aboutsummaryrefslogtreecommitdiff
path: root/package/network/services/dnsmasq/files/dnsmasq.init
Commit message (Collapse)AuthorAge
* dnsmasq: fix start if dhcp-range is not correctFlorian Eckert2025-05-29
| | | | | | | | | | | | | | | | | | | | If the uci 'dhcp' configuration for the dhcp leases is incorrect then the call to 'ipclac' fails. However, the problem is that the dnsmasq configuration option 'dhcp-range' is still written for this uci section even though the information generated by ipcalc is incorrect or not set. Due to the incorrectly generated configuration for dnsmasq, the service cannot start. To prevent an incorrect configuration from being written to the configuration, a check is now made beforehand to ensure that the required variables are present and valid. If the configuration is incorrect, a message is emitted to the log that this configuration section is incorrect and this uci configuration section is omitted. Signed-off-by: Florian Eckert <fe@dev.tdt.de> Link: https://github.com/openwrt/openwrt/pull/18641 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: fix handlers for options `filter_rr` and `cache_rr`Eric ZHANG2025-03-09
| | | | | | | | | | | | | | | | | | According to: - https://github.com/openwrt/luci/blob/master/modules/luci-mod-network/htdocs/luci-static/resources/view/network/dhcp.js#L700 - https://github.com/openwrt/luci/blob/master/modules/luci-mod-network/htdocs/luci-static/resources/view/network/dhcp.js#L402 These two options should be of type `MultiValue` but here there're used as single value. This results in dnsmasq crashes when either of these options are set with multiple values, which leads to an invalid space-separated value. As these options are designed to take multiple values, I think it's better to use list format eg. `list filter_rr 'AAAA'`, instead of `option filter_rr 'AAAA,HTTPS'`. See: https://forum.openwrt.org/t/selecting-more-than-one-filter-arbitrary-rr-or-cache-arbitrary-rr-in-v24-10-0-crashes-dnsmasq/225801 Tested on 24.10.0 Signed-off-by: Eric ZHANG <ericzhangjx@outlook.com> Link: https://github.com/openwrt/openwrt/pull/18149 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* dnsmasq: pass environment variables to hotplugChuck R2024-12-12
| | | | | | | | | | | | | | | | | | | | dnsmasq passes a limited amount of information via DHCP script arguments. Much more information is available through environment variables starting with DNSMASQ_, such as DNSMASQ_INTERFACE. However, when the dhcp-script builds its JSON environment and passes it to hotplug, all of this information is discarded since it is not copied to the JSON environment. Personally, I have a custom-made set of DDNS scripts and rely on environment variables such as DNSMASQ_INTERFACE in order to determine which DNS zones to update. So, not being able to access these variables was detrimental to me. I patched in a quick copy of all DNSMASQ_ variables to the JSON environment so that they can be used in hotplug scripts. In order to do so I also copied /usr/bin/env into dnsmasq's chroot jail. Signed-off-by: Chuck R <github@chuck.cloud> Link: https://github.com/openwrt/openwrt/pull/16354 Signed-off-by: John Crispin <john@phrozen.org>
* dnsmasq: gate configdir usage behind absolute path checkPaul Donald2024-10-20
| | | | | | | | don't use configuration directories which are relative Signed-off-by: Paul Donald <newtwen+github@gmail.com> Link: https://github.com/openwrt/openwrt/pull/14975 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: add handling of `dns-rr` to init script (add arbitrary resource ↵Paul Donald2024-10-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | records) Add support for handling of DNS RR (Resource Records) requests, which are needed for the HTTPS Type 65 records, introduced to support the DNS-based Service Discovery (DNS-SD) mechanism for HTTPS services and defined in the RFC 9460 (9.1. Query Names for HTTPS RRs). Ref: https://forum.openwrt.org/t/resolving-query-type-65-to-local-address-for-ios-clients-in-dnsmasq/179504/11 uci config usage: config dnsrr option rrname 'foo.example.com' option rrnumber '65' option hexdata '00' hexdata is optional. Available since dnsmasq 2.62 (for around 12 years at this point). Note: dnsmasq dns-rr are not affected by filter-rr Tested on 22.03.5 Signed-off-by: Paul Donald <newtwen+github@gmail.com> Tested-by: Vladimir Kochkovski <ask@getvladimir.com> Link: https://github.com/openwrt/openwrt/pull/14975 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: quoted path variablesPaul Donald2024-10-20
| | | | | | | | | | Prevents problems when variables contain spaces. Tested on: 23.05.3 Signed-off-by: Paul Donald <newtwen+github@gmail.com> Link: https://github.com/openwrt/openwrt/pull/14975 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: add 'extraconftext' parameterPaul Donald2024-10-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Users can now freely add new dnsmasq parameters (i.e. a whole config) via extraconf. This means users can add their own parameters without changes to init or GUI. Co-opted the default of confdir also to include the instance name. This way each instance gets its own .d directory (and separate instances do not all inherit the same 'extraconftext'). Usage: config dnsmasq 'config' ... option extraconftext 'cache-size=2048\nlog-async=20' config dnsmasq 'blah' ... option extraconftext 'cache-size=128\nlog-async=5' or even (which would produce staggered output but still valid) config dnsmasq 'blah' ... option extraconftext 'cache-size=128 log-async=5' See https://forum.openwrt.org/t/add-dnsmasq-custom-options-field-in-luci-gui/193184 Tested on: 23.05.3, 22.03.6 Signed-off-by: Paul Donald <newtwen+github@gmail.com> Tested-by: Vladimir Kochkovski <ask@getvladimir.com> Link: https://github.com/openwrt/openwrt/pull/14975 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: add handling of `cache-rr` to init scriptPaul Donald2024-10-20
| | | | | | | | | | | | | | | | | | | | | | | | | dnsmasq v2.90 introduced `--cache-rr=<rrtype>[,<rrtype>...]`. uci config usage: config dnsmasq ... option cache_rr 'AAAA,CNAME,NXDOMAIN,SRV,...' The dnsmasq instance internally builds a linked list of RR to cache from the individually supplied parameters, so it's allowed to provide multiples: ... --cache-rr=AAAA --cache-rr=A ... See https://forum.openwrt.org/t/resolving-query-type-65-to-local-address-for-ios-clients-in-dnsmasq/179504 Tested on: 23.05.2 Signed-off-by: Paul Donald <newtwen+github@gmail.com> Tested-by: Vladimir Kochkovski <ask@getvladimir.com> Link: https://github.com/openwrt/openwrt/pull/14975 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: add handling of `filter-rr` to init scriptPaul Donald2024-10-20
| | | | | | | | | | | | | | | | | | | | | | | | | dnsmasq v2.90 introduced `--filter-rr=<rrtype>[,<rrtype>...]`. uci config usage: config dnsmasq ... option filter_rr 'AAAA,CNAME,NXDOMAIN,SRV,...' The dnsmasq instance internally builds a linked list of RR to filter from the individually supplied parameters, so it's harmless to provide synonyms: ... --filter-A --filter-rr=A ... See https://forum.openwrt.org/t/resolving-query-type-65-to-local-address-for-ios-clients-in-dnsmasq/179504/23 Tested on: 23.05.2 Signed-off-by: Paul Donald <newtwen+github@gmail.com> Tested-by: Vladimir Kochkovski <ask@getvladimir.com> Link: https://github.com/openwrt/openwrt/pull/14975 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: Add EDNS0 Upstream supportCarsten Schuette2024-08-24
| | | | | | | | Forward client mac address and subnet on dns queries. Pi-hole and Adguard use this feature to send the originators ip address/subnet so it can be logged and not just the nat address of the router. This feature has been added since version 2.56 of dnsmasq and would be nice to expose this feature in openwrt. Signed-off-by: Carsten Schuette <schuettecarsten@googlemail.com> Link: https://github.com/openwrt/openwrt/pull/15965 Signed-off-by: Robert Marko <robimarko@gmail.com>
* dnsmasq: Fix wrong format for --dhcp-boot optionJulius Lehmann2024-02-26
| | | | | | dnsmasq --dhcp-boot option uses 'tag' instead of 'net' to specify tags Signed-off-by: Julius Lehmann <lehmanju@devpi.de>
* dnsmasq: rework network interface ignoreYegor Yefremov2024-02-22
| | | | | | | | | | | | | In some situations (slow protocol or interfaces with auto 0), the interfaces are not available during the dnsmasq initialization and hence, the ignore setting will be skipped. Install an interface trigger for ignored interfaces in case their ifname cannot be resolved. Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com> [bump PKG_RELEASE] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* dnsmasq: invert logic for "localuse"Thibaut VARÈNE2023-12-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prior to this commit, "localuse" (which enables local resolving through dnsmsasq) was off by "default". That default was in turn overridden when "noresolv" was unset (which itself is the default for "noresolv") *and* "resolvfile" was "/tmp/resolv.conf.d/resolv.conf.auto" (also the default for this parameter). In other words, the "default" unset value for "localuse" would only be ever used in specific *non-default* configurations. However, the problem with that logic is that a user who wants to ignore their ISP-provided resolvers by setting "noresolv" to true ends up with a device that will *only use* said resolvers for local DNS queries, serving clients' queries via dnsmasq (which now ignores the ISP resolvers). This can lead to confusion and break random setups as the DNS lookup performed on clients behalf can differ in their replies from DNS lookups performed locally on the router. Furthermore, "localuse" is not configurable through Luci, contrary to the other two involved settings, adding further confusion for the end user. To work around this situation, the logic that sets "localuse" is inverted: "localuse" now defaults to on by default, and IFF "noresolv" is unset (default) AND "resolvfile" is changed from default THEN "localuse" gets turned back off, allowing for more sensible behaviour. "localuse" value set in config/dhcp still overrides the logic in all cases, as it did already. Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
* dnsmasq: Invoke new ipcalc with CIDR notationPhilip Prindeville2023-11-15
| | | | | | | | | | | | | | | | | | | The new rewritten ipcalc.sh understands 3 notations: ipaddr/prefix ... ipaddr/dotted-netmask ... ipaddr dotted-netmask ... meaning that the previous 4th non-standard notation of "ipaddr prefix" will be dropped, alas that's the notation that dnsmasq currently uses. This change has us using the first notation which is the most common. This behavior came in as https://github.com/openwrt/openwrt/commit/eda27e8382f3e5253defab5419e95d4b51f72de3 a long time ago. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* dnsmasq: don't source functions.sh twicePhilip Prindeville2023-11-02
| | | | | | | | | | It's already pulled in from /etc/rc.common. Fixes: #13758 Fixes: 6b23836071b1 ("package: avoid the use of eval to parse ipcalc.sh output") Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* dnsmasq: add support for RA option 31Rahul Thakur2023-10-20
| | | | | | | | | | | | | The option 31 in the RA specifies the DNS search list, the support to configure this via UCI is missing in case dnsmasq-dhcpv6 is used. This commit uses the uci option domain (same as is done by odhcpd) to read and pass the DNS search list to dnsmasq, which is then used by RA. Hence, with this commit, we are able to configure DNS search list for the RA messages via the uci config when dnsmsaq-dhcpv6 is used. Signed-off-by: Rahul Thakur <rahul.thakur@iopsys.eu>
* package: dnsmasq: remove off-by-one mitigation for limitLeon M. Busch-George2023-09-25
| | | | | | | | | In the dnsmasq init script, an off-by-one in the range calculation of ipcalc.sh was mitigated by passing the limit as if its counting started at zero. This patch removes the mitigation as the off-by-one has been fixed. Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
* package: avoid the use of eval to parse ipcalc.sh outputLeon M. Busch-George2023-09-25
| | | | | | | | | | | Add a function 'ipcalc' to /lib/functions.sh that sets variables more safely using export. With this new function, dnsmasq also handles the return value of ipcalc correctly. Fixes: e4bd3de1be8e ("dnsmasq: refuse to add empty DHCP range") Co-Authored-By: Philip Prindeville <philipp@redfish-solutions.com> Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
* dnsmasq: configure dynamic dhcp6 and dhcp4 independentlyIan Dall2023-04-01
| | | | | | | | Given ipv6 has SLAAC it is quite plausible to wish to use dynamic dhcp4 but static dhcp6. This patch keeps dynamicdhcp as the default option for both, but is overridden by dynamicdhcpv6 or dynamicdhcpv4 Signed-off-by: Ian Dall <ian@beware.dropbear.id.au>
* dnsmasq: add dhcphostsfile to ujail sandboxRuben Jenster2023-04-01
| | | | | | | The dhcphostsfile must be mounted into the (ujail) sandbox. The file can not be accessed without this mount. Signed-off-by: Ruben Jenster <rjenster@gmail.com>
* dnsmasq: refuse to add empty DHCP rangeLeon M. George2023-02-07
| | | | | | | | | | | | Use ipcalc's return value to react to invalid range specifications. By simply ignoring the range instead of aborting with an error code, dnsmasq should still start when there's an error (best effort). Aborting the config generation or working with invalid range specs leaves dnsmasq crash-looping which is the right thing to do concerning that particular interface but it also hinders DHCP service on other interfaces and DNS on the router itself. Signed-off-by: Leon M. George <leon@georgemail.eu>
* dnsmasq: add option to expose additional paths to jailDaniel Golle2022-11-27
| | | | | | | | | | Add new UCI list 'addn_mount' allowing the expose additional filesystem paths to the jailed dnsmasq process. This is useful e.g. in case of manually configured includes to the configuration file or symlinks pointing outside of the exposed paths as used by e.g. the safe-search package in the packages feed. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: add support for filter-AAAA/AChen Minqiang2022-11-12
| | | | | | | | This add --filter-A and --filter-AAAA options, to remove IPv4 or IPv6 addresses from DNS answers. these options is supported since version 2.87. Co-authored-by: NueXini <nuexini@alumni.tongji.edu.cn> Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
* dnsmasq: Support nftables nftsetsKevin Darbyshire-Bryant2022-11-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add build option for nftables sets. By default disable iptables ipset support. By default enable nftable nftset support since this is what fw4 uses. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> dnsmasq: nftset: serve from ipset config Use existing ipset configs as source for nftsets to be compatible with existing configs. As the OS can either have iptables XOR nftables support, it's fine to provide both to dnsmasq. dnsmasq will silently fail for the present one. Depending on the dnsmasq compile time options, the ipsets or nftsets option will not be added to the dnsmasq config file. dnsmasq will try to add the IP addresses to all sets, regardless of the IP version defined for the set. Adding an IPv6 to an IPv4 set and vice versa will silently fail. Signed-off-by: Mathias Kresin <dev@kresin.me> dnsmasq: support populating nftsets in addition to ipsets Tell dnsmasq to populate nftsets instead of ipsets, if firewall4 is present in the system. Keep the same configuration syntax in /etc/config/dhcp, for compatibility purposes. Huge thanks to Jo-Philipp Wich for basically writing the function. Signed-off-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com> dnsmasq: obtain nftset ip family from nft Unfortunately dnsmasq nft is noisy if an attempt to add a mismatched ip address family to an nft set is made. Heuristic to guess which ip family a nft set might belong by inferring from the set name. In order of preference: If setname ends with standalone '4' or '6' use that, else if setname has '4' or '6' delimited by '-' or '_' use that (eg foo-4-bar) else If setname begins with '4' or '6' standalone use that. By standalone I mean not as part of a larger number eg. 24 If the above fails then use the existing nft set query mechanism and if that fails, well you're stuffed! With-thanks-to: Jo-Philipp Wich <jo@mein.io> who improved my regexp knowledge. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> dnsmasq: specify firewall table for nftset Permit ipsets to specify an nftables table for the set. New config parameter is 'table'. If not specified the default of 'fw4' is used. config ipset list name 'BK_4,BK_6' option table 'dscpclassify' option table_family 'ip' option family '4' list domain 'ms-acdc.office.com' list domain 'windowsupdate.com' list domain 'update.microsoft.com' list domain 'graph.microsoft.com' list domain '1drv.ms' list domain '1drv.com' The table family can also be specified, usually 'ip' or 'ip6' else the default 'inet' capable of both ipv4 & ipv6 is used. If the table family is not specified then finally a family option is available to specify either '4' or '6' for ipv4 or ipv6 respectively. This is all in addition to the existing heuristic that will look in the nftset name for an ip family clue, or in total desperation, query the value from the nftset itself. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: fix jail_mount for serversfileBruno Victal2022-05-02
| | | | | | Fix 'serversfile' option not being jail_mounted by the init script. Signed-off-by: Bruno Victal <brunovictal@outlook.com>
* dnsmasq: add logfacility file to jail mountsDaniel Golle2022-04-25
| | | | | | | | If logfacility is a path to a file it needs to be r/w mounted in the sandbox as well for dnsmasq to work. Reported-by: @iointerrupt Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: add procd interface index trackingValentyn Datsko2022-04-06
| | | | | | | | | | | | | Problem exist when dnsmasq is exclusively bind to particular interface. After reconfiguring or restarting this interface, its index changes, but dnsmasq uses the old one. When this problem occurs, dnsmasq does not listen on the correct interface so DHCP does not work, and clients do not get an IP address. Procd netdev param can be added to restart dnsmasq when the interface index is changed. Signed-off-by: Valentyn Datsko <valikk.d@gmail.com> [combined into a single &&-connected statement] Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: fix ismounted checkOldřich Jedlička2021-11-23
| | | | | | | | Fix the return value, shell return codes should be 0 to indicate success (i.e. mount point found), 1 should be failure (i.e. mount point not-found). Fixes: ac4e8aa ("dnsmasq: fix more dnsmasq jail issues") Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>
* dnsmasq: add match_tag for --dhcp-hostPaul Fertser2021-11-09
| | | | | | | | | | | | | | | | | | | A set of tags can be specified for --dhcp-host option to restrict the assignment to the requests which match all the tags. Example usage: config vendorclass option networkid 'udhcp' option vendorclass 'udhcp' config host option mac '*:*:*:*:*:*' list match_tag 'switch.10' list match_tag 'udhcp' option ip '192.168.25.10' Signed-off-by: Paul Fertser <fercerpav@gmail.com>
* dnsmasq: fix jail mount in case of ignore_hosts_dir being setDaniel Golle2021-11-01
| | | | | | | | | Commit a2fcd3900c ("dnsmasq: improve init script") broke the existing handling for hosts_dir. Remove the redundant mount again to fix it. Reported-by: Hartmut Birr <e9hack@gmail.com> Fixes: a2fcd3900c ("dnsmasq: improve init script") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: improve init scriptDaniel Golle2021-10-31
| | | | | | | | * fix restart in LuCI (inherited umask was to restrictive) * make directory of hosts-file (!= /tmp) accessible in ujail Reported-by: Hannu Nyman <hannu.nyman@iki.fi> Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: add explicit "set:" for client-matching optionsPaul Fertser2021-10-03
| | | | | | | | | Bring the usage in line with the dnsmasq man page and the other options where set: is mandatory. No functional change. Signed-off-by: Paul Fertser <fercerpav@gmail.com>
* dnsmasq: add config option for connmark DNS filteringEtan Kissling2021-09-14
| | | | | | | | | This adds uci support to configure connmark based DNS filtering. Signed-off-by: Etan Kissling <etan_kissling@apple.com> (imported from upstream mailing list https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q2/015151.html) Signed-off-by: Etan Kissling <etan.kissling@gmail.com>
* dnsmasq: reset EXTRA_MOUNT in the right placeDaniel Golle2021-08-01
| | | | | | | | | EXTRA_MOUNT variable should be reset in dnsmasq_start() rather than just once at the beginning of the script. Fixes: ac4e8aa2f8 ("dnsmasq: fix more dnsmasq jail issues") Reported-by: Hartmut Birr <e9hack@gmail.com> Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: fix more dnsmasq jail issuesDaniel Golle2021-08-01
| | | | | | | | | | | | * remove superflus mounts of /dev/null and /dev/urandom * reset EXTRA_MOUNTS at the beginning of the script * add mount according to ignore_hosts_dir * don't add mount for file which is inside a directory already in the EXTRA_MOUNTS list Fixes: 59c63224e1 ("dnsmasq: rework jail mounts") Reported-by: Hartmut Birr <e9hack@gmail.com> Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: rework jail mountsDaniel Golle2021-08-01
| | | | | | | | | | | | * split into multiple lines to improve readability * use EXTRA_MOUNT for addnhosts instead of blindly adding /tmp/hosts * remove no longer needed mount for /sbin/hotplug-call * add dhcp-script.sh dependencies (jshn, ubus) Fixes: 3a94c2ca5c ("dnsmasq: add /tmp/hosts/ to jail_mount") Fixes: aed95c4cb8 ("dnsmasq: switch to ubus-based hotplug call") Reported-by: Stijn Tintel <stijn@linux-ipv6.be> Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: add /tmp/hosts/ to jail_mountNick Hainke2021-07-19
| | | | | | | Programs like the olsr-name-plugin write hostname files to "/tmp/hosts/". If you don't add this to the jail_mount, dnsmasq can't read it anymore. Signed-off-by: Nick Hainke <vincent@systemli.org>
* dnsmasq: use local option for local domain parameterKevin Darbyshire-Bryant2021-07-05
| | | | | | | | | '--local' is a synonym for '--server' so let's use '--local' in the resultant config file for uci's 'local' instead of uci's local parameter being turned into '--server'. Slightly less confusion all round. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: distinct Ubus names for multiple instancesEtan Kissling2021-06-29
| | | | | | | | | | | | | | | | | | | | | | | | Currently, when using multiple dnsmasq instances they are all assigned to the same Ubus instance name. This does not work, as only a single instance can register with Ubus at a time. In the log, this leads to `Cannot add object to UBus: Invalid argument` error messages. Furthermore, upstream 3c93e8eb41952a9c91699386132d6fe83050e9be changes behaviour so that instead of the log, dnsmasq exits at start instead. With this patch, all dnsmasq instances are assigned unique names so that they can register with Ubus concurrently. One of the enabled instances is always assigned the previous default name "dnsmasq" to avoid breaking backwards compatibility with other software relying on that default. Previously, a random instance got assigned that name (while the others produced error logs). Now, the first unnamed dnsmasq config section is assigned the default name. If there are no unnamed dnsmasq sections the first encountered named dnsmasq config section is assigned instead. A similar issue exists for Dbus and was similarly addressed. Signed-off-by: Etan Kissling <etan.kissling@gmail.com> [tweaked commit message] dnsmasq was not crashing it is exiting Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* Revert "dnsmasq: add config option for connmark DNS filtering"Kevin Darbyshire-Bryant2021-06-26
| | | | | | | | | This reverts commit dea4bae7c2b963af02e1e3e3bdb5cd656a5ea3d3. dnsmasq v2.86test3 has some issues with ubus and needs reverting, hence this needs reverting. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: add config option for connmark DNS filteringEtan Kissling2021-06-26
| | | | | | | | This adds uci support to configure connmark based DNS filtering. Signed-off-by: Etan Kissling <etan_kissling@apple.com> (See https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q2/015151.html) Signed-off-by: Etan Kissling <etan.kissling@gmail.com>
* dnsmasq: add ignore hosts dir to dnsmasq init scriptJoão Henriques2021-04-24
| | | | | | | | When running multiple instances of dnsmasq, for example one being for the lan and another for a guest network, it might not be desirable to have the same dns names configured in both networks Signed-off-by: João Henriques <joaoh88@gmail.com>
* dnsmasq: 'ipset' config sectionsAleksandr Mezin2020-11-11
| | | | | | | | | | | | | | | | | | | | | | | Allow configuring ipsets with dedicated config sections: config ipset list name 'ss_rules_dst_forward' list name 'ss_rules6_dst_forward' list domain 't.me' list domain 'telegram.org' instead of current, rather inconvenient syntax: config dnsmasq ... list ipset '/t.me/telegram.org/ss_rules_dst_forward,ss_rules6_dst_forward' Current syntax will still continue to work though. With this change, a LuCI GUI for DNS ipsets should be easy to implement. Signed-off-by: Aleksandr Mezin <mezin.alexander@gmail.com> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_RELEASE increase]
* dnsmasq: include IPv6 local nameserver entryJoel Johnson2020-10-26
| | | | | | | | | For IPv6 native connections when using IPv6 DNS lookups, there is no valid default resolver if ignoring WAN DHCP provided nameservers. This uses a runtime check to determine if IPv6 is supported on the host. Signed-off-by: Joel Johnson <mrjoel@lixil.net>
* dnsmasq: fix handling ignore condition for dnssecYousong Zhou2020-09-25
| | | | | | | | | | It should return false to indicate that the option should not be ignored Fixes 064dc1e8 ("dnsmasq: abort when dnssec requested but not available") Reported-by: Sami Olmari <sami@olmari.fi> Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* dnsmasq: support tftp_unique_root in /etc/config/dhcpW. Michael Petullo2020-09-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | The TFTP server provided by dnsmasq supports serving a select boot image based on the client's MAC or IP address. This allows an administrator to activate this feature in /etc/config/dhcp. Here is an example /etc/config/dhcp that configures dnsmasq with --tftp-unique-root=mac: ... config dnsmasq option enable_tftp 1 option tftp_root /usr/libexec/tftpboot option tftp_unique_root mac config boot router option serveraddress 192.168.1.1 option servername tftp.example.com option filename openwrt-initramfs-kernel.bin ... With this configuration, dnsmasq will serve /usr/libexec/tftpboot/00-11-22-33-44-55/openwrt-initramfs-kernel.bin to the client with MAC address 00:11:22:33:44:55. Signed-off-by: W. Michael Petullo <mike@flyn.org>
* dnsmasq: abort dhcp_check on interface stateDavid Bauer2020-08-20
| | | | | | | | | Abort the dhcp-check based on the interface instead of the carrier state. In cases where the interface is up but the carrier is down, netifd won't cause a dnsmasq reload, thus dhcp won't become active on this interface. Signed-off-by: David Bauer <mail@david-bauer.net>
* dnsmasq: abort when dnssec requested but not availableYousong Zhou2020-08-07
| | | | | | | | | | | | | | | | | | | | | | Before this commit, if uci option "dnssec" was set, we pass "--dnssec" and friends to dnsmasq, let it start and decide whether to quit and whether to emit message for diagnosis # dnsmasq --dnssec; echo $? dnsmasq: DNSSEC not available: set HAVE_DNSSEC in src/config.h 1 DNSSEC as a feature is different from others like dhcp, tftp in that it's a security feature. Better be explicit. With this change committed, we make it so by not allowing it in the first in the initscript, should dnsmasq later decides to not quit (not likely) or quit without above explicit error (unlikely but less so ;) So this is just being proactive. on/off choices with uci option "dnssec" are still available like before Link: https://github.com/openwrt/openwrt/pull/3265#issuecomment-667795302 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* dnsmasq: always inform about disabled dhcp servicePetr Štetiar2020-04-30
| | | | | | | | | | | | | | | | | Init script checks for an already active DHCP server on the interface and if such DHCP server is found, then it logs "refusing to start DHCP" message, starts dnsmasq without DHCP service unless `option force 1` is set and caches the DHCP server check result. Each consecutive service start then uses this cached DHCP server check result, but doesn't provide log feedback about disabled DHCP service anymore. So this patch ensures, that the log message about disabled DHCP service on particular interface is always provided. Acked-by: Hans Dedecker <dedeckeh@gmail.com> Signed-off-by: Petr Štetiar <ynezz@true.cz>
* dnsmasq: fix dnssec+ntp chicken-and-egg workaround (FS#2574)Henrique de Moraes Holschuh2020-03-25
| | | | | | | | | | | | | | | | | | | | | | | Fix the test for an enabled sysntp initscript in dnsmasq.init, and get rid of "test -o" while at it. Issue reproduced on openwrt-19.07 with the help of pool.ntp.br and an RTC-less ath79 router. dnssec-no-timecheck would be clearly missing from /var/etc/dnsmasq.conf.* while the router was still a few days in the past due to non-working DNSSEC + DNS-based NTP server config. The fix was tested with the router in the "DNSSEC broken state": it properly started dnsmasq in dnssec-no-timecheck mode, and eventually ntp was able to resolve the server name to an IP address, and set the system time. DNSSEC was then enabled by SIGINT through the ntp hotplug hook, as expected. A missing system.ntp.enabled UCI node is required for the bug to show up. The reasons for why it would be missing in the first place were not investigated. Signed-off-by: Henrique de Moraes Holschuh <henrique@nic.br> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_RELEASE increase]
Powered by cgit, Themed by Ted Yin.