# Main +create_lookup_table + +while read LINE; do + for IP in $(echo "$LINE" | \ + sed "s#\b\($IP_regex\)\b#\n\1\n#g" | \ + grep $IP_regex) + do + NAME=`reverse_dns $IP ` + # echo "$NAME $IP" + LINE=`echo "$LINE" | sed "s#$IP#$NAME#" ` + done + echo $LINE +done + diff --git a/release/src/router/dnsmasq/contrib/wrt/dhcp_release.c b/release/src/router/dnsmasq/contrib/wrt/dhcp_release.c index 53f47dda3a..a51f04b30c 100644 --- a/release/src/router/dnsmasq/contrib/wrt/dhcp_release.c +++ b/release/src/router/dnsmasq/contrib/wrt/dhcp_release.c @@ -277,6 +277,11 @@ int main(int argc, char **argv) exit(1); } + if (inet_addr(argv[2]) == INADDR_NONE) + { + perror("invalid ip address"); + exit(1); + } lease.s_addr = inet_addr(argv[2]); server = find_interface(lease, nl, if_nametoindex(argv[1])); diff --git a/release/src/router/dnsmasq/dbus/DBus-interface b/release/src/router/dnsmasq/dbus/DBus-interface index 9a895eb24a..2db5c30b2e 100644 --- a/release/src/router/dnsmasq/dbus/DBus-interface +++ b/release/src/router/dnsmasq/dbus/DBus-interface @@ -169,6 +169,80 @@ Return an array of strings, each string is the IP address of an upstream server which has been found to loop queries back to this dnsmasq instance, and it therefore not being used. +AddDhcpLease +------------ + +Returns nothing. Adds or updates a DHCP or DHCPv6 lease to the internal lease +database, as if a client requested and obtained a lease. + +If a lease for the IPv4 or IPv6 address already exist, it is overwritten. + +Note that this function will trigger the DhcpLeaseAdded or DhcpLeaseUpdated +D-Bus signal and will run the configured DHCP lease script accordingly. + +This function takes many arguments which are the lease parameters: +- A string with the textual representation of the IPv4 or IPv6 address of the + client. + + Examples: + "192.168.1.115" + "1003:1234:abcd::1%eth0" + "2001:db8:abcd::1" + +- A string representing the hardware address of the client, using the same + format as the one used in the lease database. + + Examples: + + "00:23:45:67:89:ab" + "06-00:20:e0:3b:13:af" (token ring) + +- The hostname of the client, as an array of bytes (so there is no problem + with non-ASCII character encoding). May be empty. + + Example (for "hostname.or.fqdn"): + [104, 111, 115, 116, 110, 97, 109, 101, 46, 111, 114, 46, 102, 113, 100, 110] + +- The client identifier (IPv4) or DUID (IPv6) as an array of bytes. May be + empty. + + Examples: + + DHCPv6 DUID: + [0, 3, 0, 1, 0, 35, 69, 103, 137, 171] + DHCPv4 client identifier: + [255, 12, 34, 56, 78, 0, 1, 0, 1, 29, 9, 99, 190, 35, 69, 103, 137, 171] + +- The duration of the lease, in seconds. If the lease is updated, then + the duration replaces the previous duration. + + Example: + + 7200 + +- The IAID (Identity association identifier) of the DHCPv6 lease, as a network + byte-order unsigned integer. For DHCPv4 leases, this must be set to 0. + + Example (for IPv6): + + 203569230 + +- A boolean which, if true, indicates that the DHCPv6 lease is for a temporary + address (IA_TA). If false, the DHCPv6 lease is for a non-temporary address + (IA_NA). For DHCPv4 leases, this must be set to false. + +RemoveDhcpLease +--------------- + +Returns nothing. Removes a DHCP or DHCPv6 lease to the internal lease +database, as if a client sent a release message to abandon a lease. + +This function takes only one parameter: the text representation of the +IPv4 or IPv6 address of the lease to remove. + +Note that this function will trigger the DhcpLeaseRemoved signal and the +configured DHCP lease script will be run with the "del" action. + 2. SIGNALS diff --git a/release/src/router/dnsmasq/debian/changelog b/release/src/router/dnsmasq/debian/changelog index 0a7932550b..61a90a8428 100644 --- a/release/src/router/dnsmasq/debian/changelog +++ b/release/src/router/dnsmasq/debian/changelog @@ -1,8 +1,25 @@ dnsmasq (2.73-1) unstable; urgency=low - * New upstream. - - -- Simon Kelley Fri, 03 Oct 2014 08:49:42 +0000 + * New upstream. (closes: #786996) + * Tweak field width in cache dump to avoid truncating IPv6 + addresses. (closes: #771557) + * Add newline at the end of example config file. (LP: #1416895) + * Make Debian package build reproducible. (closes: #777323) + * Add Requires=network.target to systemd unit. + + -- Simon Kelley Thu, 4 Jun 2015 22:31:42 +0000 + +dnsmasq (2.72-3) unstable; urgency=medium + + * debian/systemd.service: switch from Type=dbus to Type=forking. + dnsmasq does not depend on dbus, but Type=dbus systemd services cannot + work without it. (Closes: #769486, #776530) + - debian/init: when called with systemd-exec argument, let dnsmasq + go into the background, so Type=forking can detect when it is ready + * Remove line containing only whitespace in debian/contol. + (closes: #777571) + + -- Simon Kelley Wed, 11 Feb 2015 21:56:12 +0000 dnsmasq (2.72-2) unstable; urgency=low diff --git a/release/src/router/dnsmasq/debian/control b/release/src/router/dnsmasq/debian/control index d7dfa946e7..aad4c48747 100644 --- a/release/src/router/dnsmasq/debian/control +++ b/release/src/router/dnsmasq/debian/control @@ -41,5 +41,3 @@ Description: Utilities for manipulating DHCP leases Small utilities to query a DHCP server's lease database and remove leases from it. These programs are distributed with dnsmasq and may not work correctly with other DHCP servers. - - diff --git a/release/src/router/dnsmasq/debian/copyright b/release/src/router/dnsmasq/debian/copyright index f382eb88fd..e3f7b4fa68 100644 --- a/release/src/router/dnsmasq/debian/copyright +++ b/release/src/router/dnsmasq/debian/copyright @@ -1,4 +1,4 @@ -dnsmasq is Copyright (c) 2000-2013 Simon Kelley +dnsmasq is Copyright (c) 2000-2015 Simon Kelley It was downloaded from: http://www.thekelleys.org.uk/dnsmasq/ diff --git a/release/src/router/dnsmasq/debian/init b/release/src/router/dnsmasq/debian/init index 808c6c12a8..b334f57310 100644 --- a/release/src/router/dnsmasq/debian/init +++ b/release/src/router/dnsmasq/debian/init @@ -283,9 +283,7 @@ case "$1" in mkdir /var/run/dnsmasq || return 2 chown dnsmasq:nogroup /var/run/dnsmasq || return 2 fi -# Enable DBus by default because we use DBus activation with systemd. - exec $DAEMON --keep-in-foreground --enable-dbus \ - -x /var/run/dnsmasq/$NAME.pid \ + exec $DAEMON -x /var/run/dnsmasq/$NAME.pid \ ${MAILHOSTNAME:+ -m $MAILHOSTNAME} \ ${MAILTARGET:+ -t $MAILTARGET} \ ${DNSMASQ_USER:+ -u $DNSMASQ_USER} \ diff --git a/release/src/router/dnsmasq/debian/rules b/release/src/router/dnsmasq/debian/rules index 0dcbb30d1a..74012ddf49 100755 --- a/release/src/router/dnsmasq/debian/rules +++ b/release/src/router/dnsmasq/debian/rules @@ -24,6 +24,7 @@ DEB_COPTS = $(COPTS) TARGET = install-i18n DEB_HOST_ARCH_OS := $(shell dpkg-architecture -qDEB_HOST_ARCH_OS) +BUILD_DATE := $(shell dpkg-parsechangelog --show-field Date) # Force package version based on git tags. ifneq (,$(filter gitversion,$(DEB_BUILD_OPTIONS))) @@ -118,8 +119,9 @@ binary-indep: checkroot install -m 644 debian/systemd.service debian/daemon/lib/systemd/system/dnsmasq.service install -m 644 debian/insserv debian/daemon/etc/insserv.conf.d/dnsmasq ln -s $(package) debian/daemon/usr/share/doc/dnsmasq - cd debian/daemon && find . -type f ! -regex '.*DEBIAN/.*' -printf '%P\0' | xargs -r0 md5sum > DEBIAN/md5sums + cd debian/daemon && find . -type f ! -regex '.*DEBIAN/.*' -printf '%P\0' | LC_ALL=C sort -z | xargs -r0 md5sum > DEBIAN/md5sums dpkg-gencontrol $(PACKAGE_VERSION) -T -pdnsmasq -Pdebian/daemon + find debian/daemon -depth -newermt '$(BUILD_DATE)' -print0 | xargs -0r touch --no-dereference --date='$(BUILD_DATE)' chown -R root.root debian/daemon chmod -R g-ws debian/daemon dpkg --build debian/daemon .. @@ -144,34 +146,35 @@ ifeq (,$(findstring nodocs,$(DEB_BUILD_OPTIONS))) install -m 644 dnsmasq.conf.example debian/base/usr/share/doc/$(package)/examples/. install -m 644 trust-anchors.conf debian/base/usr/share/$(package)/. install -m 644 FAQ debian/base/usr/share/doc/$(package)/. - gzip -9 debian/base/usr/share/doc/$(package)/FAQ + gzip -9n debian/base/usr/share/doc/$(package)/FAQ install -m 644 CHANGELOG debian/base/usr/share/doc/$(package)/changelog - gzip -9 debian/base/usr/share/doc/$(package)/changelog + gzip -9n debian/base/usr/share/doc/$(package)/changelog install -m 644 CHANGELOG.archive debian/base/usr/share/doc/$(package)/changelog.archive - gzip -9 debian/base/usr/share/doc/$(package)/changelog.archive + gzip -9n debian/base/usr/share/doc/$(package)/changelog.archive install -m 644 dbus/DBus-interface debian/base/usr/share/doc/$(package)/. - gzip -9 debian/base/usr/share/doc/$(package)/DBus-interface + gzip -9n debian/base/usr/share/doc/$(package)/DBus-interface endif install -m 644 debian/dnsmasq-base.conffiles debian/base/DEBIAN/conffiles install -m 755 debian/dnsmasq-base.postinst debian/base/DEBIAN/postinst install -m 755 debian/dnsmasq-base.postrm debian/base/DEBIAN/postrm install -m 644 debian/changelog debian/base/usr/share/doc/$(package)/changelog.Debian - gzip -9 debian/base/usr/share/doc/$(package)/changelog.Debian + gzip -9n debian/base/usr/share/doc/$(package)/changelog.Debian install -m 644 debian/readme debian/base/usr/share/doc/$(package)/README.Debian install -m 644 debian/copyright debian/base/usr/share/doc/$(package)/copyright install -m 644 debian/dbus.conf debian/base/etc/dbus-1/system.d/dnsmasq.conf - gzip -9 debian/base/usr/share/man/man8/dnsmasq.8 + gzip -9n debian/base/usr/share/man/man8/dnsmasq.8 for f in debian/base/usr/share/man/*; do \ if [ -f $$f/man8/dnsmasq.8 ]; then \ - gzip -9 $$f/man8/dnsmasq.8 ; \ + gzip -9n $$f/man8/dnsmasq.8 ; \ fi \ done ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS))) strip -R .note -R .comment debian/base/usr/sbin/dnsmasq endif - cd debian/base && find . -type f ! -regex '.*DEBIAN/.*' -printf '%P\0' | xargs -r0 md5sum > DEBIAN/md5sums + cd debian/base && find . -type f ! -regex '.*DEBIAN/.*' -printf '%P\0' | LC_ALL=C sort -z | xargs -r0 md5sum > DEBIAN/md5sums dpkg-shlibdeps --warnings=1 debian/base/usr/sbin/dnsmasq dpkg-gencontrol $(PACKAGE_VERSION) -pdnsmasq-base -Pdebian/base + find debian/base -depth -newermt '$(BUILD_DATE)' -print0 | xargs -0r touch --no-dereference --date='$(BUILD_DATE)' chown -R root.root debian/base chmod -R g-ws debian/base dpkg --build debian/base .. @@ -185,20 +188,21 @@ ifeq ($(DEB_HOST_ARCH_OS),linux) make -C contrib/wrt PREFIX=/usr DESTDIR=`pwd`/debian/utils CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" COPTS="$(DEB_COPTS)" CC=gcc install -m 755 contrib/wrt/dhcp_release debian/utils/usr/bin/dhcp_release install -m 644 contrib/wrt/dhcp_release.1 debian/utils/usr/share/man/man1/dhcp_release.1 - gzip -9 debian/utils/usr/share/man/man1/dhcp_release.1 + gzip -9n debian/utils/usr/share/man/man1/dhcp_release.1 install -m 755 contrib/wrt/dhcp_lease_time debian/utils/usr/bin/dhcp_lease_time install -m 644 contrib/wrt/dhcp_lease_time.1 debian/utils/usr/share/man/man1/dhcp_lease_time.1 install -m 644 debian/copyright debian/utils/usr/share/doc/dnsmasq-utils/copyright install -m 644 debian/changelog debian/utils/usr/share/doc/dnsmasq-utils/changelog.Debian - gzip -9 debian/utils/usr/share/doc/dnsmasq-utils/changelog.Debian - gzip -9 debian/utils/usr/share/man/man1/dhcp_lease_time.1 + gzip -9n debian/utils/usr/share/doc/dnsmasq-utils/changelog.Debian + gzip -9n debian/utils/usr/share/man/man1/dhcp_lease_time.1 ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS))) strip -R .note -R .comment debian/utils/usr/bin/dhcp_release strip -R .note -R .comment debian/utils/usr/bin/dhcp_lease_time endif - cd debian/utils && find . -type f ! -regex '.*DEBIAN/.*' -printf '%P\0' | xargs -r0 md5sum > DEBIAN/md5sums + cd debian/utils && find . -type f ! -regex '.*DEBIAN/.*' -printf '%P\0' | LC_ALL=C sort -z | xargs -r0 md5sum > DEBIAN/md5sums dpkg-shlibdeps -Tdebian/utils-substvars debian/utils/usr/bin/dhcp_release debian/utils/usr/bin/dhcp_lease_time dpkg-gencontrol $(PACKAGE_VERSION) -Tdebian/utils-substvars -pdnsmasq-utils -Pdebian/utils + find debian/utils -depth -newermt '$(BUILD_DATE)' -print0 | xargs -0r touch --no-dereference --date='$(BUILD_DATE)' chown -R root.root debian/utils chmod -R g-ws debian/utils dpkg --build debian/utils .. diff --git a/release/src/router/dnsmasq/debian/systemd.service b/release/src/router/dnsmasq/debian/systemd.service index 139eddc51b..790c41fca2 100644 --- a/release/src/router/dnsmasq/debian/systemd.service +++ b/release/src/router/dnsmasq/debian/systemd.service @@ -1,9 +1,10 @@ [Unit] -Description=A lightweight DHCP and caching DNS server +Description=dnsmasq - A lightweight DHCP and caching DNS server +Requires=network.target [Service] -Type=dbus -BusName=uk.org.thekelleys.dnsmasq +Type=forking +PIDFile=/var/run/dnsmasq/dnsmasq.pid # Test the config file and refuse starting if it is not valid. ExecStartPre=/usr/sbin/dnsmasq --test @@ -11,11 +12,6 @@ ExecStartPre=/usr/sbin/dnsmasq --test # We run dnsmasq via the /etc/init.d/dnsmasq script which acts as a # wrapper picking up extra configuration files and then execs dnsmasq # itself, when called with the "systemd-exec" function. -# -# It also adds the command-line flags -# --keep-in-foreground --enable-dbus -# to enable DBus by default because we use DBus activation. -# ExecStart=/etc/init.d/dnsmasq systemd-exec # The systemd-*-resolvconf functions configure (and deconfigure) diff --git a/release/src/router/dnsmasq/dnsmasq.conf.example b/release/src/router/dnsmasq/dnsmasq.conf.example index 1bd305dbdb..590f21742f 100644 --- a/release/src/router/dnsmasq/dnsmasq.conf.example +++ b/release/src/router/dnsmasq/dnsmasq.conf.example @@ -251,6 +251,13 @@ # the IP address 192.168.0.60 #dhcp-host=id:01:02:02:04,192.168.0.60 +# Always give the Infiniband interface with hardware address +# 80:00:00:48:fe:80:00:00:00:00:00:00:f4:52:14:03:00:28:05:81 the +# ip address 192.168.0.61. The client id is derived from the prefix +# ff:00:00:00:00:00:02:00:00:02:c9:00 and the last 8 pairs of +# hex digits of the hardware address. +#dhcp-host=id:ff:00:00:00:00:00:02:00:00:02:c9:00:f4:52:14:03:00:28:05:81,192.168.0.61 + # Always give the host with client identifier "marjorie" # the IP address 192.168.0.60 #dhcp-host=id:marjorie,192.168.0.60 @@ -345,6 +352,14 @@ # Ask client to poll for option changes every six hours. (RFC4242) #dhcp-option=option6:information-refresh-time,6h +# Set option 58 client renewal time (T1). Defaults to half of the +# lease time if not specified. (RFC2132) +#dhcp-option=option:T1:1m + +# Set option 59 rebinding time (T2). Defaults to 7/8 of the +# lease time if not specified. (RFC2132) +#dhcp-option=option:T2:2m + # Set the NTP time server address to be the same machine as # is running dnsmasq #dhcp-option=42,0.0.0.0 @@ -486,6 +501,9 @@ # Set the root directory for files available via FTP. #tftp-root=/var/ftpd +# Do not abort if the tftp-root is unavailable +#tftp-no-fail + # Make the TFTP server more secure: with this set, only files owned by # the user dnsmasq is running as will be send over the net. #tftp-secure diff --git a/release/src/router/dnsmasq/dnsmasq.install b/release/src/router/dnsmasq/dnsmasq.install new file mode 100644 index 0000000000..fb5dfc5e99 --- /dev/null +++ b/release/src/router/dnsmasq/dnsmasq.install @@ -0,0 +1,9 @@ +post_install() { + if ! getent passwd dnsmasq &>/dev/null; then + useradd -r -U -c "Local DNS Resolver" -d / -s /usr/bin/nologin dnsmasq + fi +} + +post_upgrade() { + post_install +} diff --git a/release/src/router/dnsmasq/doc.html b/release/src/router/dnsmasq/doc.html index 473cd202b2..0997f5cce2 100644 --- a/release/src/router/dnsmasq/doc.html +++ b/release/src/router/dnsmasq/doc.html @@ -74,7 +74,9 @@ for details. There is a dnsmasq mailing list at http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss which should be the -first location for queries, bugreports, suggestions etc. +first location for queries, bugreports, suggestions etc. The list is mirrored, with a +search facility, at +https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/. You can contact me at simon@thekelleys.org.uk. diff --git a/release/src/router/dnsmasq/man/dnsmasq.8 b/release/src/router/dnsmasq/man/dnsmasq.8 index 0a6ba728cf..ffa0c7b1f4 100644 --- a/release/src/router/dnsmasq/man/dnsmasq.8 +++ b/release/src/router/dnsmasq/man/dnsmasq.8 @@ -50,6 +50,10 @@ Additional hosts file. Read the specified file as well as /etc/hosts. If -h is g only the specified file. This option may be repeated for more than one additional hosts file. If a directory is given, then read all the files contained in that directory. .TP +.B --hostsdir= +Read all the hosts files contained in the directory. New or changed files +are read automatically. See --dhcp-hostsdir for details. +.TP .B \-E, --expand-hosts Add the domain to simple names (without a period) in /etc/hosts in the same way as for DHCP-derived names. Note that this does not @@ -81,6 +85,12 @@ the upstream DNS servers. .B --max-cache-ttl=