aboutsummaryrefslogtreecommitdiff
path: root/package/network/services/dnsmasq/Makefile
Commit message (Collapse)AuthorAge
* dnsmasq: fix start if dhcp-range is not correctFlorian Eckert2025-05-29
| | | | | | | | | | | | | | | | | | | | If the uci 'dhcp' configuration for the dhcp leases is incorrect then the call to 'ipclac' fails. However, the problem is that the dnsmasq configuration option 'dhcp-range' is still written for this uci section even though the information generated by ipcalc is incorrect or not set. Due to the incorrectly generated configuration for dnsmasq, the service cannot start. To prevent an incorrect configuration from being written to the configuration, a check is now made beforehand to ensure that the required variables are present and valid. If the configuration is incorrect, a message is emitted to the log that this configuration section is incorrect and this uci configuration section is omitted. Signed-off-by: Florian Eckert <fe@dev.tdt.de> Link: https://github.com/openwrt/openwrt/pull/18641 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: bump release to 2.91Rudy Andram2025-04-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | updated 200-ubus_dns.patch all remaining patches not required Changelog for version 2.91 - https://thekelleys.org.uk/dnsmasq/CHANGELOG version 2.91 Fix spurious "resource limit exceeded messages". Thanks to Dominik Derigs for the bug report. Fix out-of-bounds heap read in order_qsort(). We only need to order two server records on the ->serial field. Literal address records are smaller and don't have this field and don't need to be ordered on it. To actually provoke this bug seems to need the same server-literal to be repeated twice, e.g., --address=/a/1.1.1.1 --address-/a/1.1.1.1 which is clearly rare in the wild, but if it did exist it could provoke a SIGSEGV. Thanks to Daniel Rhea for fuzzing this one. Fix buffer overflow when configured lease-change script name is too long. Thanks to Daniel Rhea for finding this one. Improve behaviour in the face of non-responsive upstream TCP DNS servers. Without shorter timeouts, clients are blocked for too long and fail with their own timeouts. Set --fast-dns-retries by default when doing DNSSEC. A single downstream query can trigger many upstream queries. On an unreliable network, there may not be enough downstream retries to ensure that all these queries complete. Improve behaviour in the face of truncated answers to queries for DNSSEC records. Getting these answers by TCP doesn't now involve a faked truncated answer to the downstream client to force it to move to TCP. This improves performance and robustness in the face of broken clients which can't fall back to TCP. No longer remove data from truncated upstream answers. If an upstream replies with a truncated answer, but the answer has some RRs included, return those RRs, rather than returning and empty answer. Fix handling of EDNS0 UDP packet sizes. When talking upstream we always add a pseudo header, and set the UDP packet size to --edns-packet-max. Answering queries from downstream, we get the answer (either from upstream or local data) If local data won't fit the advertised size (or 512 if there's not an EDNS0 header) return truncated. If upstream returns truncated, do likewise. If upstream is OK, but the answer is too big for downstream, truncate the answer. Modify the behaviour of --synth-domain for IPv6. When deriving a domain name from an IPv6 address, an address such as 1234:: would become 1234--.example.com, which is not legal in IDNA2008. Stop using the :: compression method, so 1234:: becomes 1234-0000-0000-0000-0000-0000-0000-0000.example.com Fix broken dhcp-relay on *BSD. Thanks to Harold for finding this problem. Add --dhcp-option-pxe config. This acts almost exactly like --dhcp-option except that the defined option is only sent when replying to PXE clients. More importantly, these options are sent in reply PXE clients when dnsmasq in acting in PXE proxy mode. In PXE proxy mode, the set of options sent is defined by the PXE standard and the normal set of options is not sent. This config allows arbitrary options in PXE-proxy replies. A typical use-case is to send option 175 to iPXE. Thanks to Jason Berry for finding the requirement for this. Support PXE proxy-DHCP and DHCP-relay at the same time. When using PXE proxy-DHCP, dnsmasq supplies PXE information to the client, which also talks to another "normal" DHCP server for address allocation and similar. The normal DHCP server may be on the local network, but it may also be remote, and accessed via a DHCP relay. This change allows dnsmasq to act as both a PXE proxy-DHCP server AND a DHCP relay for the same network. Fix erroneous "DNSSEC validated" state with non-DNSSEC upstream servers. Thanks to Dominik Derigs for the bug report. Handle queries with EDNS client subnet fields better. If dnsmasq is configured to add an EDNS client subnet to a query, it is careful to suppress use of the cache, since a cached answer may not be valid for a query with a different client subnet. Extend this behaviour to queries which arrive a dnsmasq already carrying an EDNS client subnet. Handle DS queries to auth zones. When dnsmasq is configured to act as an authoritative server and has an authoritative zone configured, and receives a query for that zone _as_forwarder_ it answers the query directly rather than forwarding it. This doesn't affect the answer, but it saves dnsmasq forwarding the query to the recursor upstream, which then bounces it back to dnsmasq in auth mode. The exception should be when the query is for the root of zone, for a DS RR. The answer to that has to come from the parent, via the recursor, and will typically be a proof-of-non-existence since dnsmasq doesn't support signed zones. This patch suppresses local answers and forces forwarding to the upstream recursor for such queries. It stops breakage when a DNSSEC validating client makes queries to dnsmasq acting as forwarder for a zone for which it is authoritative. Implement "DNS-0x20 encoding", for extra protection against reply-spoof attacks. Since DNS queries are case-insensitive, it's possible to randomly flip the case of letters in a query and still get the correct answer back. This adds an extra dimension for a cache-poisoning attacker to guess when sending replies in-the-blind since it's expected that the legitimate answer will have the same pattern of upper and lower case as the query, so any replies which don't can be ignored as malicious. The amount of extra entropy clearly depends on the number of a-z and A-Z characters in the query, and this implementation puts a hard limit of 32 bits to make resource allocation easy. This about doubles entropy over the standard random ID and random port combination. This technique can interact badly with rare broken DNS servers which don't preserve the case of the query in their reply. The first time a reply is returned which matches the query in all respects except case, a warning will be logged. In this release, 0x020-encoding is default-off and must be explicitly enabled with --do-0x20-encoding. In future releases it may default on. You can avoid a future release changing the behaviour of an installation with --no-x20-encode. Fix a long-standing problem when two queries which are identical in every repect _except_ case, get combined by dnsmasq. If dnsmasq gets eg, two queries for example.com and Example.com in quick succession it will get the answer for example.com from upstream and send that answer to both requestors. This means that the query for Example.com will get an answer for example.com, and in the modern DNS, that answer may not be accepted. Signed-off-by: Rudy Andram <rmandrad@gmail.com> Link: https://github.com/openwrt/openwrt/pull/18357 Signed-off-by: Robert Marko <robimarko@gmail.com>
* dnsmasq: add fix related to DNSSEC verification from upstreamUwe Kleine-König2025-01-27
| | | | | | | | | | To find the DS record for a given zone the parent zone's nameserver must be queried and not the nameserver for the zone. Otherwise DNSSEC verification for unsigned delegations breaks. Signed-off-by: Uwe Kleine-König <uwe+openwrt@kleine-koenig.org> Link: https://patchwork.ozlabs.org/project/openwrt/patch/20250127151223.1420006-1-uwe+openwrt@kleine-koenig.org/ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: Add EDNS0 Upstream supportCarsten Schuette2024-08-24
| | | | | | | | Forward client mac address and subnet on dns queries. Pi-hole and Adguard use this feature to send the originators ip address/subnet so it can be logged and not just the nat address of the router. This feature has been added since version 2.56 of dnsmasq and would be nice to expose this feature in openwrt. Signed-off-by: Carsten Schuette <schuettecarsten@googlemail.com> Link: https://github.com/openwrt/openwrt/pull/15965 Signed-off-by: Robert Marko <robimarko@gmail.com>
* dnsmasq: Backport 2 upstream patchesHauke Mehrtens2024-03-20
| | | | | | | These two patches are fixing minor problems with DNSSEC found shortly after the dnsmasq 2.90 release. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: reset PKG_RELEASERobert Marko2024-03-13
| | | | | | | dnsmasq was recently updated to 2.90, but PKG_RELEASE was not reset to 1. Fixes: 838a27f64f56 ("dnsmasq: version 2.90") Signed-off-by: Robert Marko <robimarko@gmail.com>
* dnsmasq: version 2.90Nathaniel Wesley Filardo2024-03-11
| | | | | | | | | | | Bump to 2.90 to get upstream's fix for DNSSEC KeyTrap (CVE-2023-50387, CVE-2023-50868) among many other goodies and fixes (notably, upstream 568fb024... fixes a UAF in cache_remove_uid that was routinely crashing dnsmasq in my deployment). Catch up our 200-ubus_dns.patch, too. Signed-off-by: Nathaniel Wesley Filardo <nwfilardo@gmail.com>
* dnsmasq: rework network interface ignoreYegor Yefremov2024-02-22
| | | | | | | | | | | | | In some situations (slow protocol or interfaces with auto 0), the interfaces are not available during the dnsmasq initialization and hence, the ignore setting will be skipped. Install an interface trigger for ignored interfaces in case their ifname cannot be resolved. Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com> [bump PKG_RELEASE] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* dnsmasq: Invoke new ipcalc with CIDR notationPhilip Prindeville2023-11-15
| | | | | | | | | | | | | | | | | | | The new rewritten ipcalc.sh understands 3 notations: ipaddr/prefix ... ipaddr/dotted-netmask ... ipaddr dotted-netmask ... meaning that the previous 4th non-standard notation of "ipaddr prefix" will be dropped, alas that's the notation that dnsmasq currently uses. This change has us using the first notation which is the most common. This behavior came in as https://github.com/openwrt/openwrt/commit/eda27e8382f3e5253defab5419e95d4b51f72de3 a long time ago. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* package: dnsmasq: remove off-by-one mitigation for limitLeon M. Busch-George2023-09-25
| | | | | | | | | In the dnsmasq init script, an off-by-one in the range calculation of ipcalc.sh was mitigated by passing the limit as if its counting started at zero. This patch removes the mitigation as the off-by-one has been fixed. Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
* package: avoid the use of eval to parse ipcalc.sh outputLeon M. Busch-George2023-09-25
| | | | | | | | | | | Add a function 'ipcalc' to /lib/functions.sh that sets variables more safely using export. With this new function, dnsmasq also handles the return value of ipcalc correctly. Fixes: e4bd3de1be8e ("dnsmasq: refuse to add empty DHCP range") Co-Authored-By: Philip Prindeville <philipp@redfish-solutions.com> Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
* treewide: replace AUTORELEASE with real PKG_RELEASETianling Shen2023-05-18
| | | | | | | | | | | | | | | | | | Based on Paul Fertser <fercerpav@gmail.com>'s guidance: Change AUTORELEASE in rules.mk to: ``` AUTORELEASE = $(if $(DUMP),0,$(shell sed -i "s/\$$(AUTORELEASE)/$(call commitcount,1)/" $(CURDIR)/Makefile)) ``` then update all affected packages by: ``` for i in $(git grep -l PKG_RELEASE:=.*AUTORELEASE | sed 's^.*/\([^/]*\)/Makefile^\1^';); do make package/$i/clean done ``` Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* treewide: add support for "lto" in PKG_BUILD_FLAGSAndre Heider2023-03-21
| | | | | | | | | | | | | | | | This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-lto". Some packages used LTO, but not the linker plugin. This unifies 'em all to attempt to produce better code. Quoting man gcc(1): "This improves the quality of optimization by exposing more code to the link-time optimizer." Also use -flto=auto instead of -flto=jobserver, as it's not guaranteed that every buildsystem uses +$(MAKE) correctly. Signed-off-by: Andre Heider <a.heider@gmail.com>
* dnsmasq: bump to v2.89Kevin Darbyshire-Bryant2023-02-25
| | | | Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: bump to v2.88Kevin Darbyshire-Bryant2022-12-25
| | | | | | | Most relevant feature for openwrt in this release, supports dynamically removing hosts from 'hostsdir' supplied host files. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: Support nftables nftsetsKevin Darbyshire-Bryant2022-11-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add build option for nftables sets. By default disable iptables ipset support. By default enable nftable nftset support since this is what fw4 uses. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> dnsmasq: nftset: serve from ipset config Use existing ipset configs as source for nftsets to be compatible with existing configs. As the OS can either have iptables XOR nftables support, it's fine to provide both to dnsmasq. dnsmasq will silently fail for the present one. Depending on the dnsmasq compile time options, the ipsets or nftsets option will not be added to the dnsmasq config file. dnsmasq will try to add the IP addresses to all sets, regardless of the IP version defined for the set. Adding an IPv6 to an IPv4 set and vice versa will silently fail. Signed-off-by: Mathias Kresin <dev@kresin.me> dnsmasq: support populating nftsets in addition to ipsets Tell dnsmasq to populate nftsets instead of ipsets, if firewall4 is present in the system. Keep the same configuration syntax in /etc/config/dhcp, for compatibility purposes. Huge thanks to Jo-Philipp Wich for basically writing the function. Signed-off-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com> dnsmasq: obtain nftset ip family from nft Unfortunately dnsmasq nft is noisy if an attempt to add a mismatched ip address family to an nft set is made. Heuristic to guess which ip family a nft set might belong by inferring from the set name. In order of preference: If setname ends with standalone '4' or '6' use that, else if setname has '4' or '6' delimited by '-' or '_' use that (eg foo-4-bar) else If setname begins with '4' or '6' standalone use that. By standalone I mean not as part of a larger number eg. 24 If the above fails then use the existing nft set query mechanism and if that fails, well you're stuffed! With-thanks-to: Jo-Philipp Wich <jo@mein.io> who improved my regexp knowledge. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> dnsmasq: specify firewall table for nftset Permit ipsets to specify an nftables table for the set. New config parameter is 'table'. If not specified the default of 'fw4' is used. config ipset list name 'BK_4,BK_6' option table 'dscpclassify' option table_family 'ip' option family '4' list domain 'ms-acdc.office.com' list domain 'windowsupdate.com' list domain 'update.microsoft.com' list domain 'graph.microsoft.com' list domain '1drv.ms' list domain '1drv.com' The table family can also be specified, usually 'ip' or 'ip6' else the default 'inet' capable of both ipv4 & ipv6 is used. If the table family is not specified then finally a family option is available to specify either '4' or '6' for ipv4 or ipv6 respectively. This is all in addition to the existing heuristic that will look in the nftset name for an ip family clue, or in total desperation, query the value from the nftset itself. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: add uci-defaults script for ipset migrationMathias Kresin2022-11-06
| | | | | | | | When running sysupgrade from an existing configuration, move existing ipset definitions to a dedicated config section. Later on, it will allow to serve ipset as well as nftable sets from the same configuration. Signed-off-by: Mathias Kresin <dev@kresin.me>
* dnsmasq: bump to 2.87Kevin Darbyshire-Bryant2022-11-06
| | | | | | Bump dnsmasq to 2.87 & refresh patches Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* build: prefer HTTPS if available (for packages)Daniel Cousens2022-10-05
| | | | | | | | Changes PKG_SOURCE_URL's for arptables, bsdiff, dnsmasq, fortify-headers, ipset, ipset-dns, libaudit, libpcap, libressl, lua, lua5.3, tcpdump and valgrind, to HTTPS Signed-off-by: Daniel Cousens <github@dcousens.com>
* dnsmasq: Update to version 2.86Etan Kissling2021-09-14
| | | | | | | | | | | | | | | | | | | | | Summary of upstream CHANGELOG: * Handle DHCPREBIND requests in the DHCPv6 server code. * Fix bug which caused dnsmasq to lose track of processes forked. * Major rewrite of the DNS server and domain handling code. * Revise resource handling for number of concurrent DNS queries. * Improve efficiency of DNSSEC. * Connection track mark based DNS query filtering. * Allow smaller than 64 prefix lengths in synth-domain. * Make domains generated by --synth-domain appear in replies when in authoritative mode. * Ensure CAP_NET_ADMIN capability is available when conntrack is configured. * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are given a directory as argument, define the order in which files within that directory are read. * Support some wildcard matching of input tags to --tag-if. Signed-off-by: Etan Kissling <etan.kissling@gmail.com>
* Revert "dnsmasq: Update to version 2.86test3"Kevin Darbyshire-Bryant2021-06-26
| | | | | | | | This reverts commit 3628870015ef46eacf2c936f36e3c1ed3b4c9855. dnsmasq v2.86test3 has some issues with ubus, so is being reverted. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: Update to version 2.86test3Etan Kissling2021-06-26
| | | | | | | | | | | | | | Need this version to add config option for connmark DNS filtering. Summary of upstream CHANGELOG: * Handle DHCPREBIND requests in the DHCPv6 server code. * Fix bug which caused dnsmasq to lose track of processes forked. * Major rewrite of the DNS server and domain handling code. * Revise resource handling for number of concurrent DNS queries. * Improve efficiency of DNSSEC. * Connection track mark based DNS query filtering. Signed-off-by: Etan Kissling <etan.kissling@gmail.com>
* dnsmasq: Update to version 2.85Alan Swanson2021-05-05
| | | | | | | | | | | | | | | | | | | | | Fixes issue with merged DNS requests in 2.83/2.84 not being retried on the firsts failed request causing lookup failures. Also fixes the following security problem in dnsmasq: * CVE-2021-3448: If specifiying the source address or interface to be used when contacting upstream name servers such as: server=8.8.8.8@1.2.3.4, server=8.8.8.8@1.2.3.4#66 and server=8.8.8.8@eth0 then all would use the same socket bound to the explicitly configured port. Now only server=8.8.8.8@1.2.3.4#66 will use the explicitly configured port and the others random source ports. Remove upstreamed patches and update remaining patch. Signed-off-by: Alan Swanson <reiver@improbability.net> [refreshed old runtime support patch] Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: Bump to v2.84Kevin Darbyshire-Bryant2021-02-08
| | | | | | | | | | dnsmasq v2.84rc2 has been promoted to release. No functional difference between v2.83test3 and v2.84/v2.84rc2 Backport 2 patches to fix the version reporting Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: switch to ubus-based hotplug callDaniel Golle2021-02-08
| | | | | | | | Use new ubus-based hotplug call in dhcp-script.sh As sysntpd now makes use of the new ubus-based hotplug calls, dnsmasq no longer needs to ship ACL to cover ntpd-hotplug. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: Update to 2.84test3Kevin Darbyshire-Bryant2021-01-24
| | | | | | | | | | | | | | | dnsmasq v2.83 has a bug in handling duplicate queries which means it may try to reply using the incorrect network socket. This is especially noticeable in dual stack environments where replies may be mis-directed to IPv4 addresses on an IPv6 socket or IPv6 addresses on an IPv4 socket. This results in system log spam such as: dnsmasq[16020]: failed to send packet: Network unreachable dnsmasq[16020]: failed to send packet: Address family not supported by protocol dnsmasq v2.84test3 resolves these issues. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: Update to version 2.83Hauke Mehrtens2021-01-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes the following security problems in dnsmasq: * CVE-2020-25681: Dnsmasq versions before 2.83 is susceptible to a heap-based buffer overflow in sort_rrset() when DNSSEC is used. This can allow a remote attacker to write arbitrary data into target device's memory that can lead to memory corruption and other unexpected behaviors on the target device. * CVE-2020-25682: Dnsmasq versions before 2.83 is susceptible to buffer overflow in extract_name() function due to missing length check, when DNSSEC is enabled. This can allow a remote attacker to cause memory corruption on the target device. * CVE-2020-25683: Dnsmasq version before 2.83 is susceptible to a heap-based buffer overflow when DNSSEC is enabled. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap- allocated memory. This flaw is caused by the lack of length checks in rtc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in Dnsmasq, resulting in a Denial of Service. * CVE-2020-25684: A lack of proper address/port check implemented in Dnsmasq version < 2.83 reply_query function makes forging replies easier to an off-path attacker. * CVE-2020-25685: A lack of query resource name (RRNAME) checks implemented in Dnsmasq's versions before 2.83 reply_query function allows remote attackers to spoof DNS traffic that can lead to DNS cache poisoning. * CVE-2020-25686: Multiple DNS query requests for the same resource name (RRNAME) by Dnsmasq versions before 2.83 allows for remote attackers to spoof DNS traffic, using a birthday attack (RFC 5452), that can lead to DNS cache poisoning. * CVE-2020-25687: Dnsmasq versions before 2.83 is vulnerable to a heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rtc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a Denial of Service. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: 'ipset' config sectionsAleksandr Mezin2020-11-11
| | | | | | | | | | | | | | | | | | | | | | | Allow configuring ipsets with dedicated config sections: config ipset list name 'ss_rules_dst_forward' list name 'ss_rules6_dst_forward' list domain 't.me' list domain 'telegram.org' instead of current, rather inconvenient syntax: config dnsmasq ... list ipset '/t.me/telegram.org/ss_rules_dst_forward,ss_rules6_dst_forward' Current syntax will still continue to work though. With this change, a LuCI GUI for DNS ipsets should be easy to implement. Signed-off-by: Aleksandr Mezin <mezin.alexander@gmail.com> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_RELEASE increase]
* dnsmasq: explictly set ednspacket_max valueJan Pavlinec2020-11-09
| | | | | | | This is related to DNS Flag Day 2020. It sets default ends buffer size value to 1232. Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
* dnsmasq: install /etc/hotplug.d/ntp/25-dnsmasqsec world-readableDaniel Golle2020-10-28
| | | | | | | | /etc/hotplug.d/ntp/25-dnsmasqsec is being sourced by /sbin/hotplug-call running as ntpd user. For that to work the file needs to be readable by that user. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: adapt to non-root ntpdDaniel Golle2020-10-25
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: fix handling ignore condition for dnssecYousong Zhou2020-09-25
| | | | | | | | | | It should return false to indicate that the option should not be ignored Fixes 064dc1e8 ("dnsmasq: abort when dnssec requested but not available") Reported-by: Sami Olmari <sami@olmari.fi> Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* dnsmasq: support tftp_unique_root in /etc/config/dhcpW. Michael Petullo2020-09-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | The TFTP server provided by dnsmasq supports serving a select boot image based on the client's MAC or IP address. This allows an administrator to activate this feature in /etc/config/dhcp. Here is an example /etc/config/dhcp that configures dnsmasq with --tftp-unique-root=mac: ... config dnsmasq option enable_tftp 1 option tftp_root /usr/libexec/tftpboot option tftp_unique_root mac config boot router option serveraddress 192.168.1.1 option servername tftp.example.com option filename openwrt-initramfs-kernel.bin ... With this configuration, dnsmasq will serve /usr/libexec/tftpboot/00-11-22-33-44-55/openwrt-initramfs-kernel.bin to the client with MAC address 00:11:22:33:44:55. Signed-off-by: W. Michael Petullo <mike@flyn.org>
* dnsmasq: abort when dnssec requested but not availableYousong Zhou2020-08-07
| | | | | | | | | | | | | | | | | | | | | | Before this commit, if uci option "dnssec" was set, we pass "--dnssec" and friends to dnsmasq, let it start and decide whether to quit and whether to emit message for diagnosis # dnsmasq --dnssec; echo $? dnsmasq: DNSSEC not available: set HAVE_DNSSEC in src/config.h 1 DNSSEC as a feature is different from others like dhcp, tftp in that it's a security feature. Better be explicit. With this change committed, we make it so by not allowing it in the first in the initscript, should dnsmasq later decides to not quit (not likely) or quit without above explicit error (unlikely but less so ;) So this is just being proactive. on/off choices with uci option "dnssec" are still available like before Link: https://github.com/openwrt/openwrt/pull/3265#issuecomment-667795302 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* dnsmasq: bump to 2.82Kevin Darbyshire-Bryant2020-07-20
| | | | | | | | | This fixes a nasty problem introduced in 2.81 which causes random crashes on systems where there's significant DNS activity over TCP. It also fixes DNSSEC validation problems with zero-TTL DNSKEY and DS records. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: add /etc/dnsmasq.d/ to conffilesSven Roederer2020-06-03
| | | | | | This directory can hold configuration-snippets which should also included in the backup. Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
* dnsmasq: hotplug script tidyupKevin Darbyshire-Bryant2020-05-10
| | | | | | | | Hotplug scripts are sourced so the #!/bin/sh is superfluous/deceptive. Re-arrange script to only source 'procd' if we get to the stage of needing to signal the process, reduce hotplug processing load a little. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: bump to v2.81Kevin Darbyshire-Bryant2020-04-12
| | | | Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: bump to 2.81rc5Kevin Darbyshire-Bryant2020-04-06
| | | | | | | | | | | | | | | | | | | | Bump to 2.81rc5 and re-work ipset-remove-old-kernel-support. More runtime kernel version checking is done in 2.81rc5 in various parts of the code, so expand the ipset patch' scope to inlude those new areas and rename to something a bit more generic.:wq Upstream changes from rc4 532246f Tweak to DNSSEC logging. 8caf3d7 Fix rare problem allocating frec for DNSSEC. d162bee Allow overriding of ubus service name. b43585c Fix nameserver list in auth mode. 3f60ecd Fixed resource leak on ubus_init failure. 0506a5e Handle old kernels that don't do NETLINK_NO_ENOBUFS. e7ee1aa Extend stop-dns-rebind to reject IPv6 LL and ULA addresses. We also reject the loopback address if rebind-localhost-ok is NOT set. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: bump to 2.81rc4Kevin Darbyshire-Bryant2020-03-29
| | | | Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: fix dnssec+ntp chicken-and-egg workaround (FS#2574)Henrique de Moraes Holschuh2020-03-25
| | | | | | | | | | | | | | | | | | | | | | | Fix the test for an enabled sysntp initscript in dnsmasq.init, and get rid of "test -o" while at it. Issue reproduced on openwrt-19.07 with the help of pool.ntp.br and an RTC-less ath79 router. dnssec-no-timecheck would be clearly missing from /var/etc/dnsmasq.conf.* while the router was still a few days in the past due to non-working DNSSEC + DNS-based NTP server config. The fix was tested with the router in the "DNSSEC broken state": it properly started dnsmasq in dnssec-no-timecheck mode, and eventually ntp was able to resolve the server name to an IP address, and set the system time. DNSSEC was then enabled by SIGINT through the ntp hotplug hook, as expected. A missing system.ntp.enabled UCI node is required for the bug to show up. The reasons for why it would be missing in the first place were not investigated. Signed-off-by: Henrique de Moraes Holschuh <henrique@nic.br> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_RELEASE increase]
* dnsmasq: add 'scriptarp' optionJordan Sokolic2020-03-22
| | | | | | | | | | | Add option 'scriptarp' to uci dnsmasq config to enable --script-arp functions. The default setting is false, meaning any scripts in `/etc/hotplug.d/neigh` intended to be triggered by `/usr/lib/dnsmasq/dhcp-script.sh` will fail to execute. Also enable --script-arp if has_handlers returns true. Signed-off-by: Jordan Sokolic <oofnik@gmail.com> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_RELEASE increase]
* dnsmasq: bump to v2.81rc3Kevin Darbyshire-Bryant2020-03-10
| | | | | | | Bump to latest release candidate and drop 2 local patches that have been upstreamed. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: bump to 2.81rc2 + 2 localKevin Darbyshire-Bryant2020-03-06
| | | | | | | | | Bump to dnsmasq 2.81rc2. In the process discovered several compiler warnings one with a logical error. 2 relevant patches sent upstream, added as 2 local patches for OpenWrt Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: bump to v2.81rc1Kevin Darbyshire-Bryant2020-03-04
| | | | | | | | | | 1st release candidate for v2.81 after 18 months. Refresh patches & remove all upstreamed leaving: 110-ipset-remove-old-kernel-support.patch Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: Activate PIE by defaultHauke Mehrtens2020-01-13
| | | | | | | | | | | | | | | | | | | This activates PIE ASLR support by default when the regular option is selected. This increases the binary size by 37% uncompressed and 18% compressed on MIPS BE. old: 146,933 /usr/sbin/dnsmasq 101,837 dnsmasq_2.80-14_mips_24kc.ipk new: 202,020 /usr/sbin/dnsmasq 120,577 dnsmasq_2.80-14_mips_24kc.ipk Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Acked-by: Petr Štetiar <ynezz@true.cz>
* dnsmasq: add uci-defaults script for config migrationDaniel Golle2020-01-09
| | | | | | | | | When running sysupgrade from an existing configuration, UCI option dhcp.@dnsmasq[0].resolvfile needs to be modified in case it has not been changed from it's original value. Accomplish that using a uci-defaults script. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: bump PKG_RELEASEDaniel Golle2020-01-07
| | | | | | | | Previous commit should have bumped PKG_RELEASE, but git add was forgotten... Add it now. Fixes: cd48d8d342 ("dnsmasq: switch to /tmp/resolv.conf.d/resolv.conf.auto") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: Fix potential dnsmasq crash with TCPHauke Mehrtens2020-01-06
| | | | | | | | | | | | | | | This is a backport from the dnsmasq master which should fix a bug which could cause a crash in dnsmasq. I saw the following crashes in my log: [522413.117215] do_page_fault(): sending SIGSEGV to dnsmasq for invalid read access from 2a001450 [522413.124464] epc = 004197f1 in dnsmasq[400000+23000] [522413.129459] ra = 004197ef in dnsmasq[400000+23000] This is happening in blockdata_write() when block->next is dereferenced, but I am not sure if this is related to this problem or if this is a different problem. I am unable to reproduce this problem. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: correct sense & usage of dnsseccheckunsignedKevin Darbyshire-Bryant2019-11-23
| | | | | | | | | | | | | dnsmasq v2.80 made 'dnssec-check-unsigned' the default, thus the uci option was rendered ineffectual: we checked unsigned zones no matter the setting. Disabling the checking of unsigned zones is now achieve with the "--dnssec-check-unsigned=no" dnsmasq option. Update init script to pass required option in the disabled case. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Powered by cgit, Themed by Ted Yin.