From: Seonah Moon Date: Mon, 18 Jan 2021 09:17:41 +0000 (+0900) Subject: Imported Upstream version 2.82 X-Git-Tag: upstream/2.82 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=7511c9647d76e9e187e83847294b1a5c491ebc28;p=platform%2Fupstream%2Fdnsmasq.git Imported Upstream version 2.82 Change-Id: If6c75c812a79ed39237a4cb4af71ce73d665de75 --- diff --git a/CHANGELOG b/CHANGELOG index b32d95d..e6a2231 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,186 @@ +version 2.82 + Improve behaviour in the face of network interfaces which come + and go and change index. Thanks to Petr Mensik for the patch. + + Convert hard startup failure on NETLINK_NO_ENOBUFS under qemu-user + to a warning. + + Allow IPv6 addresses ofthe form [::ffff:1.2.3.4] in --dhcp-option. + + Fix crash under heavy TCP connection load introduced in 2.81. + Thanks to Frank for good work chasing this down. + + Change default lease time for DHCPv6 to one day. + + Alter calculation of preferred and valid times in router + advertisements, so that these do not have a floor applied + of the lease time in the dhcp-range if this is not explicitly + specified and is merely the default. + Thanks to Martin-Éric Racine for suggestions on this. + + +version 2.81 + Improve cache behaviour for TCP connections. For ease of + implementation, dnsmasq has always forked a new process to handle + each incoming TCP connection. A side-effect of this is that + any DNS queries answered from TCP connections are not cached: + when TCP connections were rare, this was not a problem. + With the coming of DNSSEC, it is now the case that some + DNSSEC queries have answers which spill to TCP, and if, + for instance, this applies to the keys for the root, then + those never get cached, and performance is very bad. + This fix passes cache entries back from the TCP child process to + the main server process, and fixes the problem. + + Remove the NO_FORK compile-time option, and support for uclinux. + In an era where everything has an MMU, this looks like + an anachronism, and it adds to (Ok, multiplies!) the + combinatorial explosion of compile-time options. Thanks to + Kevin Darbyshire-Bryant for the patch. + + Fix line-counting when reading /etc/hosts and friends; for + correct error messages. Thanks to Christian Rosentreter + for reporting this. + + Fix bug in DNS non-terminal code, added in 2.80, which could + sometimes cause a NODATA rather than an NXDOMAIN reply. + Thanks to Norman Rasmussen, Sven Mueller and Maciej Żenczykowski + for spotting and diagnosing the bug and providing patches. + + Support TCP-fastopen (RFC-7413) on both incoming and + outgoing TCP connections, if supported and enabled in the OS. + + Improve kernel-capability manipulation code under Linux. Dnsmasq + now fails early if a required capability is not available, and + tries not to request capabilities not required by its + configuration. + + Add --shared-network config. This enables allocation of addresses + by the DHCP server in subnets where the server (or relay) does not + have an interface on the network in that subnet. Many thanks to + kamp.de for sponsoring this feature. + + Fix broken contrib/lease_tools/dhcp_lease_time.c. A packet + validation check got borked in commit 2b38e382 and release 2.80. + Thanks to Tomasz Szajner for spotting this. + + Fix compilation against nettle version 3.5 and later. + + Fix spurious DNSSEC validation failures when the auth section + of a reply contains unsigned RRs from a signed zone, + with the exception that NSEC and NSEC3 RRs must always be signed. + Thanks to Tore Anderson for spotting and diagnosing the bug. + + Add --dhcp-ignore-clid. This disables reading of DHCP client + identifier option (option 61), so clients are only identified by + MAC addresses. + + Fix a bug which stopped --dhcp-name-match from working when a hostname + is supplied in --dhcp-host. Thanks to James Feeney for spotting this. + + Fix bug which caused very rarely caused zero-length DHCPv6 packets. + Thanks to Dereck Higgins for spotting this. + + Add --tftp-single-port option. + + Enhance --conf-dir to load files in a deterministic order. Thanks to + Evgenii Seliavka for the suggestion and initial patch. + + In the router advert code, handle case where we have two + different interfaces on the same IPv6 net, and we are doing + RA/DHCP service on only one of them. Thanks to NIIBE Yutaka + for spotting this case and making the initial patch. + + Support prefixed ranges of ipv6 addresses in dhcp-host. + This eases problems chain-netbooting, where each link in the + chain requests an address using a different UID. With a single + address, only one gets the "static" address, but with this + fix, enough addresses can be reserved for all the stages of the + boot. Many thanks to Harald Jensås for his work on this idea and + earlier patches. + + Add filtering by tag of --dhcp-host directives. Based on a patch + by Harald Jensås. + + Allow empty server spec in --rev-server, to match --server. + + Remove DSA signature verification from DNSSEC, as specified in + RFC 8624. Thanks to Loganaden Velvindron for the original patch. + + Add --script-on-renewal option. + + +version 2.80 + Add support for RFC 4039 DHCP rapid commit. Thanks to Ashram Method + for the initial patch and motivation. + + Alter the default for dnssec-check-unsigned. Versions of + dnsmasq prior to 2.80 defaulted to not checking unsigned + replies, and used --dnssec-check-unsigned to switch + this on. Such configurations will continue to work as before, + but those which used the default of no checking will need to be + altered to explicitly select no checking. The new default is + because switching off checking for unsigned replies is + inherently dangerous. Not only does it open the possiblity of forged + replies, but it allows everything to appear to be working even + when the upstream namesevers do not support DNSSEC, and in this + case no DNSSEC validation at all is occuring. + + Fix DHCP broken-ness when --no-ping AND --dhcp-sequential-ip + are set. Thanks to Daniel Miess for help with this. + + Add a facilty to store DNS packets sent/recieved in a + pcap-format file for later debugging. The file location + is given by the --dumpfile option, and a bitmap controlling + which packets should be dumped is given by the --dumpmask + option. + + Handle the case of both standard and constructed dhcp-ranges on the + same interface better. We don't now contruct a dhcp-range if there's + already one specified. This allows the specified interface to + have different parameters and avoids advertising the same + prefix twice. Thanks to Luis Marsano for spotting this case. + + Allow zone transfer in authoritative mode if auth-peer is specified, + even if auth-sec-servers is not. Thanks to Raphaël Halimi for + the suggestion. + + Fix bug which sometimes caused dnsmasq to wrongly return answers + without DNSSEC RRs to queries with the do-bit set, but only when + DNSSEC validation was not enabled. + Thanks to Petr Menšík for spotting this. + + Fix missing fatal errors with some malformed options + (server, local, address, rebind-domain-ok, ipset, alias). + Thanks to Eugene Lozovoy for spotting the problem. + + Fix crash on startup with a --synth-domain which has no prefix. + Introduced in 2.79. Thanks to Andreas Engel for the bug report. + + Fix missing EDNS0 section in some replies generated by local + DNS configuration which confused systemd-resolvd. Thanks to + Steve Dodd for characterising the problem. + + Add --dhcp-name-match config option. + + Add --caa-record config option. + + Implement --address=/example.com/# as (more efficient) syntactic + sugar for --address=/example.com/0.0.0.0 and + --address=/example.com/:: + Returning null addresses is a useful technique for ad-blocking. + Thanks to Peter Russell for the suggestion. + + Change anti cache-snooping behaviour with queries with the + recursion-desired bit unset. Instead to returning SERVFAIL, we + now always forward, and never answer from the cache. This + allows "dig +trace" command to work. + + Include in the example config file a formulation which + stops DHCP clients from claiming the DNS name "wpad". + This is a fix for the CERT Vulnerability VU#598349. + + version 2.79 Fix parsing of CNAME arguments, which are confused by extra spaces. Thanks to Diego Aguirre for spotting the bug. diff --git a/Makefile b/Makefile index 98ec760..78e25f0 100644 --- a/Makefile +++ b/Makefile @@ -53,6 +53,7 @@ top?=$(CURDIR) dbus_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DBUS $(PKG_CONFIG) --cflags dbus-1` dbus_libs = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DBUS $(PKG_CONFIG) --libs dbus-1` +ubus_libs = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_UBUS "" --copy -lubox -lubus` idn_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_IDN $(PKG_CONFIG) --cflags libidn` idn_libs = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_IDN $(PKG_CONFIG) --libs libidn` idn2_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LIBIDN2 $(PKG_CONFIG) --cflags libidn2` @@ -76,16 +77,16 @@ objs = cache.o rfc1035.o util.o option.o forward.o network.o \ helper.o tftp.o log.o conntrack.o dhcp6.o rfc3315.o \ dhcp-common.o outpacket.o radv.o slaac.o auth.o ipset.o \ domain.o dnssec.o blockdata.o tables.o loop.o inotify.o \ - poll.o rrfilter.o edns0.o arp.o crypto.o + poll.o rrfilter.o edns0.o arp.o crypto.o dump.o ubus.o metrics.o hdrs = dnsmasq.h config.h dhcp-protocol.h dhcp6-protocol.h \ - dns-protocol.h radv-protocol.h ip6addr.h + dns-protocol.h radv-protocol.h ip6addr.h metrics.h all : $(BUILDDIR) @cd $(BUILDDIR) && $(MAKE) \ top="$(top)" \ build_cflags="$(version) $(dbus_cflags) $(idn2_cflags) $(idn_cflags) $(ct_cflags) $(lua_cflags) $(nettle_cflags)" \ - build_libs="$(dbus_libs) $(idn2_libs) $(idn_libs) $(ct_libs) $(lua_libs) $(sunos_libs) $(nettle_libs) $(gmp_libs)" \ + build_libs="$(dbus_libs) $(idn2_libs) $(idn_libs) $(ct_libs) $(lua_libs) $(sunos_libs) $(nettle_libs) $(gmp_libs) $(ubus_libs)" \ -f $(top)/Makefile dnsmasq mostly_clean : @@ -100,7 +101,8 @@ clean : mostly_clean install : all install-common install-common : - $(INSTALL) -d $(DESTDIR)$(BINDIR) -d $(DESTDIR)$(MANDIR)/man8 + $(INSTALL) -d $(DESTDIR)$(BINDIR) + $(INSTALL) -d $(DESTDIR)$(MANDIR)/man8 $(INSTALL) -m 644 $(MAN)/dnsmasq.8 $(DESTDIR)$(MANDIR)/man8 $(INSTALL) -m 755 $(BUILDDIR)/dnsmasq $(DESTDIR)$(BINDIR) @@ -109,7 +111,7 @@ all-i18n : $(BUILDDIR) top="$(top)" \ i18n=-DLOCALEDIR=\'\"$(LOCALEDIR)\"\' \ build_cflags="$(version) $(dbus_cflags) $(idn2_cflags) $(idn_cflags) $(ct_cflags) $(lua_cflags) $(nettle_cflags)" \ - build_libs="$(dbus_libs) $(idn2_libs) $(idn_libs) $(ct_libs) $(lua_libs) $(sunos_libs) $(nettle_libs) $(gmp_libs)" \ + build_libs="$(dbus_libs) $(idn2_libs) $(idn_libs) $(ct_libs) $(lua_libs) $(sunos_libs) $(nettle_libs) $(gmp_libs) $(ubus_libs)" \ -f $(top)/Makefile dnsmasq for f in `cd $(PO); echo *.po`; do \ cd $(top) && cd $(BUILDDIR) && $(MAKE) top="$(top)" -f $(top)/Makefile $${f%.po}.mo; \ diff --git a/VERSION b/VERSION index 5ec247c..bfe3ec9 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ - (HEAD -> master, tag: v2.79, origin/master, origin/HEAD) + (HEAD -> master, tag: v2.82, origin/master, origin/HEAD) diff --git a/bld/Android.mk b/bld/Android.mk index 80ec842..080a615 100644 --- a/bld/Android.mk +++ b/bld/Android.mk @@ -10,7 +10,8 @@ LOCAL_SRC_FILES := bpf.c cache.c dbus.c dhcp.c dnsmasq.c \ dhcp6.c rfc3315.c dhcp-common.c outpacket.c \ radv.c slaac.c auth.c ipset.c domain.c \ dnssec.c dnssec-openssl.c blockdata.c tables.c \ - loop.c inotify.c poll.c rrfilter.c edns0.c arp.c crypto.c + loop.c inotify.c poll.c rrfilter.c edns0.c arp.c \ + crypto.c dump.c ubus.c LOCAL_MODULE := dnsmasq diff --git a/bld/pkg-wrapper b/bld/pkg-wrapper index 0ddb678..704bdd3 100755 --- a/bld/pkg-wrapper +++ b/bld/pkg-wrapper @@ -11,23 +11,25 @@ in=`cat` if grep "^\#[[:space:]]*define[[:space:]]*$search" config.h >/dev/null 2>&1 || \ echo $in | grep $search >/dev/null 2>&1; then -# Nasty, nasty, in --copy, arg 2 is another config to search for, use with NO_GMP +# Nasty, nasty, in --copy, arg 2 (if non-empty) is another config to search for, used with NO_GMP if [ $op = "--copy" ]; then - if grep "^\#[[:space:]]*define[[:space:]]*$pkg" config.h >/dev/null 2>&1 || \ - echo $in | grep $pkg >/dev/null 2>&1; then + if [ -z "$pkg" ]; then + pkg="$*" + elif grep "^\#[[:space:]]*define[[:space:]]*$pkg" config.h >/dev/null 2>&1 || \ + echo $in | grep $pkg >/dev/null 2>&1; then pkg="" else pkg="$*" fi elif grep "^\#[[:space:]]*define[[:space:]]*${search}_STATIC" config.h >/dev/null 2>&1 || \ - echo $in | grep ${search}_STATIC >/dev/null 2>&1; then + echo $in | grep ${search}_STATIC >/dev/null 2>&1; then pkg=`$pkg --static $op $*` else pkg=`$pkg $op $*` fi - + if grep "^\#[[:space:]]*define[[:space:]]*${search}_STATIC" config.h >/dev/null 2>&1 || \ - echo $in | grep ${search}_STATIC >/dev/null 2>&1; then + echo $in | grep ${search}_STATIC >/dev/null 2>&1; then if [ $op = "--libs" ] || [ $op = "--copy" ]; then echo "-Wl,-Bstatic $pkg -Wl,-Bdynamic" else diff --git a/contrib/lease-tools/dhcp_lease_time.c b/contrib/lease-tools/dhcp_lease_time.c index f9d7a85..91edbfa 100644 --- a/contrib/lease-tools/dhcp_lease_time.c +++ b/contrib/lease-tools/dhcp_lease_time.c @@ -83,7 +83,7 @@ static unsigned char *option_find1(unsigned char *p, unsigned char *end, int opt if (p >= end - 2) return NULL; /* malformed packet */ opt_len = option_len(p); - if (p >= end - (2 + opt_len)) + if (end - p < (2 + opt_len)) return NULL; /* malformed packet */ if (*p == opt && opt_len >= minsize) return p; diff --git a/contrib/lease-tools/dhcp_release.c b/contrib/lease-tools/dhcp_release.c index 201fcd3..30e77c6 100644 --- a/contrib/lease-tools/dhcp_release.c +++ b/contrib/lease-tools/dhcp_release.c @@ -178,7 +178,7 @@ static int is_same_net(struct in_addr a, struct in_addr b, struct in_addr mask) return (a.s_addr & mask.s_addr) == (b.s_addr & mask.s_addr); } -static struct in_addr find_interface(struct in_addr client, int fd, unsigned int index) +static struct in_addr find_interface(struct in_addr client, int fd, unsigned int index, int ifrfd, struct ifreq *ifr) { struct sockaddr_nl addr; struct nlmsghdr *h; @@ -218,7 +218,17 @@ static struct in_addr find_interface(struct in_addr client, int fd, unsigned int for (h = (struct nlmsghdr *)iov.iov_base; NLMSG_OK(h, (size_t)len); h = NLMSG_NEXT(h, len)) if (h->nlmsg_type == NLMSG_DONE) - exit(0); + { + /* No match found, return first address as src/dhcp.c code does */ + ifr->ifr_addr.sa_family = AF_INET; + if (ioctl(ifrfd, SIOCGIFADDR, ifr) != -1) + return ((struct sockaddr_in *)&ifr->ifr_addr)->sin_addr; + else + { + fprintf(stderr, "error: local IPv4 address not found\n"); + exit(1); + } + } else if (h->nlmsg_type == RTM_NEWADDR) { struct ifaddrmsg *ifa = NLMSG_DATA(h); @@ -270,7 +280,8 @@ int main(int argc, char **argv) /* This voodoo fakes up a packet coming from the correct interface, which really matters for a DHCP server */ - strcpy(ifr.ifr_name, argv[1]); + strncpy(ifr.ifr_name, argv[1], sizeof(ifr.ifr_name)-1); + ifr.ifr_name[sizeof(ifr.ifr_name)-1] = '\0'; if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, &ifr, sizeof(ifr)) == -1) { perror("cannot setup interface"); @@ -284,7 +295,7 @@ int main(int argc, char **argv) } lease.s_addr = inet_addr(argv[2]); - server = find_interface(lease, nl, if_nametoindex(argv[1])); + server = find_interface(lease, nl, if_nametoindex(argv[1]), fd, &ifr); memset(&packet, 0, sizeof(packet)); diff --git a/contrib/lease-tools/dhcp_release6.c b/contrib/lease-tools/dhcp_release6.c index 7f79fa7..d680222 100644 --- a/contrib/lease-tools/dhcp_release6.c +++ b/contrib/lease-tools/dhcp_release6.c @@ -376,9 +376,12 @@ int send_release_packet(const char* iface, struct dhcp6_packet* packet) sleep(1); continue; } + + close(sock); return result; } - + + close(sock); fprintf(stderr, "Response timed out\n"); return -1; } diff --git a/contrib/reverse-dns/README b/contrib/reverse-dns/README index 62af669..db9ca77 100644 --- a/contrib/reverse-dns/README +++ b/contrib/reverse-dns/README @@ -1,18 +1,18 @@ -The script reads stdin and replaces all IP addresses with names before -outputting it again. IPs from private networks are reverse looked up -via dns. Other IP addresses are searched for in the dnsmasq query log. -This gives names (CNAMEs if I understand DNS correctly) that are closer -to the name the client originally asked for then the names obtained by -reverse lookup. Just run - -netstat -n -4 | ./reverse_replace.sh - -to see what it does. It needs - -log-queries -log-facility=/var/log/dnsmasq.log - -in the dnsmasq configuration. - -The script runs on debian (with ash installed) and on busybox. - +The script reads stdin and replaces all IP addresses with names before +outputting it again. IPs from private networks are reverse looked up +via dns. Other IP addresses are searched for in the dnsmasq query log. +This gives names (CNAMEs if I understand DNS correctly) that are closer +to the name the client originally asked for then the names obtained by +reverse lookup. Just run + +netstat -n -4 | ./reverse_replace.sh + +to see what it does. It needs + +log-queries +log-facility=/var/log/dnsmasq.log + +in the dnsmasq configuration. + +The script runs on debian (with dash installed) and on busybox. + diff --git a/contrib/reverse-dns/reverse_replace.sh b/contrib/reverse-dns/reverse_replace.sh index c6401fb..dfdc1bf 100644 --- a/contrib/reverse-dns/reverse_replace.sh +++ b/contrib/reverse-dns/reverse_replace.sh @@ -1,4 +1,4 @@ -#!/bin/ash +#!/bin/dash # $Id: reverse_replace.sh 18 2015-03-01 16:12:35Z jo $ # # Usage e.g.: netstat -n -4 | reverse_replace.sh diff --git a/contrib/systemd/dbus_activation b/contrib/systemd/dbus_activation index 94a8820..38f0822 100644 --- a/contrib/systemd/dbus_activation +++ b/contrib/systemd/dbus_activation @@ -1,57 +1,57 @@ -To: dnsmasq-discuss@lists.thekelleys.org.uk -From: Alex Elsayed -Date: Tue, 15 May 2012 01:53:54 -0700 -Subject: [Dnsmasq-discuss] [PATCH] Support dbus activation - -Introduce dbus service file and turn dbus on in the systemd -unit. - -Note to packagers: -To add support for dbus activation, you must install the dbus -service file (dbus/uk.org.thekelleys.dnsmasq.service) into -$DATADIR/dbus-1/system-services. - ---- - contrib/systemd/dnsmasq.service | 2 +- - dbus/uk.org.thekelleys.dnsmasq.service | 7 +++++++ - 2 files changed, 8 insertions(+), 1 deletion(-) - create mode 100644 dbus/uk.org.thekelleys.dnsmasq.service - -diff --git a/contrib/systemd/dnsmasq.service -b/contrib/systemd/dnsmasq.service -index a27fe6d..4a784d3 100644 ---- a/contrib/systemd/dnsmasq.service -+++ b/contrib/systemd/dnsmasq.service -@@ -5,7 +5,7 @@ Description=A lightweight DHCP and caching DNS server - Type=dbus - BusName=uk.org.thekelleys.dnsmasq - ExecStartPre=/usr/sbin/dnsmasq --test --ExecStart=/usr/sbin/dnsmasq -k -+ExecStart=/usr/sbin/dnsmasq -k -1 - ExecReload=/bin/kill -HUP $MAINPID - - [Install] -diff --git a/dbus/uk.org.thekelleys.dnsmasq.service -b/dbus/uk.org.thekelleys.dnsmasq.service -new file mode 100644 -index 0000000..f5fe98d ---- /dev/null -+++ b/dbus/uk.org.thekelleys.dnsmasq.service -@@ -0,0 +1,7 @@ -+[D-BUS Service] -+Name=uk.org.thekelleys.dnsmasq -+Exec=/usr/sbin/dnsmasq -k -1 -+User=root -+SystemdService=dnsmasq.service -+ -+ --- -1.7.10.2 - - - -_______________________________________________ -Dnsmasq-discuss mailing list -Dnsmasq-discuss@lists.thekelleys.org.uk -http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss - +To: dnsmasq-discuss@lists.thekelleys.org.uk +From: Alex Elsayed +Date: Tue, 15 May 2012 01:53:54 -0700 +Subject: [Dnsmasq-discuss] [PATCH] Support dbus activation + +Introduce dbus service file and turn dbus on in the systemd +unit. + +Note to packagers: +To add support for dbus activation, you must install the dbus +service file (dbus/uk.org.thekelleys.dnsmasq.service) into +$DATADIR/dbus-1/system-services. + +--- + contrib/systemd/dnsmasq.service | 2 +- + dbus/uk.org.thekelleys.dnsmasq.service | 7 +++++++ + 2 files changed, 8 insertions(+), 1 deletion(-) + create mode 100644 dbus/uk.org.thekelleys.dnsmasq.service + +diff --git a/contrib/systemd/dnsmasq.service +b/contrib/systemd/dnsmasq.service +index a27fe6d..4a784d3 100644 +--- a/contrib/systemd/dnsmasq.service ++++ b/contrib/systemd/dnsmasq.service +@@ -5,7 +5,7 @@ Description=A lightweight DHCP and caching DNS server + Type=dbus + BusName=uk.org.thekelleys.dnsmasq + ExecStartPre=/usr/sbin/dnsmasq --test +-ExecStart=/usr/sbin/dnsmasq -k ++ExecStart=/usr/sbin/dnsmasq -k -1 + ExecReload=/bin/kill -HUP $MAINPID + + [Install] +diff --git a/dbus/uk.org.thekelleys.dnsmasq.service +b/dbus/uk.org.thekelleys.dnsmasq.service +new file mode 100644 +index 0000000..f5fe98d +--- /dev/null ++++ b/dbus/uk.org.thekelleys.dnsmasq.service +@@ -0,0 +1,7 @@ ++[D-BUS Service] ++Name=uk.org.thekelleys.dnsmasq ++Exec=/usr/sbin/dnsmasq -k -1 ++User=root ++SystemdService=dnsmasq.service ++ ++ +-- +1.7.10.2 + + + +_______________________________________________ +Dnsmasq-discuss mailing list +Dnsmasq-discuss@lists.thekelleys.org.uk +http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss + diff --git a/contrib/systemd/dnsmasq.service b/contrib/systemd/dnsmasq.service index c70b144..ff0ed08 100644 --- a/contrib/systemd/dnsmasq.service +++ b/contrib/systemd/dnsmasq.service @@ -1,5 +1,8 @@ [Unit] Description=dnsmasq - A lightweight DHCP and caching DNS server +After=network.target +Before=network-online.target nss-lookup.target +Wants=nss-lookup.target [Service] Type=dbus diff --git a/dbus/DBus-interface b/dbus/DBus-interface index 2db5c30..954c5b9 100644 --- a/dbus/DBus-interface +++ b/dbus/DBus-interface @@ -243,6 +243,10 @@ IPv4 or IPv6 address of the lease to remove. Note that this function will trigger the DhcpLeaseRemoved signal and the configured DHCP lease script will be run with the "del" action. +GetMetrics +---------- + +Returns an array with various metrics for DNS and DHCP. 2. SIGNALS diff --git a/dnsmasq.conf.example b/dnsmasq.conf.example index 574b053..bf19424 100644 --- a/dnsmasq.conf.example +++ b/dnsmasq.conf.example @@ -547,6 +547,14 @@ # http://www.isc.org/files/auth.html #dhcp-authoritative +# Set the DHCP server to enable DHCPv4 Rapid Commit Option per RFC 4039. +# In this mode it will respond to a DHCPDISCOVER message including a Rapid Commit +# option with a DHCPACK including a Rapid Commit option and fully committed address +# and configuration information. This must only be enabled if either the server is +# the only server for the subnet, or multiple servers are present and they each +# commit a binding for all clients. +#dhcp-rapid-commit + # Run an executable when a DHCP lease is created or destroyed. # The arguments sent to the script are "add" or "del", # then the MAC address, the IP address and finally the hostname @@ -664,3 +672,8 @@ # Include all files in a directory which end in .conf #conf-dir=/etc/dnsmasq.d/,*.conf + +# If a DHCP client claims that its name is "wpad", ignore that. +# This fixes a security hole. see CERT Vulnerability VU#598349 +#dhcp-name-match=set:wpad-ignore,wpad +#dhcp-ignore-names=tag:wpad-ignore diff --git a/man/dnsmasq.8 b/man/dnsmasq.8 index bd99b48..7b0e106 100644 --- a/man/dnsmasq.8 +++ b/man/dnsmasq.8 @@ -1,4 +1,4 @@ -.TH DNSMASQ 8 +.TH DNSMASQ 8 2020-04-05 .SH NAME dnsmasq \- A lightweight DHCP and caching DNS server. .SH SYNOPSIS @@ -27,7 +27,7 @@ TFTP server to allow net/PXE boot of DHCP hosts and also supports BOOTP. The PXE .PP The dnsmasq DHCPv6 server provides the same set of features as the DHCPv4 server, and in addition, it includes router advertisements and -a neat feature which allows nameing for clients which use DHCPv4 and +a neat feature which allows naming for clients which use DHCPv4 and stateless autoconfiguration only for IPv6 configuration. There is support for doing address allocation (both DHCPv6 and RA) from subnets which are dynamically delegated via DHCPv6 prefix delegation. .PP Dnsmasq is coded with small embedded systems in mind. It aims for the smallest possible memory footprint compatible with the supported functions, and allows unneeded functions to be omitted from the compiled binary. @@ -53,13 +53,13 @@ will display DHCPv6 options. Don't read the hostnames in /etc/hosts. .TP .B \-H, --addn-hosts= -Additional hosts file. Read the specified file as well as /etc/hosts. If -h is given, read +Additional hosts file. Read the specified file as well as /etc/hosts. If \fB--no-hosts\fP is given, read only the specified file. This option may be repeated for more than one additional hosts file. If a directory is given, then read all the files contained in that directory. .TP .B --hostsdir= Read all the hosts files contained in the directory. New or changed files -are read automatically. See --dhcp-hostsdir for details. +are read automatically. See \fB--dhcp-hostsdir\fP for details. .TP .B \-E, --expand-hosts Add the domain to simple names (without a period) in /etc/hosts @@ -76,7 +76,7 @@ reduce the load on the server at the expense of clients using stale data under some circumstances. .TP .B --dhcp-ttl=