Dnsmasq is a lightweight, easy to configure DNS forwarder and DHCP server. It
is designed to provide DNS and, optionally, DHCP, to a small network. It can
serve the names of local machines which are not in the global DNS. The DHCP
server integrates with the DNS server and allows machines with DHCP-allocated
addresses to appear in the DNS with names configured either in each host or in
a central configuration file. Dnsmasq supports static and dynamic DHCP leases
and BOOTP/TFTP/PXE for network booting of diskless machines.
Dnsmasq is targeted at home networks using NAT and connected to the internet
via a modem, cable-modem or ADSL connection but would be a good choice for any
smallish network (up to 1000 clients is known to work) where low resource use
and ease of configuration are important. -- Simon Kelley
===> The following configuration options are available for dnsmasq-2.93,1:
DBUS=off: D-Bus IPC system support
DNSSEC=on: Enable DNSSEC caching and validation (needs nettle)
DOCS=on: Build and/or install documentation
IPSET=on: Dynamic firewall management of resolved names (needs PF)
IPV6=on: IPv6 protocol support
LUA=off: Support lease-change scripts written in Lua
====> Internationalization Support Level: you can only select none or one of them
IDN=off: IDN: Int'l Domain Names WITHOUT full NLS
NLS=on: IDN+NLS: Int'l Domain Names & National Language support
===> Use 'make config' to modify these settings
dns/dnsmasq: fix DBUS option
I'd overlooked that I need to remove the src/dbus.c patch in v2.92,
fixed now. Thanks for the report.
Reported by: Igor Pavlov
PR: 292674
dns/dnsmasq: update to v2.92 + inotify patch
Changelog: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q1/018380.html
We keep the local patch to enable inotify on FreeBSD 15,
which was only merged after the release but had been in this port
already.
Make it so the pkg-message is printed on new installs and upgrades.
net/chrony: dns/dnsmasq: change rcfile ordering
Make sure that these services start in proper order, and sooner
such that chrony can synchronize time before other services need it.
Note that there is a circular dependency or bootstrapping problem
here in that the system time needs to be halfway correct if you
require your time servers to be looked up through DNS with DNSSEC
enabled because crypto usually needs correct clocks for expiration
checks on signatures to work so the name service needs a correct time,
and looking up the time server needs a working name service.
So be sure you can bootstrap with a skewed time.
Reported by: Lexi Winter
PR: 282566
I am not MFHing this, it's too intrusive.
dns/dnsmasq*: add a checkconfig option to rcfile
and automatically invoke it before restart or stop.
Under the hood, this runs dnsmasq --test.
Bump PORTREVISION of dnsmasq only, the -devel port is not
built regularly.
[commit message by Matthias Andree <mandree@FreeBSD.org>]
dns/dnsmasq: cherry-pick several upstream fixes
all from dnsmasq's Git repository hosted by Simon Kelley:
+ Fix DHCPv6 "use multicast" response
+ Avoid undefined behaviour with the ctype(3) functions.
+ Document suppressing default options in --dhcp-option.
+ Fix --rev-server option.
+ Set the default maximum DNS UDP packet size to 1232.
+ Generalise cached NXDOMAIN replies.
+ Fix possible SEGV when no servers defined.
and bump PORTREVISION. This is so we can let it mature
for two weeks before 2023Q2 and because the upstream
release schedule is unforeseeable.
Obtained from: Simon Kelley <simon@thekelleys.org.uk>
Obtained from: Dominik Derigs <dl6er@dl6er.de>
Obtained from: Taylor R Campbell <campbell+dnsmasq@mumble.net>
dns/dnsmasq: fix rare cache corruption problem
Simon Kelley sent an advisory that in rare circumstances, the cache can
become corrupted and the DNS subsystem then became disfunctional.
This is reported as regression in 2.88.
Chances seem higher this happens with DNSSEC enabled, but seems not limited
to it. For details, please see the patch contained in this commit, or
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2023q1/016821.html
The symptom of this happening is apparently a cache internal error.
2.89 with this fix and a few others is slated for release in a week.
Let's fix the patch already and MFH to 2023Q1 so we keep our liberties
to decide whether we need to move quarterly to 2.89 or rather stick
with 2.88_1.
originally
Reported by: Timo van Roermund (to Simon Kelley in private)
Reported by: Simon Kelley (upstream maintainer, through mailing list)
Obtained from: Simon Kelley (upstream maintainer, Git repository)
MFH: 2023Q1
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
dns: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* Aaron Dalton <aaron@FreeBSD.org>
* Akinori MUSHA aka knu <knu@idaemons.org>
* Alex Samorukov <samm@freebsd.org>
* Alexey Dokuchaev <danfe@FreeBSD.org>
* Allan Jude <allanjude@freebsd.org>
* Amar Takhar <verm@drunkmonk.net>
* Anders Nordby <anders@fix.no>
* Andrew Greenwood <greenwood.andy@gmail.com>
* Anton Berezin <tobez@FreeBSD.org>
* Ashish SHUKLA <ashish@FreeBSD.org>
* Attila Nagy <bra@fsn.hu>
(Only the first 15 lines of the commit message are shown above )
dns/dnsmasq: pull in three more upstream fixes
Cherry-pick these Git commits from the upstream:
--local should behave as --server, not as --address [...]
Fix confusion in DNS retries and --strict-order.
Fix confusion with log-IDs and DNS retries.
loosely prompted by Olivier's
PR: 260331
*/*: Remove redundant '-*' from CONFLICTS definitions
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Approved by: portmgr (blanket)
Clean up some things
- Remove duplicate variables
- Remove nop variables
- Sort categories
- Remove redundant option descriptions that match the default ones
Reported by: portscan
dns/dnsmasq: upgrade to v2.84 (regression fixes)
Upstream blessed v2.84 rc2 (which 2.83_1 effectively already was)
into v2.84 release, so take it (and patch the upstream bug of
leaving "rc2" in the version out).
MFH: 2021Q1 (regression fixes for security fix release)
dns/dnsmasq: regression fixes from upstream Git
Apparently there are situations where dnsmasq 2.83 can confuse
its peers or sockets, and the upstream Git contains fixes for them.
These four fixes essentially take dnsmasq to 2.84test3.
Obtained from: Simon Kelley <simon@thekelleys.org.uk>'s Git repository
dns/dnsmasq: security update to 2.83
CHANGELOG of version 2.83:
Use the values of --min-port and --max-port in outgoing
TCP connections to upstream DNS servers.
Fix a remote buffer overflow problem in the DNSSEC code. Any
dnsmasq with DNSSEC compiled in and enabled is vulnerable to this,
referenced by CVE-2020-25681, CVE-2020-25682, CVE-2020-25683
CVE-2020-25687.
Be sure to only accept UDP DNS query replies at the address
from which the query was originated. This keeps as much entropy
in the {query-ID, random-port} tuple as possible, to help defeat
(Only the first 15 lines of the commit message are shown above )
dns/dnsmasq: update to 2.82 (regression and bug fixes)
Quoting Simon Kelley "This fixes a nasty problem
introduced in 2.81 which causes random crashes on systems where there's
significant DNS activity over TCP. It also fixes DNSSEC validation
problems with zero-TTL DNSKEY and DS records."
Changelog:
<http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob;f=CHANGELOG;h=e6a223119ffcd9ead6cb15153cd49bd3c61e114f;hb=f60fea1fb0a288011f57a25dfb653b8f6f8b46b9#l1>
MFH: 2020Q3 (regression and bug fixes)
dns/dnsmasq: repair damage from UNAUTHORIZED UCL conversion of pkg-message
The pkg-message contains a security note that is necessary on
new installs and on updates alike.
Since per the porter's handbook, the UCL does not support enumeration
of types, and this is not relevant on removal, the UCL change must be
reverted. While here, remove formatting.
Failure inducing commit:
|------------------------------------------------------------------------
|r508835 | mat | 2019-08-13 18:01:59 +0200 (Tue, 13 Aug 2019) | 2 lines
|
|Convert to UCL & cleanup pkg-message (categories d)
|
|------------------------------------------------------------------------
NOTE: The UCL conversion of files/pkg-message.in was not authorized
and damaging and no heads-up was sent to the maintainer.
portmgr@ MUST act more carefully with sweeping changes and hand them out
for review first.
dns/dnsmasq: update to 2.81, unlink dnsmasq-devel
Update dns/dnsmasq to the new upstream version 2.81.
The Makefile has been rearranged with portfmt, except the
LDFLAGS+=..._intllibs... line that portfmt does not recognize.
Changelog:
<http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob;f=CHANGELOG;h=60b08d015b2d5a979f39b8ad43633b419135cb64;hb=7ddb99d251c3f5870c8c308a98bb8f283c831872#l1>
(or see CHANGELOG in the package)
Unlink dnsmasq-devel from the build, but keep the sources,
and mark it IGNORE and list dnsmasq-devel in MOVED.
Upgrade dns/dnsmasq to v2.80.
Security: the installed example configuration file shows a way of
disabling WPAD hijacking, but leaves it commented out. Extend pkg-message.
Changelog: <http://thekelleys.org.uk/dnsmasq/CHANGELOG>
Since installing v2.80 isn't a fix against the vulnerability, and fixing
it needs administrator intervention on upgrades, I am not marking this in
vuxml for now, since we'd need to mark v2.80 vulnerable, too.
MFH: 2018Q4
Security: CERT VU#598349
dns/dnsmasq update to release v2.79
Note there are a few incompatible changes. For details, please see the...
Changelog: <http://thekelleys.org.uk/dnsmasq/CHANGELOG>
Fix up pxelogic.0 suffix logic.
Regression in v2.77 caused by a patch proposed by yours truly.
Reported by: Steven Shiau (via upstream dnsmasq-discuss mailing list)
Obtained from: Chris Novakovich and Simon Kelley
Pointyhat to: mandree@
Allow build on PF-less (NO_IPSET) systems.
This adds a new ports option, IPSET, defaulting to on.
Use the opportunity to use the options helpers OPT_CFLAGS[_OFF] on the
trivial options.
PR: 217900
Submitted by: Oliver Pinter <oliver.pinter@hardenedbsd.org>
Update, new upstream feature+bugfix release v2.76
The upstream maintainer's change log is here, and in the installed
CHANGELOG file:
<http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob_plain;f=CHANGELOG;hb=v2.76>
Drop two patch files that were previously cherry-picked from the
post-v2.75 upstream repository and should no longer be needed.
New dnsmasq upstream release 2.74 (bugfixes)
version 2.74
Fix reversion in 2.73 where --conf-file would attempt to
read the default file, rather than no file.
Fix inotify code to handle dangling symlinks better and
not SEGV in some circumstances.
DNSSEC fix. In the case of a signed CNAME generated by a
wildcard which pointed to an unsigned domain, the wrong
status would be logged, and some necessary checks omitted.
Update to new upstream version 2.72, disabling dnsmasq-devel again.
Remove @dir* stuff from pkg-plist. @sample isn't documented properly
and isn't up to handling files with non-.sample suffix, so stay
away from that part of pkg-plist.
ChangeLog: http://www.thekelleys.org.uk/dnsmasq/CHANGELOG
dns/libidn:
- Add USES=libtool and bump dependent ports
- Add INSTALL_TARGET=install-strip
- Always install libidn-components.png because it is used by libidn.info
- Add -lintl to Libs.private instead of Libs in libidn.pc
Upgrade to new upstream version 2.71. Upstream's changelog:
version 2.71
Subtle change to error handling to help DNSSEC validation
when servers fail to provide NODATA answers for
non-existent DS records.
Tweak code which removes DNSSEC records from answers when
not required. Fixes broken answers when additional section
has real records in it. Thanks to Marco Davids for the bug
report.
Fix DNSSEC validation of ANY queries. Thanks to Marco Davids
for spotting that too.
Fix total DNS failure and 100% CPU use if cachesize set to zero,
regression introduced in 2.69. Thanks to James Hunt and
the Ubuntu crowd for assistance in fixing this.
Upgrade to new upstream version 2.70. Upstream changelog:
Fix crash, introduced in 2.69, on TCP request when dnsmasq compiled
with DNSSEC support, but running without DNSSEC enabled. Thanks to
Manish Sing for spotting that one.
Fix regression which broke ipset functionality. Thanks to Wang Jian
for the bug report.
Submitted by: Herbert J. Skuhra
Upgrade dnsmasq to new stable 2.68 release.
Fixes bind-interfaces with IPv6 on FreeBSD.
version 2.68
Use random addresses for DHCPv6 temporary address
allocations, instead of algorithmically determined stable
addresses.
Fix bug which meant that the DHCPv6 DUID was not available
in DHCP script runs during the lifetime of the dnsmasq
process which created the DUID de-novo. Once the DUID was
created and stored in the lease file and dnsmasq
restarted, this bug disappeared.
(Only the first 15 lines of the commit message are shown above )
Assorted fixes to dependencies on various build options,
particularly with NLS enabled when libidn was built without NLS.
While here, group OPTIONS and clean up things a bit, and print
configuration of port and libidn port for debugging.
The particular build failure was
Reported by: Yuri Vorobyev
Upgrade dnsmasq to new upstream release 2.67.
Changelog: <http://www.thekelleys.org.uk/dnsmasq/CHANGELOG>
Enable NLS and IPV6 options by default.
Use shebangfix on files that need it.
Mark dnsmasq-devel (older than release) IGNORE.
Update to new upstream release 2.66.
New DHCPv6 stuff, ability to act as authoritative server for local data.
Changelog: http://www.thekelleys.org.uk/dnsmasq/CHANGELOG
Feature safe: yes
Update to new upstream release 2.65.
Upstream changes:
Fix regression which broke forwarding of queries sent via
TCP which are not for A and AAAA and which were directed to
non-default servers. Thanks to Niax for the bug report.
Fix failure to build with DHCP support excluded. Thanks to
Gustavo Zacarias for the patch.
Fix nasty regression in 2.64 which completely broke cacheing.
Update to new upstream release 2.65.
Upstream changes:
TCP which are not for A and AAAA and which were directed to
non-default servers. Thanks to Niax for the bug report.
Fix failure to build with DHCP support excluded. Thanks to
Gustavo Zacarias for the patch.
Fix nasty regression in 2.64 which completely broke cacheing.
Update to new upstream release 2.64.
Feature safe: yes
Changelog for version 2.64:
Handle DHCP FQDN options with all flag bits zero and --dhcp-client-update set.
Thanks to Bernd Krumbroeck for spotting the problem.
Finesse the check for /etc/hosts names which conflict with DHCP names.
Previously a name/address pair in /etc/hosts which didn't match the
name/address of a DHCP lease would generate a warning. Now that only
happesn if there is not also a match. This allows multiple addresses for
a name in /etc/hosts with one of them assigned via DHCP.
(Only the first 15 lines of the commit message are shown above )
