mirror of https://github.com/hak5/openwrt.git
dnsmasq: bump to v2.81rc1
1st release candidate for v2.81 after 18 months. Refresh patches & remove all upstreamed leaving: 110-ipset-remove-old-kernel-support.patch Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>master
Kevin Darbyshire-Bryant
parent
633c5137df
commit
3251ac8f2d
|
|
@ -8,13 +8,13 @@
|
|||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=dnsmasq
|
||||
PKG_UPSTREAM_VERSION:=2.80
|
||||
PKG_UPSTREAM_VERSION:=2.81rc1
|
||||
PKG_VERSION:=$(subst test,~~test,$(subst rc,~rc,$(PKG_UPSTREAM_VERSION)))
|
||||
PKG_RELEASE:=18
|
||||
PKG_RELEASE:=1
|
||||
|
||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_UPSTREAM_VERSION).tar.xz
|
||||
PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq
|
||||
PKG_HASH:=cdaba2785e92665cf090646cba6f94812760b9d7d8c8d0cfb07ac819377a63bb
|
||||
PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq/release-candidates
|
||||
PKG_HASH:=47afc967fb3d673d1700ebfa2192ab1436197fa6e135e335f0d0ef17cdb2f0fc
|
||||
|
||||
PKG_LICENSE:=GPL-2.0
|
||||
PKG_LICENSE_FILES:=COPYING
|
||||
|
|
@ -130,7 +130,7 @@ Package/dnsmasq-full/conffiles = $(Package/dnsmasq/conffiles)
|
|||
TARGET_CFLAGS += -flto
|
||||
TARGET_LDFLAGS += -flto=jobserver
|
||||
|
||||
COPTS = -DHAVE_UBUS \
|
||||
COPTS = -DHAVE_UBUS -DHAVE_POLL_H \
|
||||
$(if $(CONFIG_IPV6),,-DNO_IPV6)
|
||||
|
||||
ifeq ($(BUILD_VARIANT),nodhcpv6)
|
||||
|
|
|
|||
|
|
@ -1,495 +0,0 @@
|
|||
From a799ca0c6314ad73a97bc6c89382d2712a9c0b0e Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Thu, 18 Oct 2018 19:35:29 +0100
|
||||
Subject: [PATCH 01/32] Impove cache behaviour for TCP connections.
|
||||
|
||||
For ease of implementaion, dnsmasq has always forked a new process to
|
||||
handle each incoming TCP connection. A side-effect of this is that any
|
||||
DNS queries answered from TCP connections are not cached: when TCP
|
||||
connections were rare, this was not a problem. With the coming of
|
||||
DNSSEC, it's now the case that some DNSSEC queries have answers which
|
||||
spill to TCP, and if, for instance, this applies to the keys for the
|
||||
root then those never get cached, and performance is very bad. This
|
||||
fix passes cache entries back from the TCP child process to the main
|
||||
server process, and fixes the problem.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
CHANGELOG | 14 ++++
|
||||
src/blockdata.c | 37 ++++++++-
|
||||
src/cache.c | 196 ++++++++++++++++++++++++++++++++++++++++++++++--
|
||||
src/dnsmasq.c | 58 ++++++++++++--
|
||||
src/dnsmasq.h | 5 ++
|
||||
5 files changed, 291 insertions(+), 19 deletions(-)
|
||||
|
||||
--- a/CHANGELOG
|
||||
+++ b/CHANGELOG
|
||||
@@ -1,3 +1,17 @@
|
||||
+version 2.81
|
||||
+ Impove cache behaviour for TCP connections. For ease of
|
||||
+ implementaion, dnsmasq has always forked a new process to handle
|
||||
+ each incoming TCP connection. A side-effect of this is that
|
||||
+ any DNS queries answered from TCP connections are not cached:
|
||||
+ when TCP connections were rare, this was not a problem.
|
||||
+ With the coming of DNSSEC, it's now the case that some
|
||||
+ DNSSEC queries have answers which spill to TCP, and if,
|
||||
+ for instance, this applies to the keys for the root then
|
||||
+ those never get cached, and performance is very bad.
|
||||
+ This fix passes cache entries back from the TCP child process to
|
||||
+ the main server process, and fixes the problem.
|
||||
+
|
||||
+
|
||||
version 2.80
|
||||
Add support for RFC 4039 DHCP rapid commit. Thanks to Ashram Method
|
||||
for the initial patch and motivation.
|
||||
--- a/src/blockdata.c
|
||||
+++ b/src/blockdata.c
|
||||
@@ -61,7 +61,7 @@ void blockdata_report(void)
|
||||
blockdata_alloced * sizeof(struct blockdata));
|
||||
}
|
||||
|
||||
-struct blockdata *blockdata_alloc(char *data, size_t len)
|
||||
+static struct blockdata *blockdata_alloc_real(int fd, char *data, size_t len)
|
||||
{
|
||||
struct blockdata *block, *ret = NULL;
|
||||
struct blockdata **prev = &ret;
|
||||
@@ -89,8 +89,17 @@ struct blockdata *blockdata_alloc(char *
|
||||
blockdata_hwm = blockdata_count;
|
||||
|
||||
blen = len > KEYBLOCK_LEN ? KEYBLOCK_LEN : len;
|
||||
- memcpy(block->key, data, blen);
|
||||
- data += blen;
|
||||
+ if (data)
|
||||
+ {
|
||||
+ memcpy(block->key, data, blen);
|
||||
+ data += blen;
|
||||
+ }
|
||||
+ else if (!read_write(fd, block->key, blen, 1))
|
||||
+ {
|
||||
+ /* failed read free partial chain */
|
||||
+ blockdata_free(ret);
|
||||
+ return NULL;
|
||||
+ }
|
||||
len -= blen;
|
||||
*prev = block;
|
||||
prev = &block->next;
|
||||
@@ -100,6 +109,10 @@ struct blockdata *blockdata_alloc(char *
|
||||
return ret;
|
||||
}
|
||||
|
||||
+struct blockdata *blockdata_alloc(char *data, size_t len)
|
||||
+{
|
||||
+ return blockdata_alloc_real(0, data, len);
|
||||
+}
|
||||
|
||||
void blockdata_free(struct blockdata *blocks)
|
||||
{
|
||||
@@ -148,5 +161,21 @@ void *blockdata_retrieve(struct blockdat
|
||||
|
||||
return data;
|
||||
}
|
||||
-
|
||||
+
|
||||
+
|
||||
+void blockdata_write(struct blockdata *block, size_t len, int fd)
|
||||
+{
|
||||
+ for (; len > 0 && block; block = block->next)
|
||||
+ {
|
||||
+ size_t blen = len > KEYBLOCK_LEN ? KEYBLOCK_LEN : len;
|
||||
+ read_write(fd, block->key, blen, 0);
|
||||
+ len -= blen;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+struct blockdata *blockdata_read(int fd, size_t len)
|
||||
+{
|
||||
+ return blockdata_alloc_real(fd, NULL, len);
|
||||
+}
|
||||
+
|
||||
#endif
|
||||
--- a/src/cache.c
|
||||
+++ b/src/cache.c
|
||||
@@ -26,6 +26,8 @@ static union bigname *big_free = NULL;
|
||||
static int bignames_left, hash_size;
|
||||
|
||||
static void make_non_terminals(struct crec *source);
|
||||
+static struct crec *really_insert(char *name, struct all_addr *addr,
|
||||
+ time_t now, unsigned long ttl, unsigned short flags);
|
||||
|
||||
/* type->string mapping: this is also used by the name-hash function as a mixing table. */
|
||||
static const struct {
|
||||
@@ -464,16 +466,10 @@ void cache_start_insert(void)
|
||||
new_chain = NULL;
|
||||
insert_error = 0;
|
||||
}
|
||||
-
|
||||
+
|
||||
struct crec *cache_insert(char *name, struct all_addr *addr,
|
||||
time_t now, unsigned long ttl, unsigned short flags)
|
||||
{
|
||||
- struct crec *new, *target_crec = NULL;
|
||||
- union bigname *big_name = NULL;
|
||||
- int freed_all = flags & F_REVERSE;
|
||||
- int free_avail = 0;
|
||||
- unsigned int target_uid;
|
||||
-
|
||||
/* Don't log DNSSEC records here, done elsewhere */
|
||||
if (flags & (F_IPV4 | F_IPV6 | F_CNAME))
|
||||
{
|
||||
@@ -484,7 +480,20 @@ struct crec *cache_insert(char *name, st
|
||||
if (daemon->min_cache_ttl != 0 && daemon->min_cache_ttl > ttl)
|
||||
ttl = daemon->min_cache_ttl;
|
||||
}
|
||||
+
|
||||
+ return really_insert(name, addr, now, ttl, flags);
|
||||
+}
|
||||
|
||||
+
|
||||
+static struct crec *really_insert(char *name, struct all_addr *addr,
|
||||
+ time_t now, unsigned long ttl, unsigned short flags)
|
||||
+{
|
||||
+ struct crec *new, *target_crec = NULL;
|
||||
+ union bigname *big_name = NULL;
|
||||
+ int freed_all = flags & F_REVERSE;
|
||||
+ int free_avail = 0;
|
||||
+ unsigned int target_uid;
|
||||
+
|
||||
/* if previous insertion failed give up now. */
|
||||
if (insert_error)
|
||||
return NULL;
|
||||
@@ -645,12 +654,185 @@ void cache_end_insert(void)
|
||||
cache_hash(new_chain);
|
||||
cache_link(new_chain);
|
||||
daemon->metrics[METRIC_DNS_CACHE_INSERTED]++;
|
||||
+
|
||||
+ /* If we're a child process, send this cache entry up the pipe to the master.
|
||||
+ The marshalling process is rather nasty. */
|
||||
+ if (daemon->pipe_to_parent != -1)
|
||||
+ {
|
||||
+ char *name = cache_get_name(new_chain);
|
||||
+ ssize_t m = strlen(name);
|
||||
+ unsigned short flags = new_chain->flags;
|
||||
+#ifdef HAVE_DNSSEC
|
||||
+ u16 class = new_chain->uid;
|
||||
+#endif
|
||||
+
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&m, sizeof(m), 0);
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)name, m, 0);
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->ttd, sizeof(new_chain->ttd), 0);
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&flags, sizeof(flags), 0);
|
||||
+
|
||||
+ if (flags & (F_IPV4 | F_IPV6))
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr, sizeof(new_chain->addr), 0);
|
||||
+#ifdef HAVE_DNSSEC
|
||||
+ else if (flags & F_DNSKEY)
|
||||
+ {
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&class, sizeof(class), 0);
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.algo, sizeof(new_chain->addr.key.algo), 0);
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.keytag, sizeof(new_chain->addr.key.keytag), 0);
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.flags, sizeof(new_chain->addr.key.flags), 0);
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.keylen, sizeof(new_chain->addr.key.keylen), 0);
|
||||
+ blockdata_write(new_chain->addr.key.keydata, new_chain->addr.key.keylen, daemon->pipe_to_parent);
|
||||
+ }
|
||||
+ else if (flags & F_DS)
|
||||
+ {
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&class, sizeof(class), 0);
|
||||
+ /* A negative DS entry is possible and has no data, obviously. */
|
||||
+ if (!(flags & F_NEG))
|
||||
+ {
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.algo, sizeof(new_chain->addr.ds.algo), 0);
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.keytag, sizeof(new_chain->addr.ds.keytag), 0);
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.digest, sizeof(new_chain->addr.ds.digest), 0);
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.keylen, sizeof(new_chain->addr.ds.keylen), 0);
|
||||
+ blockdata_write(new_chain->addr.ds.keydata, new_chain->addr.ds.keylen, daemon->pipe_to_parent);
|
||||
+ }
|
||||
+ }
|
||||
+#endif
|
||||
+
|
||||
+ }
|
||||
}
|
||||
+
|
||||
new_chain = tmp;
|
||||
}
|
||||
+
|
||||
+ /* signal end of cache insert in master process */
|
||||
+ if (daemon->pipe_to_parent != -1)
|
||||
+ {
|
||||
+ ssize_t m = -1;
|
||||
+ read_write(daemon->pipe_to_parent, (unsigned char *)&m, sizeof(m), 0);
|
||||
+ }
|
||||
+
|
||||
new_chain = NULL;
|
||||
}
|
||||
|
||||
+
|
||||
+/* A marshalled cache entry arrives on fd, read, unmarshall and insert into cache of master process. */
|
||||
+int cache_recv_insert(time_t now, int fd)
|
||||
+{
|
||||
+ ssize_t m;
|
||||
+ struct all_addr addr;
|
||||
+ unsigned long ttl;
|
||||
+ time_t ttd;
|
||||
+ unsigned short flags;
|
||||
+ struct crec *crecp = NULL;
|
||||
+
|
||||
+ cache_start_insert();
|
||||
+
|
||||
+ while(1)
|
||||
+ {
|
||||
+
|
||||
+ if (!read_write(fd, (unsigned char *)&m, sizeof(m), 1))
|
||||
+ return 0;
|
||||
+
|
||||
+ if (m == -1)
|
||||
+ {
|
||||
+ cache_end_insert();
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
+ if (!read_write(fd, (unsigned char *)daemon->namebuff, m, 1) ||
|
||||
+ !read_write(fd, (unsigned char *)&ttd, sizeof(ttd), 1) ||
|
||||
+ !read_write(fd, (unsigned char *)&flags, sizeof(flags), 1))
|
||||
+ return 0;
|
||||
+
|
||||
+ daemon->namebuff[m] = 0;
|
||||
+
|
||||
+ ttl = difftime(ttd, now);
|
||||
+
|
||||
+ if (flags & (F_IPV4 | F_IPV6))
|
||||
+ {
|
||||
+ if (!read_write(fd, (unsigned char *)&addr, sizeof(addr), 1))
|
||||
+ return 0;
|
||||
+ crecp = really_insert(daemon->namebuff, &addr, now, ttl, flags);
|
||||
+ }
|
||||
+ else if (flags & F_CNAME)
|
||||
+ {
|
||||
+ struct crec *newc = really_insert(daemon->namebuff, NULL, now, ttl, flags);
|
||||
+ /* This relies on the fact the the target of a CNAME immediately preceeds
|
||||
+ it because of the order of extraction in extract_addresses, and
|
||||
+ the order reversal on the new_chain. */
|
||||
+ if (newc)
|
||||
+ {
|
||||
+ if (!crecp)
|
||||
+ {
|
||||
+ newc->addr.cname.target.cache = NULL;
|
||||
+ /* anything other than zero, to avoid being mistaken for CNAME to interface-name */
|
||||
+ newc->addr.cname.uid = 1;
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+ next_uid(crecp);
|
||||
+ newc->addr.cname.target.cache = crecp;
|
||||
+ newc->addr.cname.uid = crecp->uid;
|
||||
+ }
|
||||
+ }
|
||||
+ }
|
||||
+#ifdef HAVE_DNSSEC
|
||||
+ else if (flags & (F_DNSKEY | F_DS))
|
||||
+ {
|
||||
+ unsigned short class, keylen, keyflags, keytag;
|
||||
+ unsigned char algo, digest;
|
||||
+ struct blockdata *keydata;
|
||||
+
|
||||
+ if (!read_write(fd, (unsigned char *)&class, sizeof(class), 1))
|
||||
+ return 0;
|
||||
+ /* Cache needs to known class for DNSSEC stuff */
|
||||
+ addr.addr.dnssec.class = class;
|
||||
+
|
||||
+ crecp = really_insert(daemon->namebuff, &addr, now, ttl, flags);
|
||||
+
|
||||
+ if (flags & F_DNSKEY)
|
||||
+ {
|
||||
+ if (!read_write(fd, (unsigned char *)&algo, sizeof(algo), 1) ||
|
||||
+ !read_write(fd, (unsigned char *)&keytag, sizeof(keytag), 1) ||
|
||||
+ !read_write(fd, (unsigned char *)&keyflags, sizeof(keyflags), 1) ||
|
||||
+ !read_write(fd, (unsigned char *)&keylen, sizeof(keylen), 1) ||
|
||||
+ !(keydata = blockdata_read(fd, keylen)))
|
||||
+ return 0;
|
||||
+ }
|
||||
+ else if (!(flags & F_NEG))
|
||||
+ {
|
||||
+ if (!read_write(fd, (unsigned char *)&algo, sizeof(algo), 1) ||
|
||||
+ !read_write(fd, (unsigned char *)&keytag, sizeof(keytag), 1) ||
|
||||
+ !read_write(fd, (unsigned char *)&digest, sizeof(digest), 1) ||
|
||||
+ !read_write(fd, (unsigned char *)&keylen, sizeof(keylen), 1) ||
|
||||
+ !(keydata = blockdata_read(fd, keylen)))
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
+ if (crecp)
|
||||
+ {
|
||||
+ if (flags & F_DNSKEY)
|
||||
+ {
|
||||
+ crecp->addr.key.algo = algo;
|
||||
+ crecp->addr.key.keytag = keytag;
|
||||
+ crecp->addr.key.flags = flags;
|
||||
+ crecp->addr.key.keylen = keylen;
|
||||
+ crecp->addr.key.keydata = keydata;
|
||||
+ }
|
||||
+ else if (!(flags & F_NEG))
|
||||
+ {
|
||||
+ crecp->addr.ds.algo = algo;
|
||||
+ crecp->addr.ds.keytag = keytag;
|
||||
+ crecp->addr.ds.digest = digest;
|
||||
+ crecp->addr.ds.keylen = keylen;
|
||||
+ crecp->addr.ds.keydata = keydata;
|
||||
+ }
|
||||
+ }
|
||||
+ }
|
||||
+#endif
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
int cache_find_non_terminal(char *name, time_t now)
|
||||
{
|
||||
struct crec *crecp;
|
||||
--- a/src/dnsmasq.c
|
||||
+++ b/src/dnsmasq.c
|
||||
@@ -930,6 +930,10 @@ int main (int argc, char **argv)
|
||||
check_servers();
|
||||
|
||||
pid = getpid();
|
||||
+
|
||||
+ daemon->pipe_to_parent = -1;
|
||||
+ for (i = 0; i < MAX_PROCS; i++)
|
||||
+ daemon->tcp_pipes[i] = -1;
|
||||
|
||||
#ifdef HAVE_INOTIFY
|
||||
/* Using inotify, have to select a resolv file at startup */
|
||||
@@ -1611,7 +1615,7 @@ static int set_dns_listeners(time_t now)
|
||||
we don't need to explicitly arrange to wake up here */
|
||||
if (listener->tcpfd != -1)
|
||||
for (i = 0; i < MAX_PROCS; i++)
|
||||
- if (daemon->tcp_pids[i] == 0)
|
||||
+ if (daemon->tcp_pids[i] == 0 && daemon->tcp_pipes[i] == -1)
|
||||
{
|
||||
poll_listen(listener->tcpfd, POLLIN);
|
||||
break;
|
||||
@@ -1624,6 +1628,13 @@ static int set_dns_listeners(time_t now)
|
||||
|
||||
}
|
||||
|
||||
+#ifndef NO_FORK
|
||||
+ if (!option_bool(OPT_DEBUG))
|
||||
+ for (i = 0; i < MAX_PROCS; i++)
|
||||
+ if (daemon->tcp_pipes[i] != -1)
|
||||
+ poll_listen(daemon->tcp_pipes[i], POLLIN);
|
||||
+#endif
|
||||
+
|
||||
return wait;
|
||||
}
|
||||
|
||||
@@ -1632,7 +1643,10 @@ static void check_dns_listeners(time_t n
|
||||
struct serverfd *serverfdp;
|
||||
struct listener *listener;
|
||||
int i;
|
||||
-
|
||||
+#ifndef NO_FORK
|
||||
+ int pipefd[2];
|
||||
+#endif
|
||||
+
|
||||
for (serverfdp = daemon->sfds; serverfdp; serverfdp = serverfdp->next)
|
||||
if (poll_check(serverfdp->fd, POLLIN))
|
||||
reply_query(serverfdp->fd, serverfdp->source_addr.sa.sa_family, now);
|
||||
@@ -1642,7 +1656,26 @@ static void check_dns_listeners(time_t n
|
||||
if (daemon->randomsocks[i].refcount != 0 &&
|
||||
poll_check(daemon->randomsocks[i].fd, POLLIN))
|
||||
reply_query(daemon->randomsocks[i].fd, daemon->randomsocks[i].family, now);
|
||||
-
|
||||
+
|
||||
+#ifndef NO_FORK
|
||||
+ /* Races. The child process can die before we read all of the data from the
|
||||
+ pipe, or vice versa. Therefore send tcp_pids to zero when we wait() the
|
||||
+ process, and tcp_pipes to -1 and close the FD when we read the last
|
||||
+ of the data - indicated by cache_recv_insert returning zero.
|
||||
+ The order of these events is indeterminate, and both are needed
|
||||
+ to free the process slot. Once the child process has gone, poll()
|
||||
+ returns POLLHUP, not POLLIN, so have to check for both here. */
|
||||
+ if (!option_bool(OPT_DEBUG))
|
||||
+ for (i = 0; i < MAX_PROCS; i++)
|
||||
+ if (daemon->tcp_pipes[i] != -1 &&
|
||||
+ poll_check(daemon->tcp_pipes[i], POLLIN | POLLHUP) &&
|
||||
+ !cache_recv_insert(now, daemon->tcp_pipes[i]))
|
||||
+ {
|
||||
+ close(daemon->tcp_pipes[i]);
|
||||
+ daemon->tcp_pipes[i] = -1;
|
||||
+ }
|
||||
+#endif
|
||||
+
|
||||
for (listener = daemon->listeners; listener; listener = listener->next)
|
||||
{
|
||||
if (listener->fd != -1 && poll_check(listener->fd, POLLIN))
|
||||
@@ -1736,15 +1769,20 @@ static void check_dns_listeners(time_t n
|
||||
while (retry_send(close(confd)));
|
||||
}
|
||||
#ifndef NO_FORK
|
||||
- else if (!option_bool(OPT_DEBUG) && (p = fork()) != 0)
|
||||
+ else if (!option_bool(OPT_DEBUG) && pipe(pipefd) == 0 && (p = fork()) != 0)
|
||||
{
|
||||
- if (p != -1)
|
||||
+ close(pipefd[1]); /* parent needs read pipe end. */
|
||||
+ if (p == -1)
|
||||
+ close(pipefd[0]);
|
||||
+ else
|
||||
{
|
||||
int i;
|
||||
+
|
||||
for (i = 0; i < MAX_PROCS; i++)
|
||||
- if (daemon->tcp_pids[i] == 0)
|
||||
+ if (daemon->tcp_pids[i] == 0 && daemon->tcp_pipes[i] == -1)
|
||||
{
|
||||
daemon->tcp_pids[i] = p;
|
||||
+ daemon->tcp_pipes[i] = pipefd[0];
|
||||
break;
|
||||
}
|
||||
}
|
||||
@@ -1761,7 +1799,7 @@ static void check_dns_listeners(time_t n
|
||||
int flags;
|
||||
struct in_addr netmask;
|
||||
int auth_dns;
|
||||
-
|
||||
+
|
||||
if (iface)
|
||||
{
|
||||
netmask = iface->netmask;
|
||||
@@ -1777,7 +1815,11 @@ static void check_dns_listeners(time_t n
|
||||
/* Arrange for SIGALRM after CHILD_LIFETIME seconds to
|
||||
terminate the process. */
|
||||
if (!option_bool(OPT_DEBUG))
|
||||
- alarm(CHILD_LIFETIME);
|
||||
+ {
|
||||
+ alarm(CHILD_LIFETIME);
|
||||
+ close(pipefd[0]); /* close read end in child. */
|
||||
+ daemon->pipe_to_parent = pipefd[1];
|
||||
+ }
|
||||
#endif
|
||||
|
||||
/* start with no upstream connections. */
|
||||
--- a/src/dnsmasq.h
|
||||
+++ b/src/dnsmasq.h
|
||||
@@ -1091,6 +1091,8 @@ extern struct daemon {
|
||||
size_t packet_len; /* " " */
|
||||
struct randfd *rfd_save; /* " " */
|
||||
pid_t tcp_pids[MAX_PROCS];
|
||||
+ int tcp_pipes[MAX_PROCS];
|
||||
+ int pipe_to_parent;
|
||||
struct randfd randomsocks[RANDOM_SOCKS];
|
||||
int v6pktinfo;
|
||||
struct addrlist *interface_addrs; /* list of all addresses/prefix lengths associated with all local interfaces */
|
||||
@@ -1152,6 +1154,7 @@ struct crec *cache_find_by_name(struct c
|
||||
char *name, time_t now, unsigned int prot);
|
||||
void cache_end_insert(void);
|
||||
void cache_start_insert(void);
|
||||
+int cache_recv_insert(time_t now, int fd);
|
||||
struct crec *cache_insert(char *name, struct all_addr *addr,
|
||||
time_t now, unsigned long ttl, unsigned short flags);
|
||||
void cache_reload(void);
|
||||
@@ -1174,6 +1177,8 @@ void blockdata_init(void);
|
||||
void blockdata_report(void);
|
||||
struct blockdata *blockdata_alloc(char *data, size_t len);
|
||||
void *blockdata_retrieve(struct blockdata *block, size_t len, void *data);
|
||||
+struct blockdata *blockdata_read(int fd, size_t len);
|
||||
+void blockdata_write(struct blockdata *block, size_t len, int fd);
|
||||
void blockdata_free(struct blockdata *blocks);
|
||||
#endif
|
||||
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
From a220545c4277cba534be5ef4638b5076fc7d2cf4 Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Mon, 22 Oct 2018 18:21:48 +0100
|
||||
Subject: [PATCH 02/32] Ensure that AD bit is reset on answers from
|
||||
--address=/<domain>/<address>.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/rfc1035.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
--- a/src/rfc1035.c
|
||||
+++ b/src/rfc1035.c
|
||||
@@ -938,9 +938,9 @@ size_t setup_reply(struct dns_header *he
|
||||
return 0;
|
||||
|
||||
/* clear authoritative and truncated flags, set QR flag */
|
||||
- header->hb3 = (header->hb3 & ~(HB3_AA | HB3_TC)) | HB3_QR;
|
||||
- /* set RA flag */
|
||||
- header->hb4 |= HB4_RA;
|
||||
+ header->hb3 = (header->hb3 & ~(HB3_AA | HB3_TC )) | HB3_QR;
|
||||
+ /* clear AD flag, set RA flag */
|
||||
+ header->hb4 = (header->hb4 & ~HB4_AD) | HB4_RA;
|
||||
|
||||
header->nscount = htons(0);
|
||||
header->arcount = htons(0);
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,52 +0,0 @@
|
|||
From cf5984367bc6a949e3803a576512c5a7bc48ebab Mon Sep 17 00:00:00 2001
|
||||
From: Vladislav Grishenko <themiron@mail.ru>
|
||||
Date: Thu, 18 Oct 2018 04:55:21 +0500
|
||||
Subject: [PATCH 04/32] Don't forward *.bind/*.server queries upstream
|
||||
|
||||
Chaos .bind and .server (RFC4892) zones are local, therefore
|
||||
don't forward queries upstream to avoid mixing with supported
|
||||
locally and false replies with NO_ID enabled.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/rfc1035.c | 15 ++++++++++++++-
|
||||
1 file changed, 14 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/src/rfc1035.c
|
||||
+++ b/src/rfc1035.c
|
||||
@@ -1276,7 +1276,7 @@ size_t answer_request(struct dns_header
|
||||
int q, ans, anscount = 0, addncount = 0;
|
||||
int dryrun = 0;
|
||||
struct crec *crecp;
|
||||
- int nxdomain = 0, auth = 1, trunc = 0, sec_data = 1;
|
||||
+ int nxdomain = 0, notimp = 0, auth = 1, trunc = 0, sec_data = 1;
|
||||
struct mx_srv_record *rec;
|
||||
size_t len;
|
||||
|
||||
@@ -1355,6 +1355,17 @@ size_t answer_request(struct dns_header
|
||||
}
|
||||
}
|
||||
|
||||
+ if (qclass == C_CHAOS)
|
||||
+ {
|
||||
+ /* don't forward *.bind and *.server chaos queries */
|
||||
+ if (hostname_issubdomain("bind", name) || hostname_issubdomain("server", name))
|
||||
+ {
|
||||
+ if (!ans)
|
||||
+ notimp = 1, auth = 0;
|
||||
+ ans = 1;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
if (qclass == C_IN)
|
||||
{
|
||||
struct txt_record *t;
|
||||
@@ -1903,6 +1914,8 @@ size_t answer_request(struct dns_header
|
||||
|
||||
if (nxdomain)
|
||||
SET_RCODE(header, NXDOMAIN);
|
||||
+ else if (notimp)
|
||||
+ SET_RCODE(header, NOTIMP);
|
||||
else
|
||||
SET_RCODE(header, NOERROR); /* no error */
|
||||
header->ancount = htons(anscount);
|
||||
|
|
@ -1,63 +0,0 @@
|
|||
From cbb5b17ad8e03e08ade62376a4f6a2066e55960d Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Tue, 23 Oct 2018 23:45:57 +0100
|
||||
Subject: [PATCH 05/32] Fix logging in cf5984367bc6a949e3803a576512c5a7bc48ebab
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/rfc1035.c | 27 ++++++++++++++++++---------
|
||||
1 file changed, 18 insertions(+), 9 deletions(-)
|
||||
|
||||
--- a/src/rfc1035.c
|
||||
+++ b/src/rfc1035.c
|
||||
@@ -1335,7 +1335,6 @@ size_t answer_request(struct dns_header
|
||||
{
|
||||
unsigned long ttl = daemon->local_ttl;
|
||||
int ok = 1;
|
||||
- log_query(F_CONFIG | F_RRNAME, name, NULL, "<TXT>");
|
||||
#ifndef NO_ID
|
||||
/* Dynamically generate stat record */
|
||||
if (t->stat != 0)
|
||||
@@ -1345,11 +1344,14 @@ size_t answer_request(struct dns_header
|
||||
ok = 0;
|
||||
}
|
||||
#endif
|
||||
- if (ok && add_resource_record(header, limit, &trunc, nameoffset, &ansp,
|
||||
- ttl, NULL,
|
||||
- T_TXT, t->class, "t", t->len, t->txt))
|
||||
- anscount++;
|
||||
-
|
||||
+ if (ok)
|
||||
+ {
|
||||
+ log_query(F_CONFIG | F_RRNAME, name, NULL, "<TXT>");
|
||||
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp,
|
||||
+ ttl, NULL,
|
||||
+ T_TXT, t->class, "t", t->len, t->txt))
|
||||
+ anscount++;
|
||||
+ }
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1357,12 +1359,19 @@ size_t answer_request(struct dns_header
|
||||
|
||||
if (qclass == C_CHAOS)
|
||||
{
|
||||
- /* don't forward *.bind and *.server chaos queries */
|
||||
+ /* don't forward *.bind and *.server chaos queries - always reply with NOTIMP */
|
||||
if (hostname_issubdomain("bind", name) || hostname_issubdomain("server", name))
|
||||
{
|
||||
if (!ans)
|
||||
- notimp = 1, auth = 0;
|
||||
- ans = 1;
|
||||
+ {
|
||||
+ notimp = 1, auth = 0;
|
||||
+ if (!dryrun)
|
||||
+ {
|
||||
+ addr.addr.rcode.rcode = NOTIMP;
|
||||
+ log_query(F_CONFIG | F_RCODE, name, &addr, NULL);
|
||||
+ }
|
||||
+ ans = 1;
|
||||
+ }
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -1,120 +0,0 @@
|
|||
From 6f7812d97bc8f87004c0a5069c6c94c64af78106 Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Tue, 23 Oct 2018 23:54:44 +0100
|
||||
Subject: [PATCH 06/32] Fix spurious AD flags in some DNS replies from local
|
||||
config.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/rfc1035.c | 42 ++++++++++++++++++++++++------------------
|
||||
1 file changed, 24 insertions(+), 18 deletions(-)
|
||||
|
||||
--- a/src/rfc1035.c
|
||||
+++ b/src/rfc1035.c
|
||||
@@ -1330,7 +1330,7 @@ size_t answer_request(struct dns_header
|
||||
{
|
||||
if (t->class == qclass && hostname_isequal(name, t->name))
|
||||
{
|
||||
- ans = 1;
|
||||
+ ans = 1, sec_data = 0;
|
||||
if (!dryrun)
|
||||
{
|
||||
unsigned long ttl = daemon->local_ttl;
|
||||
@@ -1370,7 +1370,7 @@ size_t answer_request(struct dns_header
|
||||
addr.addr.rcode.rcode = NOTIMP;
|
||||
log_query(F_CONFIG | F_RCODE, name, &addr, NULL);
|
||||
}
|
||||
- ans = 1;
|
||||
+ ans = 1, sec_data = 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1725,7 +1725,7 @@ size_t answer_request(struct dns_header
|
||||
}
|
||||
else if (is_name_synthetic(flag, name, &addr))
|
||||
{
|
||||
- ans = 1;
|
||||
+ ans = 1, sec_data = 0;
|
||||
if (!dryrun)
|
||||
{
|
||||
log_query(F_FORWARD | F_CONFIG | flag, name, &addr, NULL);
|
||||
@@ -1763,25 +1763,27 @@ size_t answer_request(struct dns_header
|
||||
for (rec = daemon->mxnames; rec; rec = rec->next)
|
||||
if (!rec->issrv && hostname_isequal(name, rec->name))
|
||||
{
|
||||
- ans = found = 1;
|
||||
- if (!dryrun)
|
||||
- {
|
||||
- int offset;
|
||||
- log_query(F_CONFIG | F_RRNAME, name, NULL, "<MX>");
|
||||
- if (add_resource_record(header, limit, &trunc, nameoffset, &ansp, daemon->local_ttl,
|
||||
- &offset, T_MX, C_IN, "sd", rec->weight, rec->target))
|
||||
- {
|
||||
- anscount++;
|
||||
- if (rec->target)
|
||||
- rec->offset = offset;
|
||||
- }
|
||||
- }
|
||||
+ ans = found = 1;
|
||||
+ sec_data = 0;
|
||||
+ if (!dryrun)
|
||||
+ {
|
||||
+ int offset;
|
||||
+ log_query(F_CONFIG | F_RRNAME, name, NULL, "<MX>");
|
||||
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp, daemon->local_ttl,
|
||||
+ &offset, T_MX, C_IN, "sd", rec->weight, rec->target))
|
||||
+ {
|
||||
+ anscount++;
|
||||
+ if (rec->target)
|
||||
+ rec->offset = offset;
|
||||
+ }
|
||||
+ }
|
||||
}
|
||||
|
||||
if (!found && (option_bool(OPT_SELFMX) || option_bool(OPT_LOCALMX)) &&
|
||||
cache_find_by_name(NULL, name, now, F_HOSTS | F_DHCP | F_NO_RR))
|
||||
{
|
||||
ans = 1;
|
||||
+ sec_data = 0;
|
||||
if (!dryrun)
|
||||
{
|
||||
log_query(F_CONFIG | F_RRNAME, name, NULL, "<MX>");
|
||||
@@ -1802,6 +1804,7 @@ size_t answer_request(struct dns_header
|
||||
if (rec->issrv && hostname_isequal(name, rec->name))
|
||||
{
|
||||
found = ans = 1;
|
||||
+ sec_data = 0;
|
||||
if (!dryrun)
|
||||
{
|
||||
int offset;
|
||||
@@ -1838,6 +1841,7 @@ size_t answer_request(struct dns_header
|
||||
if (!found && option_bool(OPT_FILTER) && (qtype == T_SRV || (qtype == T_ANY && strchr(name, '_'))))
|
||||
{
|
||||
ans = 1;
|
||||
+ sec_data = 0;
|
||||
if (!dryrun)
|
||||
log_query(F_CONFIG | F_NEG, name, NULL, NULL);
|
||||
}
|
||||
@@ -1850,6 +1854,7 @@ size_t answer_request(struct dns_header
|
||||
if (hostname_isequal(name, na->name))
|
||||
{
|
||||
ans = 1;
|
||||
+ sec_data = 0;
|
||||
if (!dryrun)
|
||||
{
|
||||
log_query(F_CONFIG | F_RRNAME, name, NULL, "<NAPTR>");
|
||||
@@ -1862,11 +1867,12 @@ size_t answer_request(struct dns_header
|
||||
}
|
||||
|
||||
if (qtype == T_MAILB)
|
||||
- ans = 1, nxdomain = 1;
|
||||
+ ans = 1, nxdomain = 1, sec_data = 0;
|
||||
|
||||
if (qtype == T_SOA && option_bool(OPT_FILTER))
|
||||
{
|
||||
- ans = 1;
|
||||
+ ans = 1;
|
||||
+ sec_data = 0;
|
||||
if (!dryrun)
|
||||
log_query(F_CONFIG | F_NEG, name, &addr, NULL);
|
||||
}
|
||||
|
|
@ -1,71 +0,0 @@
|
|||
From 24b87607c1353e94689e8a2190571ab3f3b36f31 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||||
Date: Wed, 24 Oct 2018 22:30:18 +0100
|
||||
Subject: [PATCH 07/32] Do not rely on dead code elimination, use array
|
||||
instead. Make options bits derived from size and count. Use size of option
|
||||
bits and last supported bit in computation. No new change would be required
|
||||
when new options are added. Just change OPT_LAST constant.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/dnsmasq.h | 11 +++++++----
|
||||
src/option.c | 10 ++--------
|
||||
2 files changed, 9 insertions(+), 12 deletions(-)
|
||||
|
||||
--- a/src/dnsmasq.h
|
||||
+++ b/src/dnsmasq.h
|
||||
@@ -200,9 +200,6 @@ struct event_desc {
|
||||
#define EC_MISC 5
|
||||
#define EC_INIT_OFFSET 10
|
||||
|
||||
-/* Trust the compiler dead-code eliminator.... */
|
||||
-#define option_bool(x) (((x) < 32) ? daemon->options & (1u << (x)) : daemon->options2 & (1u << ((x) - 32)))
|
||||
-
|
||||
#define OPT_BOGUSPRIV 0
|
||||
#define OPT_FILTER 1
|
||||
#define OPT_LOG 2
|
||||
@@ -264,6 +261,12 @@ struct event_desc {
|
||||
#define OPT_UBUS 58
|
||||
#define OPT_LAST 59
|
||||
|
||||
+#define OPTION_BITS (sizeof(unsigned int)*8)
|
||||
+#define OPTION_SIZE ( (OPT_LAST/OPTION_BITS)+((OPT_LAST%OPTION_BITS)!=0) )
|
||||
+#define option_var(x) (daemon->options[(x) / OPTION_BITS])
|
||||
+#define option_val(x) ((1u) << ((x) % OPTION_BITS))
|
||||
+#define option_bool(x) (option_var(x) & option_val(x))
|
||||
+
|
||||
/* extra flags for my_syslog, we use a couple of facilities since they are known
|
||||
not to occupy the same bits as priorities, no matter how syslog.h is set up. */
|
||||
#define MS_TFTP LOG_USER
|
||||
@@ -978,7 +981,7 @@ extern struct daemon {
|
||||
config file arguments. All set (including defaults)
|
||||
in option.c */
|
||||
|
||||
- unsigned int options, options2;
|
||||
+ unsigned int options[OPTION_SIZE];
|
||||
struct resolvc default_resolv, *resolv_files;
|
||||
time_t last_resolv;
|
||||
char *servers_file;
|
||||
--- a/src/option.c
|
||||
+++ b/src/option.c
|
||||
@@ -1490,18 +1490,12 @@ static int parse_dhcp_opt(char *errstr,
|
||||
|
||||
void set_option_bool(unsigned int opt)
|
||||
{
|
||||
- if (opt < 32)
|
||||
- daemon->options |= 1u << opt;
|
||||
- else
|
||||
- daemon->options2 |= 1u << (opt - 32);
|
||||
+ option_var(opt) |= option_val(opt);
|
||||
}
|
||||
|
||||
void reset_option_bool(unsigned int opt)
|
||||
{
|
||||
- if (opt < 32)
|
||||
- daemon->options &= ~(1u << opt);
|
||||
- else
|
||||
- daemon->options2 &= ~(1u << (opt - 32));
|
||||
+ option_var(opt) &= ~(option_val(opt));
|
||||
}
|
||||
|
||||
static int one_opt(int option, char *arg, char *errstr, char *gen_err, int command_line, int servers_only)
|
||||
|
|
@ -1,63 +0,0 @@
|
|||
From 3a5a84cdd1488bad118eeac72d09a60299bca744 Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Wed, 31 Oct 2018 21:30:13 +0000
|
||||
Subject: [PATCH 08/32] Fix Makefile lines generating UBUS linker config.
|
||||
|
||||
If arg2 of pkg-wrapper is "--copy", then arg1 is NOT the name of
|
||||
the package manager (--copy doesn't invoke it) it's a secondary
|
||||
config string that inhibts the copy if found. This patch allows that
|
||||
to be the empty string, for unconditional copy, and modifies the
|
||||
ubus linker config to use it. It worked by coincidence before, because
|
||||
there was no config string called "pkg-config".
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
Makefile | 2 +-
|
||||
bld/pkg-wrapper | 14 ++++++++------
|
||||
2 files changed, 9 insertions(+), 7 deletions(-)
|
||||
|
||||
--- a/Makefile
|
||||
+++ b/Makefile
|
||||
@@ -53,7 +53,7 @@ top?=$(CURDIR)
|
||||
|
||||
dbus_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DBUS $(PKG_CONFIG) --cflags dbus-1`
|
||||
dbus_libs = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DBUS $(PKG_CONFIG) --libs dbus-1`
|
||||
-ubus_libs = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_UBUS $(PKG_CONFIG) --copy -lubox -lubus`
|
||||
+ubus_libs = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_UBUS "" --copy -lubox -lubus`
|
||||
idn_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_IDN $(PKG_CONFIG) --cflags libidn`
|
||||
idn_libs = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_IDN $(PKG_CONFIG) --libs libidn`
|
||||
idn2_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LIBIDN2 $(PKG_CONFIG) --cflags libidn2`
|
||||
--- a/bld/pkg-wrapper
|
||||
+++ b/bld/pkg-wrapper
|
||||
@@ -11,23 +11,25 @@ in=`cat`
|
||||
|
||||
if grep "^\#[[:space:]]*define[[:space:]]*$search" config.h >/dev/null 2>&1 || \
|
||||
echo $in | grep $search >/dev/null 2>&1; then
|
||||
-# Nasty, nasty, in --copy, arg 2 is another config to search for, use with NO_GMP
|
||||
+# Nasty, nasty, in --copy, arg 2 (if non-empty) is another config to search for, used with NO_GMP
|
||||
if [ $op = "--copy" ]; then
|
||||
- if grep "^\#[[:space:]]*define[[:space:]]*$pkg" config.h >/dev/null 2>&1 || \
|
||||
- echo $in | grep $pkg >/dev/null 2>&1; then
|
||||
+ if [ -z "$pkg" ]; then
|
||||
+ pkg="$*"
|
||||
+ elif grep "^\#[[:space:]]*define[[:space:]]*$pkg" config.h >/dev/null 2>&1 || \
|
||||
+ echo $in | grep $pkg >/dev/null 2>&1; then
|
||||
pkg=""
|
||||
else
|
||||
pkg="$*"
|
||||
fi
|
||||
elif grep "^\#[[:space:]]*define[[:space:]]*${search}_STATIC" config.h >/dev/null 2>&1 || \
|
||||
- echo $in | grep ${search}_STATIC >/dev/null 2>&1; then
|
||||
+ echo $in | grep ${search}_STATIC >/dev/null 2>&1; then
|
||||
pkg=`$pkg --static $op $*`
|
||||
else
|
||||
pkg=`$pkg $op $*`
|
||||
fi
|
||||
-
|
||||
+
|
||||
if grep "^\#[[:space:]]*define[[:space:]]*${search}_STATIC" config.h >/dev/null 2>&1 || \
|
||||
- echo $in | grep ${search}_STATIC >/dev/null 2>&1; then
|
||||
+ echo $in | grep ${search}_STATIC >/dev/null 2>&1; then
|
||||
if [ $op = "--libs" ] || [ $op = "--copy" ]; then
|
||||
echo "-Wl,-Bstatic $pkg -Wl,-Bdynamic"
|
||||
else
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
From 122392e0b352507cabb9e982208d35d2e56902e0 Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Wed, 31 Oct 2018 22:24:02 +0000
|
||||
Subject: [PATCH 09/32] Revert 68f6312d4bae30b78daafcd6f51dc441b8685b1e
|
||||
|
||||
The above is intended to increase robustness, but actually does the
|
||||
opposite. The problem is that by ignoring SERVFAIL messages and hoping
|
||||
for a better answer from another of the servers we've forwarded to,
|
||||
we become vulnerable in the case that one or more of the configured
|
||||
servers is down or not responding.
|
||||
|
||||
Consider the case that a domain is indeed BOGUS, and we've send the
|
||||
query to n servers. With 68f6312d4bae30b78daafcd6f51dc441b8685b1e
|
||||
we ignore the first n-1 SERVFAIL replies, and only return the
|
||||
final n'th answer to the client. Now, if one of the servers we are
|
||||
forwarding to is down, then we won't get all n replies, and the
|
||||
client will never get an answer! This is a far more likely scenario
|
||||
than a temporary SERVFAIL from only one of a set of notionally identical
|
||||
servers, so, on the ground of robustness, we have to believe
|
||||
any SERVFAIL answers we get, and return them to the client.
|
||||
|
||||
The client could be using the same recursive servers we are,
|
||||
so it should, in theory, retry on SERVFAIL anyway.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/forward.c | 3 +--
|
||||
1 file changed, 1 insertion(+), 2 deletions(-)
|
||||
|
||||
--- a/src/forward.c
|
||||
+++ b/src/forward.c
|
||||
@@ -957,8 +957,7 @@ void reply_query(int fd, int family, tim
|
||||
we get a good reply from another server. Kill it when we've
|
||||
had replies from all to avoid filling the forwarding table when
|
||||
everything is broken */
|
||||
- if (forward->forwardall == 0 || --forward->forwardall == 1 ||
|
||||
- (RCODE(header) != REFUSED && RCODE(header) != SERVFAIL))
|
||||
+ if (forward->forwardall == 0 || --forward->forwardall == 1 || RCODE(header) != REFUSED)
|
||||
{
|
||||
int check_rebind = 0, no_cache_dnssec = 0, cache_secure = 0, bogusanswer = 0;
|
||||
|
||||
|
|
@ -1,199 +0,0 @@
|
|||
From 48d12f14c9c0fc8cf943b52774c3892517dd72d4 Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Fri, 2 Nov 2018 21:55:04 +0000
|
||||
Subject: [PATCH 10/32] Remove the NO_FORK compile-time option, and support for
|
||||
uclinux.
|
||||
|
||||
In an era where everything has an MMU, this looks like
|
||||
an anachronism, and it adds to (Ok, multiplies!) the
|
||||
combinatorial explosion of compile-time options.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
CHANGELOG | 6 ++++++
|
||||
src/config.h | 21 ++-------------------
|
||||
src/dnsmasq.c | 14 --------------
|
||||
src/option.c | 4 +---
|
||||
4 files changed, 9 insertions(+), 36 deletions(-)
|
||||
|
||||
--- a/CHANGELOG
|
||||
+++ b/CHANGELOG
|
||||
@@ -11,6 +11,12 @@ version 2.81
|
||||
This fix passes cache entries back from the TCP child process to
|
||||
the main server process, and fixes the problem.
|
||||
|
||||
+ Remove the NO_FORK compile-time option, and support for uclinux.
|
||||
+ In an era where everything has an MMU, this looks like
|
||||
+ an anachronism, and it adds to (Ok, multiplies!) the
|
||||
+ combinatorial explosion of compile-time options. Thanks to
|
||||
+ Kevin Darbyshire-Bryant for the patch.
|
||||
+
|
||||
|
||||
version 2.80
|
||||
Add support for RFC 4039 DHCP rapid commit. Thanks to Ashram Method
|
||||
--- a/src/config.h
|
||||
+++ b/src/config.h
|
||||
@@ -239,27 +239,13 @@ HAVE_SOCKADDR_SA_LEN
|
||||
defined if struct sockaddr has sa_len field (*BSD)
|
||||
*/
|
||||
|
||||
-/* Must precede __linux__ since uClinux defines __linux__ too. */
|
||||
-#if defined(__uClinux__)
|
||||
-#define HAVE_LINUX_NETWORK
|
||||
-#define HAVE_GETOPT_LONG
|
||||
-#undef HAVE_SOCKADDR_SA_LEN
|
||||
-/* Never use fork() on uClinux. Note that this is subtly different from the
|
||||
- --keep-in-foreground option, since it also suppresses forking new
|
||||
- processes for TCP connections and disables the call-a-script on leasechange
|
||||
- system. It's intended for use on MMU-less kernels. */
|
||||
-#define NO_FORK
|
||||
-
|
||||
-#elif defined(__UCLIBC__)
|
||||
+#if defined(__UCLIBC__)
|
||||
#define HAVE_LINUX_NETWORK
|
||||
#if defined(__UCLIBC_HAS_GNU_GETOPT__) || \
|
||||
((__UCLIBC_MAJOR__==0) && (__UCLIBC_MINOR__==9) && (__UCLIBC_SUBLEVEL__<21))
|
||||
# define HAVE_GETOPT_LONG
|
||||
#endif
|
||||
#undef HAVE_SOCKADDR_SA_LEN
|
||||
-#if !defined(__ARCH_HAS_MMU__) && !defined(__UCLIBC_HAS_MMU__)
|
||||
-# define NO_FORK
|
||||
-#endif
|
||||
#if defined(__UCLIBC_HAS_IPV6__)
|
||||
# ifndef IPV6_V6ONLY
|
||||
# define IPV6_V6ONLY 26
|
||||
@@ -328,7 +314,7 @@ HAVE_SOCKADDR_SA_LEN
|
||||
#define HAVE_DHCP
|
||||
#endif
|
||||
|
||||
-#if defined(NO_SCRIPT) || defined(NO_FORK)
|
||||
+#if defined(NO_SCRIPT)
|
||||
#undef HAVE_SCRIPT
|
||||
#undef HAVE_LUASCRIPT
|
||||
#endif
|
||||
@@ -372,9 +358,6 @@ static char *compile_opts =
|
||||
#ifdef HAVE_BROKEN_RTC
|
||||
"no-RTC "
|
||||
#endif
|
||||
-#ifdef NO_FORK
|
||||
-"no-MMU "
|
||||
-#endif
|
||||
#ifndef HAVE_DBUS
|
||||
"no-"
|
||||
#endif
|
||||
--- a/src/dnsmasq.c
|
||||
+++ b/src/dnsmasq.c
|
||||
@@ -485,7 +485,6 @@ int main (int argc, char **argv)
|
||||
if (chdir("/") != 0)
|
||||
die(_("cannot chdir to filesystem root: %s"), NULL, EC_MISC);
|
||||
|
||||
-#ifndef NO_FORK
|
||||
if (!option_bool(OPT_NO_FORK))
|
||||
{
|
||||
pid_t pid;
|
||||
@@ -525,7 +524,6 @@ int main (int argc, char **argv)
|
||||
if (pid != 0)
|
||||
_exit(0);
|
||||
}
|
||||
-#endif
|
||||
|
||||
/* write pidfile _after_ forking ! */
|
||||
if (daemon->runfile)
|
||||
@@ -1628,12 +1626,10 @@ static int set_dns_listeners(time_t now)
|
||||
|
||||
}
|
||||
|
||||
-#ifndef NO_FORK
|
||||
if (!option_bool(OPT_DEBUG))
|
||||
for (i = 0; i < MAX_PROCS; i++)
|
||||
if (daemon->tcp_pipes[i] != -1)
|
||||
poll_listen(daemon->tcp_pipes[i], POLLIN);
|
||||
-#endif
|
||||
|
||||
return wait;
|
||||
}
|
||||
@@ -1643,9 +1639,7 @@ static void check_dns_listeners(time_t n
|
||||
struct serverfd *serverfdp;
|
||||
struct listener *listener;
|
||||
int i;
|
||||
-#ifndef NO_FORK
|
||||
int pipefd[2];
|
||||
-#endif
|
||||
|
||||
for (serverfdp = daemon->sfds; serverfdp; serverfdp = serverfdp->next)
|
||||
if (poll_check(serverfdp->fd, POLLIN))
|
||||
@@ -1657,7 +1651,6 @@ static void check_dns_listeners(time_t n
|
||||
poll_check(daemon->randomsocks[i].fd, POLLIN))
|
||||
reply_query(daemon->randomsocks[i].fd, daemon->randomsocks[i].family, now);
|
||||
|
||||
-#ifndef NO_FORK
|
||||
/* Races. The child process can die before we read all of the data from the
|
||||
pipe, or vice versa. Therefore send tcp_pids to zero when we wait() the
|
||||
process, and tcp_pipes to -1 and close the FD when we read the last
|
||||
@@ -1674,7 +1667,6 @@ static void check_dns_listeners(time_t n
|
||||
close(daemon->tcp_pipes[i]);
|
||||
daemon->tcp_pipes[i] = -1;
|
||||
}
|
||||
-#endif
|
||||
|
||||
for (listener = daemon->listeners; listener; listener = listener->next)
|
||||
{
|
||||
@@ -1768,7 +1760,6 @@ static void check_dns_listeners(time_t n
|
||||
shutdown(confd, SHUT_RDWR);
|
||||
while (retry_send(close(confd)));
|
||||
}
|
||||
-#ifndef NO_FORK
|
||||
else if (!option_bool(OPT_DEBUG) && pipe(pipefd) == 0 && (p = fork()) != 0)
|
||||
{
|
||||
close(pipefd[1]); /* parent needs read pipe end. */
|
||||
@@ -1791,7 +1782,6 @@ static void check_dns_listeners(time_t n
|
||||
/* The child can use up to TCP_MAX_QUERIES ids, so skip that many. */
|
||||
daemon->log_id += TCP_MAX_QUERIES;
|
||||
}
|
||||
-#endif
|
||||
else
|
||||
{
|
||||
unsigned char *buff;
|
||||
@@ -1811,7 +1801,6 @@ static void check_dns_listeners(time_t n
|
||||
auth_dns = 0;
|
||||
}
|
||||
|
||||
-#ifndef NO_FORK
|
||||
/* Arrange for SIGALRM after CHILD_LIFETIME seconds to
|
||||
terminate the process. */
|
||||
if (!option_bool(OPT_DEBUG))
|
||||
@@ -1820,7 +1809,6 @@ static void check_dns_listeners(time_t n
|
||||
close(pipefd[0]); /* close read end in child. */
|
||||
daemon->pipe_to_parent = pipefd[1];
|
||||
}
|
||||
-#endif
|
||||
|
||||
/* start with no upstream connections. */
|
||||
for (s = daemon->servers; s; s = s->next)
|
||||
@@ -1846,13 +1834,11 @@ static void check_dns_listeners(time_t n
|
||||
shutdown(s->tcpfd, SHUT_RDWR);
|
||||
while (retry_send(close(s->tcpfd)));
|
||||
}
|
||||
-#ifndef NO_FORK
|
||||
if (!option_bool(OPT_DEBUG))
|
||||
{
|
||||
flush_log();
|
||||
_exit(0);
|
||||
}
|
||||
-#endif
|
||||
}
|
||||
}
|
||||
}
|
||||
--- a/src/option.c
|
||||
+++ b/src/option.c
|
||||
@@ -1828,9 +1828,7 @@ static int one_opt(int option, char *arg
|
||||
/* Sorry about the gross pre-processor abuse */
|
||||
case '6': /* --dhcp-script */
|
||||
case LOPT_LUASCRIPT: /* --dhcp-luascript */
|
||||
-# if defined(NO_FORK)
|
||||
- ret_err(_("cannot run scripts under uClinux"));
|
||||
-# elif !defined(HAVE_SCRIPT)
|
||||
+# if !defined(HAVE_SCRIPT)
|
||||
ret_err(_("recompile with HAVE_SCRIPT defined to enable lease-change scripts"));
|
||||
# else
|
||||
if (option == LOPT_LUASCRIPT)
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,32 +0,0 @@
|
|||
From 07e25da5bf26d46aad4f1d2eb19b260789182004 Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Sun, 16 Dec 2018 18:21:58 +0000
|
||||
Subject: [PATCH 13/32] Treat DS and DNSKEY queries being forwarded the same as
|
||||
those locally originated.
|
||||
|
||||
The queries will not be forwarded to a server for a domain, unless
|
||||
there's a trust anchor provided for that domain. This allows, especially,
|
||||
suitable proof of non-existance for DS records to come from
|
||||
the parent domain for domains which are not signed.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/rfc1035.c | 7 +++++++
|
||||
1 file changed, 7 insertions(+)
|
||||
|
||||
--- a/src/rfc1035.c
|
||||
+++ b/src/rfc1035.c
|
||||
@@ -916,6 +916,13 @@ unsigned int extract_request(struct dns_
|
||||
if (qtype == T_ANY)
|
||||
return F_IPV4 | F_IPV6;
|
||||
}
|
||||
+
|
||||
+ /* F_DNSSECOK as agument to search_servers() inhibits forwarding
|
||||
+ to servers for domains without a trust anchor. This make the
|
||||
+ behaviour for DS and DNSKEY queries we forward the same
|
||||
+ as for DS and DNSKEY queries we originate. */
|
||||
+ if (qtype == T_DS || qtype == T_DNSKEY)
|
||||
+ return F_DNSSECOK;
|
||||
|
||||
return F_QUERY;
|
||||
}
|
||||
|
|
@ -1,42 +0,0 @@
|
|||
From 137e9f878fafb38369eab7d9dfe84e4228ff5f89 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||||
Date: Sun, 16 Dec 2018 21:25:29 +0000
|
||||
Subject: [PATCH 14/32] Fix option parsing errors introduced in
|
||||
59e470381f84f2fdf0640c7bc67827f3f0c64784
|
||||
|
||||
Thanks to Kevin Darbyshire-Bryant for spotting this.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/option.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
--- a/src/option.c
|
||||
+++ b/src/option.c
|
||||
@@ -3432,7 +3432,7 @@ static int one_opt(int option, char *arg
|
||||
{
|
||||
struct dhcp_netid *id = dhcp_tags(&arg);
|
||||
|
||||
- if (!id)
|
||||
+ if (!arg)
|
||||
{
|
||||
ret_err(gen_err);
|
||||
}
|
||||
@@ -3483,7 +3483,7 @@ static int one_opt(int option, char *arg
|
||||
{
|
||||
struct dhcp_netid *id = dhcp_tags(&arg);
|
||||
|
||||
- if (!id)
|
||||
+ if (!arg)
|
||||
{
|
||||
ret_err(gen_err);
|
||||
}
|
||||
@@ -3513,7 +3513,7 @@ static int one_opt(int option, char *arg
|
||||
new->opt = 10; /* PXE_MENU_PROMPT */
|
||||
new->netid = dhcp_tags(&arg);
|
||||
|
||||
- if (!new->netid)
|
||||
+ if (!arg)
|
||||
{
|
||||
dhcp_opt_free(new);
|
||||
ret_err(gen_err);
|
||||
|
|
@ -1,45 +0,0 @@
|
|||
From 3becf468bad699bfdcb2d18d553bc72d4c79e23c Mon Sep 17 00:00:00 2001
|
||||
From: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
|
||||
Date: Wed, 12 Dec 2018 12:00:19 +0000
|
||||
Subject: [PATCH 15/32] fix ipv6 ipset bug in master
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Hi Simon,
|
||||
|
||||
Another one fallen out of the openwrt tree shake :-)
|
||||
|
||||
ipv6 ipset addresses weren’t being set correctly. patch attached
|
||||
|
||||
Cheers,
|
||||
|
||||
Kevin D-B
|
||||
|
||||
012C ACB2 28C6 C53E 9775 9123 B3A2 389B 9DE2 334A
|
||||
From b50fc0491e374186f982b019f293379955afd203 Mon Sep 17 00:00:00 2001
|
||||
From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
Date: Wed, 12 Dec 2018 11:35:12 +0000
|
||||
Subject: [PATCH] ipset fix ternary order swap
|
||||
|
||||
ee87504 Remove ability to compile without IPv6 support introduced a
|
||||
ternary operator for ip address size. Unfortunately the true/false
|
||||
order was incorrect which meant ipv6 ipset addresses were added
|
||||
incorrectly.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/ipset.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
--- a/src/ipset.c
|
||||
+++ b/src/ipset.c
|
||||
@@ -120,7 +120,7 @@ static int new_add_to_ipset(const char *
|
||||
struct my_nfgenmsg *nfg;
|
||||
struct my_nlattr *nested[2];
|
||||
uint8_t proto;
|
||||
- int addrsz = (af == AF_INET6) ? INADDRSZ : IN6ADDRSZ;
|
||||
+ int addrsz = (af == AF_INET6) ? IN6ADDRSZ : INADDRSZ;
|
||||
|
||||
if (strlen(setname) >= IPSET_MAXNAMELEN)
|
||||
{
|
||||
|
|
@ -1,50 +0,0 @@
|
|||
From b683cf37f9f3dd3dc5d95d621ee75850d559b2e4 Mon Sep 17 00:00:00 2001
|
||||
From: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
|
||||
Date: Mon, 10 Dec 2018 10:34:35 +0000
|
||||
Subject: [PATCH 16/32] build failure on master with NO_DHCPv6 and fix....
|
||||
|
||||
Hi Simon,
|
||||
|
||||
master has a build error when building without HAVE_DHCPv6
|
||||
|
||||
option.c: In function 'dhcp_context_free':
|
||||
option.c:1042:15: error: 'struct dhcp_context' has no member named 'template_interface'
|
||||
free(ctx->template_interface);
|
||||
|
||||
Sadly, need to put in a little conditional compilation ifdef'erey
|
||||
|
||||
Simplest patch in the world attached
|
||||
|
||||
Cheers,
|
||||
|
||||
Kevin D-B
|
||||
|
||||
012C ACB2 28C6 C53E 9775 9123 B3A2 389B 9DE2 334A
|
||||
|
||||
From 061eb8599636bb360e0b7fa5986935b86db39497 Mon Sep 17 00:00:00 2001
|
||||
From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
Date: Mon, 10 Dec 2018 10:07:33 +0000
|
||||
Subject: [PATCH] option: fix non DHCPv6 build error
|
||||
|
||||
option.c: In function 'dhcp_context_free':
|
||||
option.c:1042:15: error: 'struct dhcp_context' has no member named 'template_interface'
|
||||
free(ctx->template_interface);
|
||||
^~
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/option.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
--- a/src/option.c
|
||||
+++ b/src/option.c
|
||||
@@ -1039,7 +1039,9 @@ static void dhcp_context_free(struct dhc
|
||||
{
|
||||
dhcp_netid_free(ctx->filter);
|
||||
free(ctx->netid.net);
|
||||
+#ifdef HAVE_DHCP6
|
||||
free(ctx->template_interface);
|
||||
+#endif
|
||||
free(ctx);
|
||||
}
|
||||
}
|
||||
|
|
@ -1,57 +0,0 @@
|
|||
From e7bfd556c079c8b5e7425aed44abc35925b24043 Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Mon, 31 Dec 2018 20:51:15 +0000
|
||||
Subject: [PATCH 17/32] Alter DHCP address selection after DECLINE in
|
||||
consec-addr mode. Avoid offering the same address after a recieving a DECLINE
|
||||
message to stop an infinite protocol loop. This has long been done in default
|
||||
address allocation mode: this adds similar behaviour when allocaing addresses
|
||||
consecutively.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/dhcp.c | 13 +++++++++++++
|
||||
src/dhcp6.c | 11 +++++++++--
|
||||
2 files changed, 22 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/src/dhcp.c
|
||||
+++ b/src/dhcp.c
|
||||
@@ -754,6 +754,19 @@ int address_allocate(struct dhcp_context
|
||||
if (addr.s_addr == d->router.s_addr)
|
||||
break;
|
||||
|
||||
+ /* in consec-ip mode, skip addresses equal to
|
||||
+ the number of addresses rejected by clients. This
|
||||
+ should avoid the same client being offered the same
|
||||
+ address after it has rjected it. */
|
||||
+ if (option_bool(OPT_CONSEC_ADDR))
|
||||
+ {
|
||||
+ if (c->addr_epoch)
|
||||
+ {
|
||||
+ c->addr_epoch--;
|
||||
+ d = context; /* d non-NULL skips the address. */
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
/* Addresses which end in .255 and .0 are broken in Windows even when using
|
||||
supernetting. ie dhcp-range=192.168.0.1,192.168.1.254,255,255,254.0
|
||||
then 192.168.0.255 is a valid IP address, but not for Windows as it's
|
||||
--- a/src/dhcp6.c
|
||||
+++ b/src/dhcp6.c
|
||||
@@ -431,8 +431,15 @@ struct dhcp_context *address6_allocate(s
|
||||
else
|
||||
{
|
||||
if (!temp_addr && option_bool(OPT_CONSEC_ADDR))
|
||||
- /* seed is largest extant lease addr in this context */
|
||||
- start = lease_find_max_addr6(c) + serial;
|
||||
+ {
|
||||
+ /* seed is largest extant lease addr in this context,
|
||||
+ skip addresses equal to the number of addresses rejected
|
||||
+ by clients. This should avoid the same client being offered the same
|
||||
+ address after it has rjected it. */
|
||||
+ start = lease_find_max_addr6(c) + serial + c->addr_epoch;
|
||||
+ if (c->addr_epoch)
|
||||
+ c->addr_epoch--;
|
||||
+ }
|
||||
else
|
||||
{
|
||||
u64 range = 1 + addr6part(&c->end6) - addr6part(&c->start6);
|
||||
|
|
@ -1,80 +0,0 @@
|
|||
From bde46476ee06c96e821653dfdb8fa11fe7326998 Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Mon, 31 Dec 2018 23:28:24 +0000
|
||||
Subject: [PATCH 18/32] Tidy all_addr union, merge log and rcode fields.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/cache.c | 2 +-
|
||||
src/dnsmasq.h | 6 +-----
|
||||
src/forward.c | 2 +-
|
||||
src/rfc1035.c | 6 +++---
|
||||
4 files changed, 6 insertions(+), 10 deletions(-)
|
||||
|
||||
--- a/src/cache.c
|
||||
+++ b/src/cache.c
|
||||
@@ -1926,7 +1926,7 @@ void log_query(unsigned int flags, char
|
||||
sprintf(daemon->addrbuff, arg, addr->addr.log.keytag, addr->addr.log.algo, addr->addr.log.digest);
|
||||
else if (flags & F_RCODE)
|
||||
{
|
||||
- unsigned int rcode = addr->addr.rcode.rcode;
|
||||
+ unsigned int rcode = addr->addr.log.rcode;
|
||||
|
||||
if (rcode == SERVFAIL)
|
||||
dest = "SERVFAIL";
|
||||
--- a/src/dnsmasq.h
|
||||
+++ b/src/dnsmasq.h
|
||||
@@ -279,12 +279,8 @@ struct all_addr {
|
||||
struct in6_addr addr6;
|
||||
/* for log_query */
|
||||
struct {
|
||||
- unsigned short keytag, algo, digest;
|
||||
+ unsigned short keytag, algo, digest, rcode;
|
||||
} log;
|
||||
- /* for log_query */
|
||||
- struct {
|
||||
- unsigned int rcode;
|
||||
- } rcode;
|
||||
/* for cache_insert of DNSKEY, DS */
|
||||
struct {
|
||||
unsigned short class, type;
|
||||
--- a/src/forward.c
|
||||
+++ b/src/forward.c
|
||||
@@ -658,7 +658,7 @@ static size_t process_reply(struct dns_h
|
||||
if (rcode != NOERROR && rcode != NXDOMAIN)
|
||||
{
|
||||
struct all_addr a;
|
||||
- a.addr.rcode.rcode = rcode;
|
||||
+ a.addr.log.rcode = rcode;
|
||||
log_query(F_UPSTREAM | F_RCODE, "error", &a, NULL);
|
||||
|
||||
return resize_packet(header, n, pheader, plen);
|
||||
--- a/src/rfc1035.c
|
||||
+++ b/src/rfc1035.c
|
||||
@@ -950,7 +950,7 @@ size_t setup_reply(struct dns_header *he
|
||||
else if (flags == F_SERVFAIL)
|
||||
{
|
||||
struct all_addr a;
|
||||
- a.addr.rcode.rcode = SERVFAIL;
|
||||
+ a.addr.log.rcode = SERVFAIL;
|
||||
log_query(F_CONFIG | F_RCODE, "error", &a, NULL);
|
||||
SET_RCODE(header, SERVFAIL);
|
||||
}
|
||||
@@ -975,7 +975,7 @@ size_t setup_reply(struct dns_header *he
|
||||
else /* nowhere to forward to */
|
||||
{
|
||||
struct all_addr a;
|
||||
- a.addr.rcode.rcode = REFUSED;
|
||||
+ a.addr.log.rcode = REFUSED;
|
||||
log_query(F_CONFIG | F_RCODE, "error", &a, NULL);
|
||||
SET_RCODE(header, REFUSED);
|
||||
}
|
||||
@@ -1374,7 +1374,7 @@ size_t answer_request(struct dns_header
|
||||
notimp = 1, auth = 0;
|
||||
if (!dryrun)
|
||||
{
|
||||
- addr.addr.rcode.rcode = NOTIMP;
|
||||
+ addr.addr.log.rcode = NOTIMP;
|
||||
log_query(F_CONFIG | F_RCODE, name, &addr, NULL);
|
||||
}
|
||||
ans = 1, sec_data = 0;
|
||||
|
|
@ -1,290 +0,0 @@
|
|||
From 65a01b71bb433c9466e4c78a73a8d8ed218ed4e8 Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Mon, 31 Dec 2018 23:56:33 +0000
|
||||
Subject: [PATCH 19/32] Tidy address-union handling: move class into explicit
|
||||
argument.
|
||||
|
||||
This moves the class argument to cache-insert into an argument,
|
||||
rather then overloading a union in the address argument. Note that
|
||||
tha class is NOT stored in the cache other than for DS/DNSKEY entries,
|
||||
so must always be C_IN except for these. The data-extraction code
|
||||
ensures this as it only attempts to cache C_IN class records.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/cache.c | 57 ++++++++++++++++++++++-----------------------------
|
||||
src/dnsmasq.h | 2 +-
|
||||
src/dnssec.c | 13 +++---------
|
||||
src/rfc1035.c | 12 +++++------
|
||||
4 files changed, 34 insertions(+), 50 deletions(-)
|
||||
|
||||
--- a/src/cache.c
|
||||
+++ b/src/cache.c
|
||||
@@ -26,7 +26,7 @@ static union bigname *big_free = NULL;
|
||||
static int bignames_left, hash_size;
|
||||
|
||||
static void make_non_terminals(struct crec *source);
|
||||
-static struct crec *really_insert(char *name, struct all_addr *addr,
|
||||
+static struct crec *really_insert(char *name, struct all_addr *addr, unsigned short class,
|
||||
time_t now, unsigned long ttl, unsigned short flags);
|
||||
|
||||
/* type->string mapping: this is also used by the name-hash function as a mixing table. */
|
||||
@@ -330,8 +330,8 @@ static int is_expired(time_t now, struct
|
||||
return 1;
|
||||
}
|
||||
|
||||
-static struct crec *cache_scan_free(char *name, struct all_addr *addr, time_t now, unsigned short flags,
|
||||
- struct crec **target_crec, unsigned int *target_uid)
|
||||
+static struct crec *cache_scan_free(char *name, struct all_addr *addr, unsigned short class, time_t now,
|
||||
+ unsigned short flags, struct crec **target_crec, unsigned int *target_uid)
|
||||
{
|
||||
/* Scan and remove old entries.
|
||||
If (flags & F_FORWARD) then remove any forward entries for name and any expired
|
||||
@@ -350,6 +350,8 @@ static struct crec *cache_scan_free(char
|
||||
This entry will get re-used with the same name, to preserve CNAMEs. */
|
||||
|
||||
struct crec *crecp, **up;
|
||||
+
|
||||
+ (void)class;
|
||||
|
||||
if (flags & F_FORWARD)
|
||||
{
|
||||
@@ -381,7 +383,7 @@ static struct crec *cache_scan_free(char
|
||||
|
||||
#ifdef HAVE_DNSSEC
|
||||
/* Deletion has to be class-sensitive for DS and DNSKEY */
|
||||
- if ((flags & crecp->flags & (F_DNSKEY | F_DS)) && crecp->uid == addr->addr.dnssec.class)
|
||||
+ if ((flags & crecp->flags & (F_DNSKEY | F_DS)) && crecp->uid == class)
|
||||
{
|
||||
if (crecp->flags & F_CONFIG)
|
||||
return crecp;
|
||||
@@ -464,7 +466,7 @@ void cache_start_insert(void)
|
||||
insert_error = 0;
|
||||
}
|
||||
|
||||
-struct crec *cache_insert(char *name, struct all_addr *addr,
|
||||
+struct crec *cache_insert(char *name, struct all_addr *addr, unsigned short class,
|
||||
time_t now, unsigned long ttl, unsigned short flags)
|
||||
{
|
||||
/* Don't log DNSSEC records here, done elsewhere */
|
||||
@@ -478,11 +480,11 @@ struct crec *cache_insert(char *name, st
|
||||
ttl = daemon->min_cache_ttl;
|
||||
}
|
||||
|
||||
- return really_insert(name, addr, now, ttl, flags);
|
||||
+ return really_insert(name, addr, class, now, ttl, flags);
|
||||
}
|
||||
|
||||
|
||||
-static struct crec *really_insert(char *name, struct all_addr *addr,
|
||||
+static struct crec *really_insert(char *name, struct all_addr *addr, unsigned short class,
|
||||
time_t now, unsigned long ttl, unsigned short flags)
|
||||
{
|
||||
struct crec *new, *target_crec = NULL;
|
||||
@@ -497,7 +499,7 @@ static struct crec *really_insert(char *
|
||||
|
||||
/* First remove any expired entries and entries for the name/address we
|
||||
are currently inserting. */
|
||||
- if ((new = cache_scan_free(name, addr, now, flags, &target_crec, &target_uid)))
|
||||
+ if ((new = cache_scan_free(name, addr, class, now, flags, &target_crec, &target_uid)))
|
||||
{
|
||||
/* We're trying to insert a record over one from
|
||||
/etc/hosts or DHCP, or other config. If the
|
||||
@@ -553,21 +555,14 @@ static struct crec *really_insert(char *
|
||||
|
||||
if (freed_all)
|
||||
{
|
||||
- struct all_addr free_addr = new->addr.addr;;
|
||||
-
|
||||
-#ifdef HAVE_DNSSEC
|
||||
- /* For DNSSEC records, addr holds class. */
|
||||
- if (new->flags & (F_DS | F_DNSKEY))
|
||||
- free_addr.addr.dnssec.class = new->uid;
|
||||
-#endif
|
||||
-
|
||||
+ /* For DNSSEC records, uid holds class. */
|
||||
free_avail = 1; /* Must be free space now. */
|
||||
- cache_scan_free(cache_get_name(new), &free_addr, now, new->flags, NULL, NULL);
|
||||
+ cache_scan_free(cache_get_name(new), &new->addr.addr, new->uid, now, new->flags, NULL, NULL);
|
||||
daemon->metrics[METRIC_DNS_CACHE_LIVE_FREED]++;
|
||||
}
|
||||
else
|
||||
{
|
||||
- cache_scan_free(NULL, NULL, now, 0, NULL, NULL);
|
||||
+ cache_scan_free(NULL, NULL, class, now, 0, NULL, NULL);
|
||||
freed_all = 1;
|
||||
}
|
||||
}
|
||||
@@ -615,15 +610,13 @@ static struct crec *really_insert(char *
|
||||
else
|
||||
*cache_get_name(new) = 0;
|
||||
|
||||
- if (addr)
|
||||
- {
|
||||
#ifdef HAVE_DNSSEC
|
||||
- if (flags & (F_DS | F_DNSKEY))
|
||||
- new->uid = addr->addr.dnssec.class;
|
||||
- else
|
||||
+ if (flags & (F_DS | F_DNSKEY))
|
||||
+ new->uid = class;
|
||||
#endif
|
||||
- new->addr.addr = *addr;
|
||||
- }
|
||||
+
|
||||
+ if (addr)
|
||||
+ new->addr.addr = *addr;
|
||||
|
||||
new->ttd = now + (time_t)ttl;
|
||||
new->next = new_chain;
|
||||
@@ -747,11 +740,11 @@ int cache_recv_insert(time_t now, int fd
|
||||
{
|
||||
if (!read_write(fd, (unsigned char *)&addr, sizeof(addr), 1))
|
||||
return 0;
|
||||
- crecp = really_insert(daemon->namebuff, &addr, now, ttl, flags);
|
||||
+ crecp = really_insert(daemon->namebuff, &addr, C_IN, now, ttl, flags);
|
||||
}
|
||||
else if (flags & F_CNAME)
|
||||
{
|
||||
- struct crec *newc = really_insert(daemon->namebuff, NULL, now, ttl, flags);
|
||||
+ struct crec *newc = really_insert(daemon->namebuff, NULL, C_IN, now, ttl, flags);
|
||||
/* This relies on the fact the the target of a CNAME immediately preceeds
|
||||
it because of the order of extraction in extract_addresses, and
|
||||
the order reversal on the new_chain. */
|
||||
@@ -780,10 +773,8 @@ int cache_recv_insert(time_t now, int fd
|
||||
|
||||
if (!read_write(fd, (unsigned char *)&class, sizeof(class), 1))
|
||||
return 0;
|
||||
- /* Cache needs to known class for DNSSEC stuff */
|
||||
- addr.addr.dnssec.class = class;
|
||||
-
|
||||
- crecp = really_insert(daemon->namebuff, &addr, now, ttl, flags);
|
||||
+
|
||||
+ crecp = really_insert(daemon->namebuff, NULL, class, now, ttl, flags);
|
||||
|
||||
if (flags & F_DNSKEY)
|
||||
{
|
||||
@@ -1463,7 +1454,7 @@ void cache_add_dhcp_entry(char *host_nam
|
||||
}
|
||||
else if (!(crec->flags & F_DHCP))
|
||||
{
|
||||
- cache_scan_free(host_name, NULL, 0, crec->flags & (flags | F_CNAME | F_FORWARD), NULL, NULL);
|
||||
+ cache_scan_free(host_name, NULL, C_IN, 0, crec->flags & (flags | F_CNAME | F_FORWARD), NULL, NULL);
|
||||
/* scan_free deletes all addresses associated with name */
|
||||
break;
|
||||
}
|
||||
@@ -1490,7 +1481,7 @@ void cache_add_dhcp_entry(char *host_nam
|
||||
if (crec->flags & F_NEG)
|
||||
{
|
||||
flags |= F_REVERSE;
|
||||
- cache_scan_free(NULL, (struct all_addr *)host_address, 0, flags, NULL, NULL);
|
||||
+ cache_scan_free(NULL, (struct all_addr *)host_address, C_IN, 0, flags, NULL, NULL);
|
||||
}
|
||||
}
|
||||
else
|
||||
--- a/src/dnsmasq.h
|
||||
+++ b/src/dnsmasq.h
|
||||
@@ -1144,7 +1144,7 @@ struct crec *cache_find_by_name(struct c
|
||||
void cache_end_insert(void);
|
||||
void cache_start_insert(void);
|
||||
int cache_recv_insert(time_t now, int fd);
|
||||
-struct crec *cache_insert(char *name, struct all_addr *addr,
|
||||
+struct crec *cache_insert(char *name, struct all_addr *addr, unsigned short class,
|
||||
time_t now, unsigned long ttl, unsigned short flags);
|
||||
void cache_reload(void);
|
||||
void cache_add_dhcp_entry(char *host_name, int prot, struct all_addr *host_address, time_t ttd);
|
||||
--- a/src/dnssec.c
|
||||
+++ b/src/dnssec.c
|
||||
@@ -798,12 +798,9 @@ int dnssec_validate_by_ds(time_t now, st
|
||||
algo = *p++;
|
||||
keytag = dnskey_keytag(algo, flags, p, rdlen - 4);
|
||||
|
||||
- /* Cache needs to known class for DNSSEC stuff */
|
||||
- a.addr.dnssec.class = class;
|
||||
-
|
||||
if ((key = blockdata_alloc((char*)p, rdlen - 4)))
|
||||
{
|
||||
- if (!(recp1 = cache_insert(name, &a, now, ttl, F_FORWARD | F_DNSKEY | F_DNSSECOK)))
|
||||
+ if (!(recp1 = cache_insert(name, &a, class, now, ttl, F_FORWARD | F_DNSKEY | F_DNSSECOK)))
|
||||
{
|
||||
blockdata_free(key);
|
||||
return STAT_BOGUS;
|
||||
@@ -927,12 +924,9 @@ int dnssec_validate_ds(time_t now, struc
|
||||
algo = *p++;
|
||||
digest = *p++;
|
||||
|
||||
- /* Cache needs to known class for DNSSEC stuff */
|
||||
- a.addr.dnssec.class = class;
|
||||
-
|
||||
if ((key = blockdata_alloc((char*)p, rdlen - 4)))
|
||||
{
|
||||
- if (!(crecp = cache_insert(name, &a, now, ttl, F_FORWARD | F_DS | F_DNSSECOK)))
|
||||
+ if (!(crecp = cache_insert(name, NULL, class, now, ttl, F_FORWARD | F_DS | F_DNSSECOK)))
|
||||
{
|
||||
blockdata_free(key);
|
||||
return STAT_BOGUS;
|
||||
@@ -1021,8 +1015,7 @@ int dnssec_validate_ds(time_t now, struc
|
||||
{
|
||||
cache_start_insert();
|
||||
|
||||
- a.addr.dnssec.class = class;
|
||||
- if (!cache_insert(name, &a, now, ttl, flags))
|
||||
+ if (!cache_insert(name, NULL, class, now, ttl, flags))
|
||||
return STAT_BOGUS;
|
||||
|
||||
cache_end_insert();
|
||||
--- a/src/rfc1035.c
|
||||
+++ b/src/rfc1035.c
|
||||
@@ -701,7 +701,7 @@ int extract_addresses(struct dns_header
|
||||
goto cname_loop;
|
||||
}
|
||||
|
||||
- cache_insert(name, &addr, now, cttl, name_encoding | secflag | F_REVERSE);
|
||||
+ cache_insert(name, &addr, C_IN, now, cttl, name_encoding | secflag | F_REVERSE);
|
||||
found = 1;
|
||||
}
|
||||
|
||||
@@ -719,7 +719,7 @@ int extract_addresses(struct dns_header
|
||||
ttl = find_soa(header, qlen, NULL, doctored);
|
||||
}
|
||||
if (ttl)
|
||||
- cache_insert(NULL, &addr, now, ttl, name_encoding | F_REVERSE | F_NEG | flags | (secure ? F_DNSSECOK : 0));
|
||||
+ cache_insert(NULL, &addr, C_IN, now, ttl, name_encoding | F_REVERSE | F_NEG | flags | (secure ? F_DNSSECOK : 0));
|
||||
}
|
||||
}
|
||||
else
|
||||
@@ -773,7 +773,7 @@ int extract_addresses(struct dns_header
|
||||
{
|
||||
if (!cname_count--)
|
||||
return 0; /* looped CNAMES */
|
||||
- newc = cache_insert(name, NULL, now, attl, F_CNAME | F_FORWARD | secflag);
|
||||
+ newc = cache_insert(name, NULL, C_IN, now, attl, F_CNAME | F_FORWARD | secflag);
|
||||
if (newc)
|
||||
{
|
||||
newc->addr.cname.target.cache = NULL;
|
||||
@@ -833,7 +833,7 @@ int extract_addresses(struct dns_header
|
||||
}
|
||||
#endif
|
||||
|
||||
- newc = cache_insert(name, &addr, now, attl, flags | F_FORWARD | secflag);
|
||||
+ newc = cache_insert(name, &addr, C_IN, now, attl, flags | F_FORWARD | secflag);
|
||||
if (newc && cpp)
|
||||
{
|
||||
next_uid(newc);
|
||||
@@ -860,7 +860,7 @@ int extract_addresses(struct dns_header
|
||||
pointing at this, inherit its TTL */
|
||||
if (ttl || cpp)
|
||||
{
|
||||
- newc = cache_insert(name, NULL, now, ttl ? ttl : cttl, F_FORWARD | F_NEG | flags | (secure ? F_DNSSECOK : 0));
|
||||
+ newc = cache_insert(name, NULL, C_IN, now, ttl ? ttl : cttl, F_FORWARD | F_NEG | flags | (secure ? F_DNSSECOK : 0));
|
||||
if (newc && cpp)
|
||||
{
|
||||
next_uid(newc);
|
||||
@@ -1054,7 +1054,7 @@ int check_for_bogus_wildcard(struct dns_
|
||||
/* Found a bogus address. Insert that info here, since there no SOA record
|
||||
to get the ttl from in the normal processing */
|
||||
cache_start_insert();
|
||||
- cache_insert(name, NULL, now, ttl, F_IPV4 | F_FORWARD | F_NEG | F_NXDOMAIN);
|
||||
+ cache_insert(name, NULL, C_IN, now, ttl, F_IPV4 | F_FORWARD | F_NEG | F_NXDOMAIN);
|
||||
cache_end_insert();
|
||||
|
||||
return 1;
|
||||
|
|
@ -1,363 +0,0 @@
|
|||
From ab194ed7ca433e4e2e8b2ec338bfa4e6aa886a4b Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Tue, 1 Jan 2019 01:35:30 +0000
|
||||
Subject: [PATCH 20/32] Futher address union tidying.
|
||||
|
||||
Pass DNSKEY and DS data into cache_insert via the address argument,
|
||||
now these data types are included in struct all_addr.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/cache.c | 116 ++++++++++++++++----------------------------------
|
||||
src/dnsmasq.h | 26 +++++------
|
||||
src/dnssec.c | 53 +++++++++++------------
|
||||
3 files changed, 73 insertions(+), 122 deletions(-)
|
||||
|
||||
--- a/src/cache.c
|
||||
+++ b/src/cache.c
|
||||
@@ -202,9 +202,9 @@ static void cache_hash(struct crec *crec
|
||||
static void cache_blockdata_free(struct crec *crecp)
|
||||
{
|
||||
if (crecp->flags & F_DNSKEY)
|
||||
- blockdata_free(crecp->addr.key.keydata);
|
||||
+ blockdata_free(crecp->addr.addr.addr.key.keydata);
|
||||
else if ((crecp->flags & F_DS) && !(crecp->flags & F_NEG))
|
||||
- blockdata_free(crecp->addr.ds.keydata);
|
||||
+ blockdata_free(crecp->addr.addr.addr.ds.keydata);
|
||||
}
|
||||
#endif
|
||||
|
||||
@@ -659,33 +659,22 @@ void cache_end_insert(void)
|
||||
read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->ttd, sizeof(new_chain->ttd), 0);
|
||||
read_write(daemon->pipe_to_parent, (unsigned char *)&flags, sizeof(flags), 0);
|
||||
|
||||
- if (flags & (F_IPV4 | F_IPV6))
|
||||
+ if (flags & (F_IPV4 | F_IPV6 | F_DNSKEY | F_DS))
|
||||
read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr, sizeof(new_chain->addr), 0);
|
||||
#ifdef HAVE_DNSSEC
|
||||
- else if (flags & F_DNSKEY)
|
||||
+ if (flags & F_DNSKEY)
|
||||
{
|
||||
read_write(daemon->pipe_to_parent, (unsigned char *)&class, sizeof(class), 0);
|
||||
- read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.algo, sizeof(new_chain->addr.key.algo), 0);
|
||||
- read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.keytag, sizeof(new_chain->addr.key.keytag), 0);
|
||||
- read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.flags, sizeof(new_chain->addr.key.flags), 0);
|
||||
- read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.keylen, sizeof(new_chain->addr.key.keylen), 0);
|
||||
- blockdata_write(new_chain->addr.key.keydata, new_chain->addr.key.keylen, daemon->pipe_to_parent);
|
||||
+ blockdata_write(new_chain->addr.addr.addr.key.keydata, new_chain->addr.addr.addr.key.keylen, daemon->pipe_to_parent);
|
||||
}
|
||||
else if (flags & F_DS)
|
||||
{
|
||||
read_write(daemon->pipe_to_parent, (unsigned char *)&class, sizeof(class), 0);
|
||||
/* A negative DS entry is possible and has no data, obviously. */
|
||||
if (!(flags & F_NEG))
|
||||
- {
|
||||
- read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.algo, sizeof(new_chain->addr.ds.algo), 0);
|
||||
- read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.keytag, sizeof(new_chain->addr.ds.keytag), 0);
|
||||
- read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.digest, sizeof(new_chain->addr.ds.digest), 0);
|
||||
- read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.keylen, sizeof(new_chain->addr.ds.keylen), 0);
|
||||
- blockdata_write(new_chain->addr.ds.keydata, new_chain->addr.ds.keylen, daemon->pipe_to_parent);
|
||||
- }
|
||||
+ blockdata_write(new_chain->addr.addr.addr.ds.keydata, new_chain->addr.addr.addr.ds.keylen, daemon->pipe_to_parent);
|
||||
}
|
||||
#endif
|
||||
-
|
||||
}
|
||||
}
|
||||
|
||||
@@ -736,11 +725,30 @@ int cache_recv_insert(time_t now, int fd
|
||||
|
||||
ttl = difftime(ttd, now);
|
||||
|
||||
- if (flags & (F_IPV4 | F_IPV6))
|
||||
+ if (flags & (F_IPV4 | F_IPV6 | F_DNSKEY | F_DS))
|
||||
{
|
||||
+ unsigned short class = C_IN;
|
||||
+
|
||||
if (!read_write(fd, (unsigned char *)&addr, sizeof(addr), 1))
|
||||
return 0;
|
||||
- crecp = really_insert(daemon->namebuff, &addr, C_IN, now, ttl, flags);
|
||||
+
|
||||
+#ifdef HAVE_DNSSEC
|
||||
+ if (flags & F_DNSKEY)
|
||||
+ {
|
||||
+ if (!read_write(fd, (unsigned char *)&class, sizeof(class), 1) ||
|
||||
+ !(addr.addr.key.keydata = blockdata_read(fd, addr.addr.key.keylen)))
|
||||
+ return 0;
|
||||
+ }
|
||||
+ else if (flags & F_DS)
|
||||
+ {
|
||||
+ if (!read_write(fd, (unsigned char *)&class, sizeof(class), 1) ||
|
||||
+ (flags & F_NEG) ||
|
||||
+ !(addr.addr.key.keydata = blockdata_read(fd, addr.addr.key.keylen)))
|
||||
+ return 0;
|
||||
+ }
|
||||
+#endif
|
||||
+
|
||||
+ crecp = really_insert(daemon->namebuff, &addr, class, now, ttl, flags);
|
||||
}
|
||||
else if (flags & F_CNAME)
|
||||
{
|
||||
@@ -764,58 +772,6 @@ int cache_recv_insert(time_t now, int fd
|
||||
}
|
||||
}
|
||||
}
|
||||
-#ifdef HAVE_DNSSEC
|
||||
- else if (flags & (F_DNSKEY | F_DS))
|
||||
- {
|
||||
- unsigned short class, keylen, keyflags, keytag;
|
||||
- unsigned char algo, digest;
|
||||
- struct blockdata *keydata;
|
||||
-
|
||||
- if (!read_write(fd, (unsigned char *)&class, sizeof(class), 1))
|
||||
- return 0;
|
||||
-
|
||||
- crecp = really_insert(daemon->namebuff, NULL, class, now, ttl, flags);
|
||||
-
|
||||
- if (flags & F_DNSKEY)
|
||||
- {
|
||||
- if (!read_write(fd, (unsigned char *)&algo, sizeof(algo), 1) ||
|
||||
- !read_write(fd, (unsigned char *)&keytag, sizeof(keytag), 1) ||
|
||||
- !read_write(fd, (unsigned char *)&keyflags, sizeof(keyflags), 1) ||
|
||||
- !read_write(fd, (unsigned char *)&keylen, sizeof(keylen), 1) ||
|
||||
- !(keydata = blockdata_read(fd, keylen)))
|
||||
- return 0;
|
||||
- }
|
||||
- else if (!(flags & F_NEG))
|
||||
- {
|
||||
- if (!read_write(fd, (unsigned char *)&algo, sizeof(algo), 1) ||
|
||||
- !read_write(fd, (unsigned char *)&keytag, sizeof(keytag), 1) ||
|
||||
- !read_write(fd, (unsigned char *)&digest, sizeof(digest), 1) ||
|
||||
- !read_write(fd, (unsigned char *)&keylen, sizeof(keylen), 1) ||
|
||||
- !(keydata = blockdata_read(fd, keylen)))
|
||||
- return 0;
|
||||
- }
|
||||
-
|
||||
- if (crecp)
|
||||
- {
|
||||
- if (flags & F_DNSKEY)
|
||||
- {
|
||||
- crecp->addr.key.algo = algo;
|
||||
- crecp->addr.key.keytag = keytag;
|
||||
- crecp->addr.key.flags = flags;
|
||||
- crecp->addr.key.keylen = keylen;
|
||||
- crecp->addr.key.keydata = keydata;
|
||||
- }
|
||||
- else if (!(flags & F_NEG))
|
||||
- {
|
||||
- crecp->addr.ds.algo = algo;
|
||||
- crecp->addr.ds.keytag = keytag;
|
||||
- crecp->addr.ds.digest = digest;
|
||||
- crecp->addr.ds.keylen = keylen;
|
||||
- crecp->addr.ds.keydata = keydata;
|
||||
- }
|
||||
- }
|
||||
- }
|
||||
-#endif
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1290,15 +1246,15 @@ void cache_reload(void)
|
||||
#ifdef HAVE_DNSSEC
|
||||
for (ds = daemon->ds; ds; ds = ds->next)
|
||||
if ((cache = whine_malloc(SIZEOF_POINTER_CREC)) &&
|
||||
- (cache->addr.ds.keydata = blockdata_alloc(ds->digest, ds->digestlen)))
|
||||
+ (cache->addr.addr.addr.ds.keydata = blockdata_alloc(ds->digest, ds->digestlen)))
|
||||
{
|
||||
cache->flags = F_FORWARD | F_IMMORTAL | F_DS | F_CONFIG | F_NAMEP;
|
||||
cache->ttd = daemon->local_ttl;
|
||||
cache->name.namep = ds->name;
|
||||
- cache->addr.ds.keylen = ds->digestlen;
|
||||
- cache->addr.ds.algo = ds->algo;
|
||||
- cache->addr.ds.keytag = ds->keytag;
|
||||
- cache->addr.ds.digest = ds->digest_type;
|
||||
+ cache->addr.addr.addr.ds.keylen = ds->digestlen;
|
||||
+ cache->addr.addr.addr.ds.algo = ds->algo;
|
||||
+ cache->addr.addr.addr.ds.keytag = ds->keytag;
|
||||
+ cache->addr.addr.addr.ds.digest = ds->digest_type;
|
||||
cache->uid = ds->class;
|
||||
cache_hash(cache);
|
||||
make_non_terminals(cache);
|
||||
@@ -1775,12 +1731,12 @@ void dump_cache(time_t now)
|
||||
else if (cache->flags & F_DS)
|
||||
{
|
||||
if (!(cache->flags & F_NEG))
|
||||
- sprintf(a, "%5u %3u %3u", cache->addr.ds.keytag,
|
||||
- cache->addr.ds.algo, cache->addr.ds.digest);
|
||||
+ sprintf(a, "%5u %3u %3u", cache->addr.addr.addr.ds.keytag,
|
||||
+ cache->addr.addr.addr.ds.algo, cache->addr.addr.addr.ds.digest);
|
||||
}
|
||||
else if (cache->flags & F_DNSKEY)
|
||||
- sprintf(a, "%5u %3u %3u", cache->addr.key.keytag,
|
||||
- cache->addr.key.algo, cache->addr.key.flags);
|
||||
+ sprintf(a, "%5u %3u %3u", cache->addr.addr.addr.key.keytag,
|
||||
+ cache->addr.addr.addr.key.algo, cache->addr.addr.addr.key.flags);
|
||||
#endif
|
||||
else if (!(cache->flags & F_NEG) || !(cache->flags & F_FORWARD))
|
||||
{
|
||||
--- a/src/dnsmasq.h
|
||||
+++ b/src/dnsmasq.h
|
||||
@@ -277,14 +277,21 @@ struct all_addr {
|
||||
union {
|
||||
struct in_addr addr4;
|
||||
struct in6_addr addr6;
|
||||
+ struct {
|
||||
+ struct blockdata *keydata;
|
||||
+ unsigned short keylen, flags, keytag;
|
||||
+ unsigned char algo;
|
||||
+ } key;
|
||||
+ struct {
|
||||
+ struct blockdata *keydata;
|
||||
+ unsigned short keylen, keytag;
|
||||
+ unsigned char algo;
|
||||
+ unsigned char digest;
|
||||
+ } ds;
|
||||
/* for log_query */
|
||||
struct {
|
||||
unsigned short keytag, algo, digest, rcode;
|
||||
} log;
|
||||
- /* for cache_insert of DNSKEY, DS */
|
||||
- struct {
|
||||
- unsigned short class, type;
|
||||
- } dnssec;
|
||||
} addr;
|
||||
};
|
||||
|
||||
@@ -414,17 +421,6 @@ struct crec {
|
||||
} target;
|
||||
unsigned int uid; /* 0 if union is interface-name */
|
||||
} cname;
|
||||
- struct {
|
||||
- struct blockdata *keydata;
|
||||
- unsigned short keylen, flags, keytag;
|
||||
- unsigned char algo;
|
||||
- } key;
|
||||
- struct {
|
||||
- struct blockdata *keydata;
|
||||
- unsigned short keylen, keytag;
|
||||
- unsigned char algo;
|
||||
- unsigned char digest;
|
||||
- } ds;
|
||||
} addr;
|
||||
time_t ttd; /* time to die */
|
||||
/* used as class if DNSKEY/DS, index to source for F_HOSTS */
|
||||
--- a/src/dnssec.c
|
||||
+++ b/src/dnssec.c
|
||||
@@ -628,10 +628,10 @@ static int validate_rrset(time_t now, st
|
||||
{
|
||||
/* iterate through all possible keys 4035 5.3.1 */
|
||||
for (; crecp; crecp = cache_find_by_name(crecp, keyname, now, F_DNSKEY))
|
||||
- if (crecp->addr.key.algo == algo &&
|
||||
- crecp->addr.key.keytag == key_tag &&
|
||||
+ if (crecp->addr.addr.addr.key.algo == algo &&
|
||||
+ crecp->addr.addr.addr.key.keytag == key_tag &&
|
||||
crecp->uid == (unsigned int)class &&
|
||||
- verify(crecp->addr.key.keydata, crecp->addr.key.keylen, sig, sig_len, digest, hash->digest_size, algo))
|
||||
+ verify(crecp->addr.addr.addr.key.keydata, crecp->addr.addr.addr.key.keylen, sig, sig_len, digest, hash->digest_size, algo))
|
||||
return (labels < name_labels) ? STAT_SECURE_WILDCARD : STAT_SECURE;
|
||||
}
|
||||
}
|
||||
@@ -728,10 +728,10 @@ int dnssec_validate_by_ds(time_t now, st
|
||||
const struct nettle_hash *hash;
|
||||
int sigcnt, rrcnt;
|
||||
|
||||
- if (recp1->addr.ds.algo == algo &&
|
||||
- recp1->addr.ds.keytag == keytag &&
|
||||
+ if (recp1->addr.addr.addr.ds.algo == algo &&
|
||||
+ recp1->addr.addr.addr.ds.keytag == keytag &&
|
||||
recp1->uid == (unsigned int)class &&
|
||||
- (hash = hash_find(ds_digest_name(recp1->addr.ds.digest))) &&
|
||||
+ (hash = hash_find(ds_digest_name(recp1->addr.addr.addr.ds.digest))) &&
|
||||
hash_init(hash, &ctx, &digest))
|
||||
|
||||
{
|
||||
@@ -746,9 +746,9 @@ int dnssec_validate_by_ds(time_t now, st
|
||||
from_wire(name);
|
||||
|
||||
if (!(recp1->flags & F_NEG) &&
|
||||
- recp1->addr.ds.keylen == (int)hash->digest_size &&
|
||||
- (ds_digest = blockdata_retrieve(recp1->addr.key.keydata, recp1->addr.ds.keylen, NULL)) &&
|
||||
- memcmp(ds_digest, digest, recp1->addr.ds.keylen) == 0 &&
|
||||
+ recp1->addr.addr.addr.ds.keylen == (int)hash->digest_size &&
|
||||
+ (ds_digest = blockdata_retrieve(recp1->addr.addr.addr.ds.keydata, recp1->addr.addr.addr.ds.keylen, NULL)) &&
|
||||
+ memcmp(ds_digest, digest, recp1->addr.addr.addr.ds.keylen) == 0 &&
|
||||
explore_rrset(header, plen, class, T_DNSKEY, name, keyname, &sigcnt, &rrcnt) &&
|
||||
sigcnt != 0 && rrcnt != 0 &&
|
||||
validate_rrset(now, header, plen, class, T_DNSKEY, sigcnt, rrcnt, name, keyname,
|
||||
@@ -800,7 +800,13 @@ int dnssec_validate_by_ds(time_t now, st
|
||||
|
||||
if ((key = blockdata_alloc((char*)p, rdlen - 4)))
|
||||
{
|
||||
- if (!(recp1 = cache_insert(name, &a, class, now, ttl, F_FORWARD | F_DNSKEY | F_DNSSECOK)))
|
||||
+ a.addr.key.keylen = rdlen - 4;
|
||||
+ a.addr.key.keydata = key;
|
||||
+ a.addr.key.algo = algo;
|
||||
+ a.addr.key.keytag = keytag;
|
||||
+ a.addr.key.flags = flags;
|
||||
+
|
||||
+ if (!cache_insert(name, &a, class, now, ttl, F_FORWARD | F_DNSKEY | F_DNSSECOK))
|
||||
{
|
||||
blockdata_free(key);
|
||||
return STAT_BOGUS;
|
||||
@@ -813,12 +819,6 @@ int dnssec_validate_by_ds(time_t now, st
|
||||
log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DNSKEY keytag %hu, algo %hu");
|
||||
else
|
||||
log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DNSKEY keytag %hu, algo %hu (not supported)");
|
||||
-
|
||||
- recp1->addr.key.keylen = rdlen - 4;
|
||||
- recp1->addr.key.keydata = key;
|
||||
- recp1->addr.key.algo = algo;
|
||||
- recp1->addr.key.keytag = keytag;
|
||||
- recp1->addr.key.flags = flags;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -915,8 +915,7 @@ int dnssec_validate_ds(time_t now, struc
|
||||
int algo, digest, keytag;
|
||||
unsigned char *psave = p;
|
||||
struct blockdata *key;
|
||||
- struct crec *crecp;
|
||||
-
|
||||
+
|
||||
if (rdlen < 4)
|
||||
return STAT_BOGUS; /* bad packet */
|
||||
|
||||
@@ -926,7 +925,13 @@ int dnssec_validate_ds(time_t now, struc
|
||||
|
||||
if ((key = blockdata_alloc((char*)p, rdlen - 4)))
|
||||
{
|
||||
- if (!(crecp = cache_insert(name, NULL, class, now, ttl, F_FORWARD | F_DS | F_DNSSECOK)))
|
||||
+ a.addr.ds.digest = digest;
|
||||
+ a.addr.ds.keydata = key;
|
||||
+ a.addr.ds.algo = algo;
|
||||
+ a.addr.ds.keytag = keytag;
|
||||
+ a.addr.ds.keylen = rdlen - 4;
|
||||
+
|
||||
+ if (!cache_insert(name, &a, class, now, ttl, F_FORWARD | F_DS | F_DNSSECOK))
|
||||
{
|
||||
blockdata_free(key);
|
||||
return STAT_BOGUS;
|
||||
@@ -940,12 +945,6 @@ int dnssec_validate_ds(time_t now, struc
|
||||
log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DS keytag %hu, algo %hu, digest %hu");
|
||||
else
|
||||
log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DS keytag %hu, algo %hu, digest %hu (not supported)");
|
||||
-
|
||||
- crecp->addr.ds.digest = digest;
|
||||
- crecp->addr.ds.keydata = key;
|
||||
- crecp->addr.ds.algo = algo;
|
||||
- crecp->addr.ds.keytag = keytag;
|
||||
- crecp->addr.ds.keylen = rdlen - 4;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1711,8 +1710,8 @@ static int zone_status(char *name, int c
|
||||
do
|
||||
{
|
||||
if (crecp->uid == (unsigned int)class &&
|
||||
- ds_digest_name(crecp->addr.ds.digest) &&
|
||||
- algo_digest_name(crecp->addr.ds.algo))
|
||||
+ ds_digest_name(crecp->addr.addr.addr.ds.digest) &&
|
||||
+ algo_digest_name(crecp->addr.addr.addr.ds.algo))
|
||||
break;
|
||||
}
|
||||
while ((crecp = cache_find_by_name(crecp, keyname, now, F_DS)));
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,23 +0,0 @@
|
|||
From 2c594732eb7391e7cfa817598e33e61cab71131f Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Thu, 3 Jan 2019 13:42:03 +0000
|
||||
Subject: [PATCH 22/32] File logic bug in cache-marshalling code. Introduced a
|
||||
couple of commits back.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/cache.c | 3 +--
|
||||
1 file changed, 1 insertion(+), 2 deletions(-)
|
||||
|
||||
--- a/src/cache.c
|
||||
+++ b/src/cache.c
|
||||
@@ -742,8 +742,7 @@ int cache_recv_insert(time_t now, int fd
|
||||
else if (flags & F_DS)
|
||||
{
|
||||
if (!read_write(fd, (unsigned char *)&class, sizeof(class), 1) ||
|
||||
- (flags & F_NEG) ||
|
||||
- !(addr.key.keydata = blockdata_read(fd, addr.key.keylen)))
|
||||
+ (!(flags & F_NEG) && !(addr.key.keydata = blockdata_read(fd, addr.key.keylen))))
|
||||
return 0;
|
||||
}
|
||||
#endif
|
||||
|
|
@ -1,33 +0,0 @@
|
|||
From 2daca52b80afdc92e7c976629a2bf8182335a626 Mon Sep 17 00:00:00 2001
|
||||
From: Christian Weiske <cweiske@cweiske.de>
|
||||
Date: Thu, 3 Jan 2019 20:10:14 +0000
|
||||
Subject: [PATCH 23/32] Fix typo in ra-param man page section.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
man/dnsmasq.8 | 2 +-
|
||||
man/fr/dnsmasq.8 | 2 +-
|
||||
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/man/dnsmasq.8
|
||||
+++ b/man/dnsmasq.8
|
||||
@@ -1829,7 +1829,7 @@ The interval between router advertisemen
|
||||
.B --ra-param=eth0,60.
|
||||
The lifetime of the route may be changed or set to zero, which allows
|
||||
a router to advertise prefixes but not a route via itself.
|
||||
-.B --ra-parm=eth0,0,0
|
||||
+.B --ra-param=eth0,0,0
|
||||
(A value of zero for the interval means the default value.) All four parameters may be set at once.
|
||||
.B --ra-param=eth0,mtu:1280,low,60,1200
|
||||
|
||||
--- a/man/fr/dnsmasq.8
|
||||
+++ b/man/fr/dnsmasq.8
|
||||
@@ -1774,7 +1774,7 @@ Un intervalle (en secondes) entre les an
|
||||
.B --ra-param=eth0,60.
|
||||
La durée de vie de la route peut être changée ou mise à zéro, auquel cas
|
||||
le routeur peut annoncer les préfixes mais pas de route :
|
||||
-.B --ra-parm=eth0,0,0
|
||||
+.B --ra-param=eth0,0,0
|
||||
(une valeur de zéro pour l'intervalle signifie qu'il garde la valeur par défaut).
|
||||
Ces quatre paramètres peuvent être configurés en une fois :
|
||||
.B --ra-param=eth0,mtu:1280,low,60,1200
|
||||
|
|
@ -1,523 +0,0 @@
|
|||
From 5b99eae59d59a8e34a7e512059b98bbd803312f2 Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Sun, 6 Jan 2019 23:09:50 +0000
|
||||
Subject: [PATCH 24/32] Cache SRV records.
|
||||
|
||||
Inpsired by a patch from Jeremy Allison, but completely re-rolled
|
||||
by srk. All bugs are mine.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/auth.c | 2 +-
|
||||
src/blockdata.c | 12 ++---
|
||||
src/cache.c | 64 ++++++++++++++--------
|
||||
src/dnsmasq.c | 2 -
|
||||
src/dnsmasq.h | 11 ++--
|
||||
src/rfc1035.c | 141 ++++++++++++++++++++++++++++++++++++++----------
|
||||
6 files changed, 166 insertions(+), 66 deletions(-)
|
||||
|
||||
--- a/src/auth.c
|
||||
+++ b/src/auth.c
|
||||
@@ -129,7 +129,7 @@ size_t answer_auth(struct dns_header *he
|
||||
|
||||
for (q = ntohs(header->qdcount); q != 0; q--)
|
||||
{
|
||||
- unsigned short flag = 0;
|
||||
+ unsigned int flag = 0;
|
||||
int found = 0;
|
||||
int cname_wildcard = 0;
|
||||
|
||||
--- a/src/blockdata.c
|
||||
+++ b/src/blockdata.c
|
||||
@@ -16,8 +16,6 @@
|
||||
|
||||
#include "dnsmasq.h"
|
||||
|
||||
-#ifdef HAVE_DNSSEC
|
||||
-
|
||||
static struct blockdata *keyblock_free;
|
||||
static unsigned int blockdata_count, blockdata_hwm, blockdata_alloced;
|
||||
|
||||
@@ -54,11 +52,10 @@ void blockdata_init(void)
|
||||
|
||||
void blockdata_report(void)
|
||||
{
|
||||
- if (option_bool(OPT_DNSSEC_VALID))
|
||||
- my_syslog(LOG_INFO, _("DNSSEC memory in use %u, max %u, allocated %u"),
|
||||
- blockdata_count * sizeof(struct blockdata),
|
||||
- blockdata_hwm * sizeof(struct blockdata),
|
||||
- blockdata_alloced * sizeof(struct blockdata));
|
||||
+ my_syslog(LOG_INFO, _("pool memory in use %u, max %u, allocated %u"),
|
||||
+ blockdata_count * sizeof(struct blockdata),
|
||||
+ blockdata_hwm * sizeof(struct blockdata),
|
||||
+ blockdata_alloced * sizeof(struct blockdata));
|
||||
}
|
||||
|
||||
static struct blockdata *blockdata_alloc_real(int fd, char *data, size_t len)
|
||||
@@ -178,4 +175,3 @@ struct blockdata *blockdata_read(int fd,
|
||||
return blockdata_alloc_real(fd, NULL, len);
|
||||
}
|
||||
|
||||
-#endif
|
||||
--- a/src/cache.c
|
||||
+++ b/src/cache.c
|
||||
@@ -27,7 +27,7 @@ static int bignames_left, hash_size;
|
||||
|
||||
static void make_non_terminals(struct crec *source);
|
||||
static struct crec *really_insert(char *name, union all_addr *addr, unsigned short class,
|
||||
- time_t now, unsigned long ttl, unsigned short flags);
|
||||
+ time_t now, unsigned long ttl, unsigned int flags);
|
||||
|
||||
/* type->string mapping: this is also used by the name-hash function as a mixing table. */
|
||||
static const struct {
|
||||
@@ -198,15 +198,17 @@ static void cache_hash(struct crec *crec
|
||||
*up = crecp;
|
||||
}
|
||||
|
||||
-#ifdef HAVE_DNSSEC
|
||||
static void cache_blockdata_free(struct crec *crecp)
|
||||
{
|
||||
- if (crecp->flags & F_DNSKEY)
|
||||
+ if (crecp->flags & F_SRV)
|
||||
+ blockdata_free(crecp->addr.srv.target);
|
||||
+#ifdef HAVE_DNSSEC
|
||||
+ else if (crecp->flags & F_DNSKEY)
|
||||
blockdata_free(crecp->addr.key.keydata);
|
||||
else if ((crecp->flags & F_DS) && !(crecp->flags & F_NEG))
|
||||
blockdata_free(crecp->addr.ds.keydata);
|
||||
-}
|
||||
#endif
|
||||
+}
|
||||
|
||||
static void cache_free(struct crec *crecp)
|
||||
{
|
||||
@@ -230,9 +232,7 @@ static void cache_free(struct crec *crec
|
||||
crecp->flags &= ~F_BIGNAME;
|
||||
}
|
||||
|
||||
-#ifdef HAVE_DNSSEC
|
||||
cache_blockdata_free(crecp);
|
||||
-#endif
|
||||
}
|
||||
|
||||
/* insert a new cache entry at the head of the list (youngest entry) */
|
||||
@@ -331,7 +331,7 @@ static int is_expired(time_t now, struct
|
||||
}
|
||||
|
||||
static struct crec *cache_scan_free(char *name, union all_addr *addr, unsigned short class, time_t now,
|
||||
- unsigned short flags, struct crec **target_crec, unsigned int *target_uid)
|
||||
+ unsigned int flags, struct crec **target_crec, unsigned int *target_uid)
|
||||
{
|
||||
/* Scan and remove old entries.
|
||||
If (flags & F_FORWARD) then remove any forward entries for name and any expired
|
||||
@@ -360,7 +360,7 @@ static struct crec *cache_scan_free(char
|
||||
if ((crecp->flags & F_FORWARD) && hostname_isequal(cache_get_name(crecp), name))
|
||||
{
|
||||
/* Don't delete DNSSEC in favour of a CNAME, they can co-exist */
|
||||
- if ((flags & crecp->flags & (F_IPV4 | F_IPV6)) ||
|
||||
+ if ((flags & crecp->flags & (F_IPV4 | F_IPV6 | F_SRV)) ||
|
||||
(((crecp->flags | flags) & F_CNAME) && !(crecp->flags & (F_DNSKEY | F_DS))))
|
||||
{
|
||||
if (crecp->flags & (F_HOSTS | F_DHCP | F_CONFIG))
|
||||
@@ -467,10 +467,10 @@ void cache_start_insert(void)
|
||||
}
|
||||
|
||||
struct crec *cache_insert(char *name, union all_addr *addr, unsigned short class,
|
||||
- time_t now, unsigned long ttl, unsigned short flags)
|
||||
+ time_t now, unsigned long ttl, unsigned int flags)
|
||||
{
|
||||
/* Don't log DNSSEC records here, done elsewhere */
|
||||
- if (flags & (F_IPV4 | F_IPV6 | F_CNAME))
|
||||
+ if (flags & (F_IPV4 | F_IPV6 | F_CNAME | F_SRV))
|
||||
{
|
||||
log_query(flags | F_UPSTREAM, name, addr, NULL);
|
||||
/* Don't mess with TTL for DNSSEC records. */
|
||||
@@ -485,7 +485,7 @@ struct crec *cache_insert(char *name, un
|
||||
|
||||
|
||||
static struct crec *really_insert(char *name, union all_addr *addr, unsigned short class,
|
||||
- time_t now, unsigned long ttl, unsigned short flags)
|
||||
+ time_t now, unsigned long ttl, unsigned int flags)
|
||||
{
|
||||
struct crec *new, *target_crec = NULL;
|
||||
union bigname *big_name = NULL;
|
||||
@@ -649,7 +649,7 @@ void cache_end_insert(void)
|
||||
{
|
||||
char *name = cache_get_name(new_chain);
|
||||
ssize_t m = strlen(name);
|
||||
- unsigned short flags = new_chain->flags;
|
||||
+ unsigned int flags = new_chain->flags;
|
||||
#ifdef HAVE_DNSSEC
|
||||
u16 class = new_chain->uid;
|
||||
#endif
|
||||
@@ -659,8 +659,10 @@ void cache_end_insert(void)
|
||||
read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->ttd, sizeof(new_chain->ttd), 0);
|
||||
read_write(daemon->pipe_to_parent, (unsigned char *)&flags, sizeof(flags), 0);
|
||||
|
||||
- if (flags & (F_IPV4 | F_IPV6 | F_DNSKEY | F_DS))
|
||||
+ if (flags & (F_IPV4 | F_IPV6 | F_DNSKEY | F_DS | F_SRV))
|
||||
read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr, sizeof(new_chain->addr), 0);
|
||||
+ if (flags & F_SRV)
|
||||
+ blockdata_write(new_chain->addr.srv.target, new_chain->addr.srv.targetlen, daemon->pipe_to_parent);
|
||||
#ifdef HAVE_DNSSEC
|
||||
if (flags & F_DNSKEY)
|
||||
{
|
||||
@@ -699,7 +701,7 @@ int cache_recv_insert(time_t now, int fd
|
||||
union all_addr addr;
|
||||
unsigned long ttl;
|
||||
time_t ttd;
|
||||
- unsigned short flags;
|
||||
+ unsigned int flags;
|
||||
struct crec *crecp = NULL;
|
||||
|
||||
cache_start_insert();
|
||||
@@ -725,13 +727,16 @@ int cache_recv_insert(time_t now, int fd
|
||||
|
||||
ttl = difftime(ttd, now);
|
||||
|
||||
- if (flags & (F_IPV4 | F_IPV6 | F_DNSKEY | F_DS))
|
||||
+ if (flags & (F_IPV4 | F_IPV6 | F_DNSKEY | F_DS | F_SRV))
|
||||
{
|
||||
unsigned short class = C_IN;
|
||||
|
||||
if (!read_write(fd, (unsigned char *)&addr, sizeof(addr), 1))
|
||||
return 0;
|
||||
-
|
||||
+
|
||||
+ if (flags & F_SRV && !(addr.srv.target = blockdata_read(fd, addr.srv.targetlen)))
|
||||
+ return 0;
|
||||
+
|
||||
#ifdef HAVE_DNSSEC
|
||||
if (flags & F_DNSKEY)
|
||||
{
|
||||
@@ -802,7 +807,7 @@ struct crec *cache_find_by_name(struct c
|
||||
/* first search, look for relevant entries and push to top of list
|
||||
also free anything which has expired */
|
||||
struct crec *next, **up, **insert = NULL, **chainp = &ans;
|
||||
- unsigned short ins_flags = 0;
|
||||
+ unsigned int ins_flags = 0;
|
||||
|
||||
for (up = hash_bucket(name), crecp = *up; crecp; crecp = next)
|
||||
{
|
||||
@@ -1086,7 +1091,7 @@ int read_hostsfile(char *filename, unsig
|
||||
FILE *f = fopen(filename, "r");
|
||||
char *token = daemon->namebuff, *domain_suffix = NULL;
|
||||
int addr_count = 0, name_count = cache_size, lineno = 0;
|
||||
- unsigned short flags = 0;
|
||||
+ unsigned int flags = 0;
|
||||
union all_addr addr;
|
||||
int atnl, addrlen = 0;
|
||||
|
||||
@@ -1201,9 +1206,8 @@ void cache_reload(void)
|
||||
for (i=0; i<hash_size; i++)
|
||||
for (cache = hash_table[i], up = &hash_table[i]; cache; cache = tmp)
|
||||
{
|
||||
-#ifdef HAVE_DNSSEC
|
||||
cache_blockdata_free(cache);
|
||||
-#endif
|
||||
+
|
||||
tmp = cache->hash_next;
|
||||
if (cache->flags & (F_HOSTS | F_CONFIG))
|
||||
{
|
||||
@@ -1381,7 +1385,7 @@ void cache_add_dhcp_entry(char *host_nam
|
||||
union all_addr *host_address, time_t ttd)
|
||||
{
|
||||
struct crec *crec = NULL, *fail_crec = NULL;
|
||||
- unsigned short flags = F_IPV4;
|
||||
+ unsigned int flags = F_IPV4;
|
||||
int in_hosts = 0;
|
||||
size_t addrlen = sizeof(struct in_addr);
|
||||
|
||||
@@ -1682,9 +1686,8 @@ void dump_cache(time_t now)
|
||||
#ifdef HAVE_AUTH
|
||||
my_syslog(LOG_INFO, _("queries for authoritative zones %u"), daemon->metrics[METRIC_DNS_AUTH_ANSWERED]);
|
||||
#endif
|
||||
-#ifdef HAVE_DNSSEC
|
||||
+
|
||||
blockdata_report();
|
||||
-#endif
|
||||
|
||||
/* sum counts from different records for same server */
|
||||
for (serv = daemon->servers; serv; serv = serv->next)
|
||||
@@ -1726,6 +1729,17 @@ void dump_cache(time_t now)
|
||||
p += sprintf(p, "%-30.30s ", sanitise(n));
|
||||
if ((cache->flags & F_CNAME) && !is_outdated_cname_pointer(cache))
|
||||
a = sanitise(cache_get_cname_target(cache));
|
||||
+ else if ((cache->flags & F_SRV) && !(cache->flags & F_NEG))
|
||||
+ {
|
||||
+ int targetlen = cache->addr.srv.targetlen;
|
||||
+ ssize_t len = sprintf(a, "%u %u %u ", cache->addr.srv.priority,
|
||||
+ cache->addr.srv.weight, cache->addr.srv.srvport);
|
||||
+
|
||||
+ if (targetlen > (40 - len))
|
||||
+ targetlen = 40 - len;
|
||||
+ blockdata_retrieve(cache->addr.srv.target, targetlen, a + len);
|
||||
+ a[len + targetlen] = 0;
|
||||
+ }
|
||||
#ifdef HAVE_DNSSEC
|
||||
else if (cache->flags & F_DS)
|
||||
{
|
||||
@@ -1752,6 +1766,8 @@ void dump_cache(time_t now)
|
||||
t = "6";
|
||||
else if (cache->flags & F_CNAME)
|
||||
t = "C";
|
||||
+ else if (cache->flags & F_SRV)
|
||||
+ t = "V";
|
||||
#ifdef HAVE_DNSSEC
|
||||
else if (cache->flags & F_DS)
|
||||
t = "S";
|
||||
@@ -1913,6 +1929,8 @@ void log_query(unsigned int flags, char
|
||||
}
|
||||
else if (flags & F_CNAME)
|
||||
dest = "<CNAME>";
|
||||
+ else if (flags & F_SRV)
|
||||
+ dest = "<SRV>";
|
||||
else if (flags & F_RRNAME)
|
||||
dest = arg;
|
||||
|
||||
--- a/src/dnsmasq.c
|
||||
+++ b/src/dnsmasq.c
|
||||
@@ -366,9 +366,7 @@ int main (int argc, char **argv)
|
||||
{
|
||||
cache_init();
|
||||
|
||||
-#ifdef HAVE_DNSSEC
|
||||
blockdata_init();
|
||||
-#endif
|
||||
}
|
||||
|
||||
#ifdef HAVE_INOTIFY
|
||||
--- a/src/dnsmasq.h
|
||||
+++ b/src/dnsmasq.h
|
||||
@@ -299,6 +299,10 @@ union all_addr {
|
||||
unsigned char algo;
|
||||
unsigned char digest;
|
||||
} ds;
|
||||
+ struct {
|
||||
+ struct blockdata *target;
|
||||
+ unsigned short targetlen, srvport, priority, weight;
|
||||
+ } srv;
|
||||
/* for log_query */
|
||||
struct {
|
||||
unsigned short keytag, algo, digest, rcode;
|
||||
@@ -426,7 +430,7 @@ struct crec {
|
||||
time_t ttd; /* time to die */
|
||||
/* used as class if DNSKEY/DS, index to source for F_HOSTS */
|
||||
unsigned int uid;
|
||||
- unsigned short flags;
|
||||
+ unsigned int flags;
|
||||
union {
|
||||
char sname[SMALLDNAME];
|
||||
union bigname *bname;
|
||||
@@ -470,6 +474,7 @@ struct crec {
|
||||
#define F_NOEXTRA (1u<<27)
|
||||
#define F_SERVFAIL (1u<<28)
|
||||
#define F_RCODE (1u<<29)
|
||||
+#define F_SRV (1u<<30)
|
||||
|
||||
#define UID_NONE 0
|
||||
/* Values of uid in crecs with F_CONFIG bit set. */
|
||||
@@ -1142,7 +1147,7 @@ void cache_end_insert(void);
|
||||
void cache_start_insert(void);
|
||||
int cache_recv_insert(time_t now, int fd);
|
||||
struct crec *cache_insert(char *name, union all_addr *addr, unsigned short class,
|
||||
- time_t now, unsigned long ttl, unsigned short flags);
|
||||
+ time_t now, unsigned long ttl, unsigned int flags);
|
||||
void cache_reload(void);
|
||||
void cache_add_dhcp_entry(char *host_name, int prot, union all_addr *host_address, time_t ttd);
|
||||
struct in_addr a_record_from_hosts(char *name, time_t now);
|
||||
@@ -1158,7 +1163,6 @@ int read_hostsfile(char *filename, unsig
|
||||
struct crec **rhash, int hashsz);
|
||||
|
||||
/* blockdata.c */
|
||||
-#ifdef HAVE_DNSSEC
|
||||
void blockdata_init(void);
|
||||
void blockdata_report(void);
|
||||
struct blockdata *blockdata_alloc(char *data, size_t len);
|
||||
@@ -1166,7 +1170,6 @@ void *blockdata_retrieve(struct blockdat
|
||||
struct blockdata *blockdata_read(int fd, size_t len);
|
||||
void blockdata_write(struct blockdata *block, size_t len, int fd);
|
||||
void blockdata_free(struct blockdata *blocks);
|
||||
-#endif
|
||||
|
||||
/* domain.c */
|
||||
char *get_domain(struct in_addr addr);
|
||||
--- a/src/rfc1035.c
|
||||
+++ b/src/rfc1035.c
|
||||
@@ -726,7 +726,7 @@ int extract_addresses(struct dns_header
|
||||
{
|
||||
/* everything other than PTR */
|
||||
struct crec *newc;
|
||||
- int addrlen;
|
||||
+ int addrlen = 0;
|
||||
|
||||
if (qtype == T_A)
|
||||
{
|
||||
@@ -738,7 +738,9 @@ int extract_addresses(struct dns_header
|
||||
addrlen = IN6ADDRSZ;
|
||||
flags |= F_IPV6;
|
||||
}
|
||||
- else
|
||||
+ else if (qtype == T_SRV)
|
||||
+ flags |= F_SRV;
|
||||
+ else
|
||||
continue;
|
||||
|
||||
cname_loop1:
|
||||
@@ -799,39 +801,61 @@ int extract_addresses(struct dns_header
|
||||
{
|
||||
found = 1;
|
||||
|
||||
- /* copy address into aligned storage */
|
||||
- if (!CHECK_LEN(header, p1, qlen, addrlen))
|
||||
- return 0; /* bad packet */
|
||||
- memcpy(&addr, p1, addrlen);
|
||||
-
|
||||
- /* check for returned address in private space */
|
||||
- if (check_rebind)
|
||||
+ if (flags & F_SRV)
|
||||
{
|
||||
- if ((flags & F_IPV4) &&
|
||||
- private_net(addr.addr4, !option_bool(OPT_LOCAL_REBIND)))
|
||||
- return 1;
|
||||
-
|
||||
- if ((flags & F_IPV6) &&
|
||||
- IN6_IS_ADDR_V4MAPPED(&addr.addr6))
|
||||
+ unsigned char *tmp = namep;
|
||||
+
|
||||
+ if (!CHECK_LEN(header, p1, qlen, 6))
|
||||
+ return 0; /* bad packet */
|
||||
+ GETSHORT(addr.srv.priority, p1);
|
||||
+ GETSHORT(addr.srv.weight, p1);
|
||||
+ GETSHORT(addr.srv.srvport, p1);
|
||||
+ if (!extract_name(header, qlen, &p1, name, 1, 0))
|
||||
+ return 0;
|
||||
+ addr.srv.targetlen = strlen(name) + 1; /* include terminating zero */
|
||||
+ if (!(addr.srv.target = blockdata_alloc(name, addr.srv.targetlen)))
|
||||
+ return 0;
|
||||
+
|
||||
+ /* we overwrote the original name, so get it back here. */
|
||||
+ if (!extract_name(header, qlen, &tmp, name, 1, 0))
|
||||
+ return 0;
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+ /* copy address into aligned storage */
|
||||
+ if (!CHECK_LEN(header, p1, qlen, addrlen))
|
||||
+ return 0; /* bad packet */
|
||||
+ memcpy(&addr, p1, addrlen);
|
||||
+
|
||||
+ /* check for returned address in private space */
|
||||
+ if (check_rebind)
|
||||
{
|
||||
- struct in_addr v4;
|
||||
- v4.s_addr = ((const uint32_t *) (&addr.addr6))[3];
|
||||
- if (private_net(v4, !option_bool(OPT_LOCAL_REBIND)))
|
||||
+ if ((flags & F_IPV4) &&
|
||||
+ private_net(addr.addr4, !option_bool(OPT_LOCAL_REBIND)))
|
||||
return 1;
|
||||
+
|
||||
+ if ((flags & F_IPV6) &&
|
||||
+ IN6_IS_ADDR_V4MAPPED(&addr.addr6))
|
||||
+ {
|
||||
+ struct in_addr v4;
|
||||
+ v4.s_addr = ((const uint32_t *) (&addr.addr6))[3];
|
||||
+ if (private_net(v4, !option_bool(OPT_LOCAL_REBIND)))
|
||||
+ return 1;
|
||||
+ }
|
||||
}
|
||||
- }
|
||||
-
|
||||
+
|
||||
#ifdef HAVE_IPSET
|
||||
- if (ipsets && (flags & (F_IPV4 | F_IPV6)))
|
||||
- {
|
||||
- ipsets_cur = ipsets;
|
||||
- while (*ipsets_cur)
|
||||
+ if (ipsets && (flags & (F_IPV4 | F_IPV6)))
|
||||
{
|
||||
- log_query((flags & (F_IPV4 | F_IPV6)) | F_IPSET, name, &addr, *ipsets_cur);
|
||||
- add_to_ipset(*ipsets_cur++, &addr, flags, 0);
|
||||
+ ipsets_cur = ipsets;
|
||||
+ while (*ipsets_cur)
|
||||
+ {
|
||||
+ log_query((flags & (F_IPV4 | F_IPV6)) | F_IPSET, name, &addr, *ipsets_cur);
|
||||
+ add_to_ipset(*ipsets_cur++, &addr, flags, 0);
|
||||
+ }
|
||||
}
|
||||
- }
|
||||
#endif
|
||||
+ }
|
||||
|
||||
newc = cache_insert(name, &addr, C_IN, now, attl, flags | F_FORWARD | secflag);
|
||||
if (newc && cpp)
|
||||
@@ -1844,7 +1868,68 @@ size_t answer_request(struct dns_header
|
||||
*up = move;
|
||||
move->next = NULL;
|
||||
}
|
||||
-
|
||||
+
|
||||
+ if (!found)
|
||||
+ {
|
||||
+ cname_srv_restart:
|
||||
+ if ((crecp = cache_find_by_name(NULL, name, now, F_CNAME | F_SRV | (dryrun ? F_NO_RR : 0))) &&
|
||||
+ (!do_bit || (option_bool(OPT_DNSSEC_VALID) && !(crecp->flags & F_DNSSECOK))))
|
||||
+ {
|
||||
+ if (!(crecp->flags & F_DNSSECOK))
|
||||
+ sec_data = 0;
|
||||
+
|
||||
+ auth = 0;
|
||||
+ found = ans = 1;
|
||||
+
|
||||
+ do {
|
||||
+ if (crecp->flags & F_CNAME)
|
||||
+ {
|
||||
+ char *cname_target = cache_get_cname_target(crecp);
|
||||
+
|
||||
+ if (!dryrun)
|
||||
+ {
|
||||
+ log_query(crecp->flags, name, NULL, record_source(crecp->uid));
|
||||
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp,
|
||||
+ crec_ttl(crecp, now), &nameoffset,
|
||||
+ T_CNAME, C_IN, "d", cname_target))
|
||||
+ anscount++;
|
||||
+ }
|
||||
+
|
||||
+ strcpy(name, cname_target);
|
||||
+ goto cname_srv_restart;
|
||||
+ }
|
||||
+ else if (crecp->flags & F_NEG)
|
||||
+ {
|
||||
+ if (crecp->flags & F_NXDOMAIN)
|
||||
+ nxdomain = 1;
|
||||
+ if (!dryrun)
|
||||
+ log_query(crecp->flags, name, NULL, NULL);
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+ unsigned char *p1 = ((unsigned char *)header) + nameoffset;
|
||||
+
|
||||
+ if (!dryrun)
|
||||
+ {
|
||||
+ log_query(crecp->flags, name, NULL, 0);
|
||||
+
|
||||
+ blockdata_retrieve(crecp->addr.srv.target, crecp->addr.srv.targetlen, name);
|
||||
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp,
|
||||
+ crec_ttl(crecp, now), NULL, T_SRV, C_IN, "sssd",
|
||||
+ crecp->addr.srv.priority, crecp->addr.srv.weight, crecp->addr.srv.srvport,
|
||||
+ name))
|
||||
+ anscount++;
|
||||
+
|
||||
+
|
||||
+ /* restore name we overwrote */
|
||||
+ if (!extract_name(header, qlen, &p1, name, 1, 0))
|
||||
+ return 0; /* bad packet */
|
||||
+ }
|
||||
+ }
|
||||
+ } while ((crecp = cache_find_by_name(crecp, name, now, F_SRV | F_CNAME)));
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
if (!found && option_bool(OPT_FILTER) && (qtype == T_SRV || (qtype == T_ANY && strchr(name, '_'))))
|
||||
{
|
||||
ans = 1;
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
From a90f09db4cc635941a32b973b57e58c662569625 Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Wed, 9 Jan 2019 15:08:16 +0000
|
||||
Subject: [PATCH 25/32] Fix crash freeing negative SRV cache entries.
|
||||
|
||||
Thanks to Daniel for finding this one.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/cache.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
--- a/src/cache.c
|
||||
+++ b/src/cache.c
|
||||
@@ -200,7 +200,7 @@ static void cache_hash(struct crec *crec
|
||||
|
||||
static void cache_blockdata_free(struct crec *crecp)
|
||||
{
|
||||
- if (crecp->flags & F_SRV)
|
||||
+ if (crecp->flags & F_SRV && !(crecp->flags & F_NEG))
|
||||
blockdata_free(crecp->addr.srv.target);
|
||||
#ifdef HAVE_DNSSEC
|
||||
else if (crecp->flags & F_DNSKEY)
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
From 2896e2485e44c04e73a0b7c9f7cbc9c8515d0800 Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Wed, 9 Jan 2019 15:12:34 +0000
|
||||
Subject: [PATCH 26/32] Check for not(DS or DNSKEY) in
|
||||
is_outdated_cname_pointer()
|
||||
|
||||
Previous check was _for_ IPV4, IPv6 CNAME, and I missed adding SRV.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/cache.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
--- a/src/cache.c
|
||||
+++ b/src/cache.c
|
||||
@@ -312,7 +312,7 @@ static int is_outdated_cname_pointer(str
|
||||
/* NB. record may be reused as DS or DNSKEY, where uid is
|
||||
overloaded for something completely different */
|
||||
if (crecp->addr.cname.target.cache &&
|
||||
- (crecp->addr.cname.target.cache->flags & (F_IPV4 | F_IPV6 | F_CNAME)) &&
|
||||
+ !(crecp->addr.cname.target.cache->flags & (F_DNSKEY | F_DS)) &&
|
||||
crecp->addr.cname.uid == crecp->addr.cname.target.cache->uid)
|
||||
return 0;
|
||||
|
||||
|
|
@ -1,95 +0,0 @@
|
|||
From 9c0d445ef4abffa2b9342ad65e85ef425c1f83bb Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Wed, 9 Jan 2019 17:57:56 +0000
|
||||
Subject: [PATCH 27/32] Fix e7bfd556c079c8b5e7425aed44abc35925b24043 to
|
||||
actually work.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/dhcp.c | 54 +++++++++++++++++++++++++----------------------------
|
||||
src/dhcp6.c | 2 +-
|
||||
2 files changed, 26 insertions(+), 30 deletions(-)
|
||||
|
||||
--- a/src/dhcp.c
|
||||
+++ b/src/dhcp.c
|
||||
@@ -754,19 +754,6 @@ int address_allocate(struct dhcp_context
|
||||
if (addr.s_addr == d->router.s_addr)
|
||||
break;
|
||||
|
||||
- /* in consec-ip mode, skip addresses equal to
|
||||
- the number of addresses rejected by clients. This
|
||||
- should avoid the same client being offered the same
|
||||
- address after it has rjected it. */
|
||||
- if (option_bool(OPT_CONSEC_ADDR))
|
||||
- {
|
||||
- if (c->addr_epoch)
|
||||
- {
|
||||
- c->addr_epoch--;
|
||||
- d = context; /* d non-NULL skips the address. */
|
||||
- }
|
||||
- }
|
||||
-
|
||||
/* Addresses which end in .255 and .0 are broken in Windows even when using
|
||||
supernetting. ie dhcp-range=192.168.0.1,192.168.1.254,255,255,254.0
|
||||
then 192.168.0.255 is a valid IP address, but not for Windows as it's
|
||||
@@ -778,24 +765,33 @@ int address_allocate(struct dhcp_context
|
||||
(!IN_CLASSC(ntohl(addr.s_addr)) ||
|
||||
((ntohl(addr.s_addr) & 0xff) != 0xff && ((ntohl(addr.s_addr) & 0xff) != 0x0))))
|
||||
{
|
||||
- struct ping_result *r;
|
||||
-
|
||||
- if ((r = do_icmp_ping(now, addr, j, loopback)))
|
||||
- {
|
||||
- /* consec-ip mode: we offered this address for another client
|
||||
- (different hash) recently, don't offer it to this one. */
|
||||
- if (!option_bool(OPT_CONSEC_ADDR) || r->hash == j)
|
||||
- {
|
||||
- *addrp = addr;
|
||||
- return 1;
|
||||
- }
|
||||
- }
|
||||
+ /* in consec-ip mode, skip addresses equal to
|
||||
+ the number of addresses rejected by clients. This
|
||||
+ should avoid the same client being offered the same
|
||||
+ address after it has rjected it. */
|
||||
+ if (option_bool(OPT_CONSEC_ADDR) && c->addr_epoch)
|
||||
+ c->addr_epoch--;
|
||||
else
|
||||
{
|
||||
- /* address in use: perturb address selection so that we are
|
||||
- less likely to try this address again. */
|
||||
- if (!option_bool(OPT_CONSEC_ADDR))
|
||||
- c->addr_epoch++;
|
||||
+ struct ping_result *r;
|
||||
+
|
||||
+ if ((r = do_icmp_ping(now, addr, j, loopback)))
|
||||
+ {
|
||||
+ /* consec-ip mode: we offered this address for another client
|
||||
+ (different hash) recently, don't offer it to this one. */
|
||||
+ if (!option_bool(OPT_CONSEC_ADDR) || r->hash == j)
|
||||
+ {
|
||||
+ *addrp = addr;
|
||||
+ return 1;
|
||||
+ }
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+ /* address in use: perturb address selection so that we are
|
||||
+ less likely to try this address again. */
|
||||
+ if (!option_bool(OPT_CONSEC_ADDR))
|
||||
+ c->addr_epoch++;
|
||||
+ }
|
||||
}
|
||||
}
|
||||
|
||||
--- a/src/dhcp6.c
|
||||
+++ b/src/dhcp6.c
|
||||
@@ -436,7 +436,7 @@ struct dhcp_context *address6_allocate(s
|
||||
skip addresses equal to the number of addresses rejected
|
||||
by clients. This should avoid the same client being offered the same
|
||||
address after it has rjected it. */
|
||||
- start = lease_find_max_addr6(c) + serial + c->addr_epoch;
|
||||
+ start = lease_find_max_addr6(c) + 1 + serial + c->addr_epoch;
|
||||
if (c->addr_epoch)
|
||||
c->addr_epoch--;
|
||||
}
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
From 4bf62f616b82fad7a7f91195b0204dd64d79a35c Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Thu, 10 Jan 2019 21:54:22 +0000
|
||||
Subject: [PATCH 28/32] Tidy cache_blockdata_free()
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/cache.c | 15 +++++++++------
|
||||
1 file changed, 9 insertions(+), 6 deletions(-)
|
||||
|
||||
--- a/src/cache.c
|
||||
+++ b/src/cache.c
|
||||
@@ -200,14 +200,17 @@ static void cache_hash(struct crec *crec
|
||||
|
||||
static void cache_blockdata_free(struct crec *crecp)
|
||||
{
|
||||
- if (crecp->flags & F_SRV && !(crecp->flags & F_NEG))
|
||||
- blockdata_free(crecp->addr.srv.target);
|
||||
+ if (!(crecp->flags & F_NEG))
|
||||
+ {
|
||||
+ if (crecp->flags & F_SRV)
|
||||
+ blockdata_free(crecp->addr.srv.target);
|
||||
#ifdef HAVE_DNSSEC
|
||||
- else if (crecp->flags & F_DNSKEY)
|
||||
- blockdata_free(crecp->addr.key.keydata);
|
||||
- else if ((crecp->flags & F_DS) && !(crecp->flags & F_NEG))
|
||||
- blockdata_free(crecp->addr.ds.keydata);
|
||||
+ else if (crecp->flags & F_DNSKEY)
|
||||
+ blockdata_free(crecp->addr.key.keydata);
|
||||
+ else if (crecp->flags & F_DS)
|
||||
+ blockdata_free(crecp->addr.ds.keydata);
|
||||
#endif
|
||||
+ }
|
||||
}
|
||||
|
||||
static void cache_free(struct crec *crecp)
|
||||
|
|
@ -1,52 +0,0 @@
|
|||
From f8c77edbdffb8ada7753ea9fa104f0f6da70cfe3 Mon Sep 17 00:00:00 2001
|
||||
From: Simon Kelley <simon@thekelleys.org.uk>
|
||||
Date: Thu, 10 Jan 2019 21:58:18 +0000
|
||||
Subject: [PATCH 29/32] Fix removal of DHCP_CLIENT_MAC options from DHCPv6
|
||||
relay replies.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/rfc3315.c | 30 +++++++++++++++++-------------
|
||||
1 file changed, 17 insertions(+), 13 deletions(-)
|
||||
|
||||
--- a/src/rfc3315.c
|
||||
+++ b/src/rfc3315.c
|
||||
@@ -219,21 +219,25 @@ static int dhcp6_maybe_relay(struct stat
|
||||
if (opt6_ptr(opt, 0) + opt6_len(opt) > end)
|
||||
return 0;
|
||||
|
||||
- int o = new_opt6(opt6_type(opt));
|
||||
- if (opt6_type(opt) == OPTION6_RELAY_MSG)
|
||||
+ /* Don't copy MAC address into reply. */
|
||||
+ if (opt6_type(opt) != OPTION6_CLIENT_MAC)
|
||||
{
|
||||
- struct in6_addr align;
|
||||
- /* the packet data is unaligned, copy to aligned storage */
|
||||
- memcpy(&align, inbuff + 2, IN6ADDRSZ);
|
||||
- state->link_address = &align;
|
||||
- /* zero is_unicast since that is now known to refer to the
|
||||
- relayed packet, not the original sent by the client */
|
||||
- if (!dhcp6_maybe_relay(state, opt6_ptr(opt, 0), opt6_len(opt), client_addr, 0, now))
|
||||
- return 0;
|
||||
+ int o = new_opt6(opt6_type(opt));
|
||||
+ if (opt6_type(opt) == OPTION6_RELAY_MSG)
|
||||
+ {
|
||||
+ struct in6_addr align;
|
||||
+ /* the packet data is unaligned, copy to aligned storage */
|
||||
+ memcpy(&align, inbuff + 2, IN6ADDRSZ);
|
||||
+ state->link_address = &align;
|
||||
+ /* zero is_unicast since that is now known to refer to the
|
||||
+ relayed packet, not the original sent by the client */
|
||||
+ if (!dhcp6_maybe_relay(state, opt6_ptr(opt, 0), opt6_len(opt), client_addr, 0, now))
|
||||
+ return 0;
|
||||
+ }
|
||||
+ else
|
||||
+ put_opt6(opt6_ptr(opt, 0), opt6_len(opt));
|
||||
+ end_opt6(o);
|
||||
}
|
||||
- else if (opt6_type(opt) != OPTION6_CLIENT_MAC)
|
||||
- put_opt6(opt6_ptr(opt, 0), opt6_len(opt));
|
||||
- end_opt6(o);
|
||||
}
|
||||
|
||||
return 1;
|
||||
|
|
@ -1,54 +0,0 @@
|
|||
From 18eac67c0a15b673c8d27002c248651b308093e4 Mon Sep 17 00:00:00 2001
|
||||
From: Steven Siloti <ssiloti@gmail.com>
|
||||
Date: Sun, 13 Jan 2019 22:56:36 +0000
|
||||
Subject: [PATCH 30/32] Fix entries in /etc/hosts disabling static leases.
|
||||
|
||||
It is possible for a config entry to have one address family specified by a
|
||||
dhcp-host directive and the other added from /etc/hosts. This is especially
|
||||
common on OpenWrt because it uses odhcpd for DHCPv6 and IPv6 leases are
|
||||
imported into dnsmasq via a hosts file.
|
||||
|
||||
To handle this case there need to be separate *_HOSTS flags for IPv4 and IPv6.
|
||||
Otherwise when the hosts file is reloaded it will clear the CONFIG_ADDR(6) flag
|
||||
which was set by the dhcp-host directive.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/dhcp-common.c | 8 ++++++--
|
||||
src/dnsmasq.h | 1 +
|
||||
2 files changed, 7 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/src/dhcp-common.c
|
||||
+++ b/src/dhcp-common.c
|
||||
@@ -372,7 +372,11 @@ void dhcp_update_configs(struct dhcp_con
|
||||
|
||||
for (config = configs; config; config = config->next)
|
||||
if (config->flags & CONFIG_ADDR_HOSTS)
|
||||
- config->flags &= ~(CONFIG_ADDR | CONFIG_ADDR6 | CONFIG_ADDR_HOSTS);
|
||||
+ config->flags &= ~(CONFIG_ADDR | CONFIG_ADDR_HOSTS);
|
||||
+#ifdef HAVE_DHCP6
|
||||
+ if (config->flags & CONFIG_ADDR6_HOSTS)
|
||||
+ config->flags &= ~(CONFIG_ADDR6 | CONFIG_ADDR6_HOSTS);
|
||||
+#endif
|
||||
|
||||
#ifdef HAVE_DHCP6
|
||||
again:
|
||||
@@ -421,7 +425,7 @@ void dhcp_update_configs(struct dhcp_con
|
||||
(!(conf_tmp = config_find_by_address6(configs, &crec->addr.addr6, 128, 0)) || conf_tmp == config))
|
||||
{
|
||||
memcpy(&config->addr6, &crec->addr.addr6, IN6ADDRSZ);
|
||||
- config->flags |= CONFIG_ADDR6 | CONFIG_ADDR_HOSTS;
|
||||
+ config->flags |= CONFIG_ADDR6 | CONFIG_ADDR6_HOSTS;
|
||||
continue;
|
||||
}
|
||||
#endif
|
||||
--- a/src/dnsmasq.h
|
||||
+++ b/src/dnsmasq.h
|
||||
@@ -789,6 +789,7 @@ struct dhcp_config {
|
||||
#define CONFIG_BANK 2048 /* from dhcp hosts file */
|
||||
#define CONFIG_ADDR6 4096
|
||||
#define CONFIG_WILDCARD 8192
|
||||
+#define CONFIG_ADDR6_HOSTS 16384 /* address added by from /etc/hosts */
|
||||
|
||||
struct dhcp_opt {
|
||||
int opt, len, flags;
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
From d2d49907435433001ab00698a3e9ca2a7b5b3236 Mon Sep 17 00:00:00 2001
|
||||
From: Steven Siloti <ssiloti@gmail.com>
|
||||
Date: Thu, 17 Jan 2019 22:52:13 +0000
|
||||
Subject: [PATCH 31/32] Fix missing braces in
|
||||
8eac67c0a15b673c8d27002c248651b308093e4
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/dhcp-common.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
--- a/src/dhcp-common.c
|
||||
+++ b/src/dhcp-common.c
|
||||
@@ -371,12 +371,14 @@ void dhcp_update_configs(struct dhcp_con
|
||||
int prot = AF_INET;
|
||||
|
||||
for (config = configs; config; config = config->next)
|
||||
+ {
|
||||
if (config->flags & CONFIG_ADDR_HOSTS)
|
||||
config->flags &= ~(CONFIG_ADDR | CONFIG_ADDR_HOSTS);
|
||||
#ifdef HAVE_DHCP6
|
||||
if (config->flags & CONFIG_ADDR6_HOSTS)
|
||||
config->flags &= ~(CONFIG_ADDR6 | CONFIG_ADDR6_HOSTS);
|
||||
#endif
|
||||
+ }
|
||||
|
||||
#ifdef HAVE_DHCP6
|
||||
again:
|
||||
|
|
@ -1,61 +0,0 @@
|
|||
From 28cfe36e1eee9d2c234e0256ad459956b415a3bb Mon Sep 17 00:00:00 2001
|
||||
From: Brian Haley <haleyb.dev@gmail.com>
|
||||
Date: Thu, 17 Jan 2019 23:21:23 +0000
|
||||
Subject: [PATCH 32/32] Change read_leases() to skip invalid entries.
|
||||
|
||||
There's no reason to stop reading the existing lease file
|
||||
when dnsmasq is started and an invalid entry is found, it
|
||||
can just be ignored. This was fallout from an Openstack
|
||||
bug where the file was being written incorrectly with []
|
||||
around IPv6 addresses.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
src/lease.c | 22 +++++++++++++++-------
|
||||
1 file changed, 15 insertions(+), 7 deletions(-)
|
||||
|
||||
--- a/src/lease.c
|
||||
+++ b/src/lease.c
|
||||
@@ -60,8 +60,13 @@ static int read_leases(time_t now, FILE
|
||||
|
||||
if (fscanf(leasestream, " %64s %255s %764s",
|
||||
daemon->namebuff, daemon->dhcp_buff, daemon->packet) != 3)
|
||||
- return 0;
|
||||
-
|
||||
+ {
|
||||
+ my_syslog(MS_DHCP | LOG_WARNING, _("ignoring invalid line in lease database: %s %s %s %s ..."),
|
||||
+ daemon->dhcp_buff3, daemon->dhcp_buff2,
|
||||
+ daemon->namebuff, daemon->dhcp_buff);
|
||||
+ continue;
|
||||
+ }
|
||||
+
|
||||
if (inet_pton(AF_INET, daemon->namebuff, &addr.addr4))
|
||||
{
|
||||
if ((lease = lease4_allocate(addr.addr4)))
|
||||
@@ -92,7 +97,12 @@ static int read_leases(time_t now, FILE
|
||||
}
|
||||
#endif
|
||||
else
|
||||
- return 0;
|
||||
+ {
|
||||
+ my_syslog(MS_DHCP | LOG_WARNING, _("ignoring invalid line in lease database, bad address: %s"),
|
||||
+ daemon->namebuff);
|
||||
+ continue;
|
||||
+ }
|
||||
+
|
||||
|
||||
if (!lease)
|
||||
die (_("too many stored leases"), NULL, EC_MISC);
|
||||
@@ -172,10 +182,8 @@ void lease_init(time_t now)
|
||||
if (leasestream)
|
||||
{
|
||||
if (!read_leases(now, leasestream))
|
||||
- my_syslog(MS_DHCP | LOG_ERR, _("failed to parse lease database, invalid line: %s %s %s %s ..."),
|
||||
- daemon->dhcp_buff3, daemon->dhcp_buff2,
|
||||
- daemon->namebuff, daemon->dhcp_buff);
|
||||
-
|
||||
+ my_syslog(MS_DHCP | LOG_ERR, _("failed to parse lease database cleanly"));
|
||||
+
|
||||
if (ferror(leasestream))
|
||||
die(_("failed to read lease file %s: %s"), daemon->lease_file, EC_FILE);
|
||||
}
|
||||
|
|
@ -1,35 +0,0 @@
|
|||
From e710c34469af4378c2db6fa0b0be88313adcb68f Mon Sep 17 00:00:00 2001
|
||||
From: Alin Nastac <alin.nastac@gmail.com>
|
||||
Date: Mon, 30 Sep 2019 15:30:26 +0100
|
||||
Subject: [PATCH] Fix crash when negative SRV response over TCP gets stored in
|
||||
LRU cache entry.
|
||||
|
||||
Patch extended to receive side of pipe by SRK.
|
||||
---
|
||||
src/cache.c | 8 ++++++--
|
||||
1 file changed, 6 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/src/cache.c
|
||||
+++ b/src/cache.c
|
||||
@@ -665,7 +665,11 @@ void cache_end_insert(void)
|
||||
if (flags & (F_IPV4 | F_IPV6 | F_DNSKEY | F_DS | F_SRV))
|
||||
read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr, sizeof(new_chain->addr), 0);
|
||||
if (flags & F_SRV)
|
||||
- blockdata_write(new_chain->addr.srv.target, new_chain->addr.srv.targetlen, daemon->pipe_to_parent);
|
||||
+ {
|
||||
+ /* A negative SRV entry is possible and has no data, obviously. */
|
||||
+ if (!(flags & F_NEG))
|
||||
+ blockdata_write(new_chain->addr.srv.target, new_chain->addr.srv.targetlen, daemon->pipe_to_parent);
|
||||
+ }
|
||||
#ifdef HAVE_DNSSEC
|
||||
if (flags & F_DNSKEY)
|
||||
{
|
||||
@@ -737,7 +741,7 @@ int cache_recv_insert(time_t now, int fd
|
||||
if (!read_write(fd, (unsigned char *)&addr, sizeof(addr), 1))
|
||||
return 0;
|
||||
|
||||
- if (flags & F_SRV && !(addr.srv.target = blockdata_read(fd, addr.srv.targetlen)))
|
||||
+ if ((flags & F_SRV) && !(flags & F_NEG) && !(addr.srv.target = blockdata_read(fd, addr.srv.targetlen)))
|
||||
return 0;
|
||||
|
||||
#ifdef HAVE_DNSSEC
|
||||
|
|
@ -1,35 +0,0 @@
|
|||
From 1f55b09dd88bc65b3ee6e3a665bc844a5a9a9e8d Mon Sep 17 00:00:00 2001
|
||||
From: Hans Dedecker <dedeckeh@gmail.com>
|
||||
Date: Fri, 9 Aug 2019 21:08:17 +0200
|
||||
Subject: [PATCH] crypto: use nettle ecc_curve access functions
|
||||
|
||||
Nettle 3.5.1 has made ecc_curve definitions (nettle_secp_192r1,
|
||||
nettle_secp_224r1, nettle_secp_256r1, ...) private and forces
|
||||
users to make use of the accessor functions (nettle_get_secp_192r1,
|
||||
...) to retrieve the specific ecc_curve structs.
|
||||
|
||||
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
|
||||
---
|
||||
src/crypto.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/src/crypto.c
|
||||
+++ b/src/crypto.c
|
||||
@@ -294,7 +294,7 @@ static int dnsmasq_ecdsa_verify(struct b
|
||||
if (!(key_256 = whine_malloc(sizeof(struct ecc_point))))
|
||||
return 0;
|
||||
|
||||
- nettle_ecc_point_init(key_256, &nettle_secp_256r1);
|
||||
+ nettle_ecc_point_init(key_256, nettle_get_secp_256r1());
|
||||
}
|
||||
|
||||
key = key_256;
|
||||
@@ -307,7 +307,7 @@ static int dnsmasq_ecdsa_verify(struct b
|
||||
if (!(key_384 = whine_malloc(sizeof(struct ecc_point))))
|
||||
return 0;
|
||||
|
||||
- nettle_ecc_point_init(key_384, &nettle_secp_384r1);
|
||||
+ nettle_ecc_point_init(key_384, nettle_get_secp_384r1());
|
||||
}
|
||||
|
||||
key = key_384;
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
dnsmasq: fix warning with poll.h include on musl
|
||||
|
||||
Warning is:
|
||||
#warning redirecting incorrect #include <sys/poll.h> to <poll.h>
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
|
||||
|
||||
--- a/src/dnsmasq.h
|
||||
+++ b/src/dnsmasq.h
|
||||
@@ -95,7 +95,7 @@ typedef unsigned long long u64;
|
||||
#if defined(HAVE_SOLARIS_NETWORK)
|
||||
# include <sys/sockio.h>
|
||||
#endif
|
||||
-#include <sys/poll.h>
|
||||
+#include <poll.h>
|
||||
#include <sys/wait.h>
|
||||
#include <sys/time.h>
|
||||
#include <sys/un.h>
|
||||
Loading…
Reference in New Issue