Fix problem with re-allocation of serverarray.

Rationalise domain parsing for --rev-server and --domain.
Don't re-use datastructures for --address and --local.
2026-11-04 13:48:30 +00:00 · 2021-06-26 21:13:41 +01:00 · 2021-06-26 18:51:05 +01:00 · 2021-06-26 01:00:37 +01:00 · 2021-06-26 00:38:55 +01:00 · 2021-06-26 00:38:01 +01:00
166 changed files with 74831 additions and 14333 deletions
@@ -0,0 +1 @@
 VERSION export-subst
@@ -0,0 +1,14 @@
 src/*.o
 src/*.mo
 src/dnsmasq.pot
 src/dnsmasq
 src/dnsmasq_baseline
 src/.copts_*
 contrib/lease-tools/dhcp_lease_time
 contrib/lease-tools/dhcp_release
 contrib/lease-tools/dhcp_release6
 debian/files
 debian/substvars
 debian/utils-substvars
 debian/trees/
 debian/build/
@@ -0,0 +1,3 @@
 ifneq ($(TARGET_SIMULATOR),true)
 include $(call all-subdir-makefiles)
 endif
@@ -0,0 +1,674 @@
                    GNU GENERAL PUBLIC LICENSE
                       Version 3, 29 June 2007
 Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.
                            Preamble
  The GNU General Public License is a free, copyleft license for
 software and other kinds of works.
  The licenses for most software and other practical works are designed
 to take away your freedom to share and change the works.  By contrast,
 the GNU General Public License is intended to guarantee your freedom to
 share and change all versions of a program--to make sure it remains free
 software for all its users.  We, the Free Software Foundation, use the
 GNU General Public License for most of our software; it applies also to
 any other work released this way by its authors.  You can apply it to
 your programs, too.
  When we speak of free software, we are referring to freedom, not
 price.  Our General Public Licenses are designed to make sure that you
 have the freedom to distribute copies of free software (and charge for
 them if you wish), that you receive source code or can get it if you
 want it, that you can change the software or use pieces of it in new
 free programs, and that you know you can do these things.
  To protect your rights, we need to prevent others from denying you
 these rights or asking you to surrender the rights.  Therefore, you have
 certain responsibilities if you distribute copies of the software, or if
 you modify it: responsibilities to respect the freedom of others.
  For example, if you distribute copies of such a program, whether
 gratis or for a fee, you must pass on to the recipients the same
 freedoms that you received.  You must make sure that they, too, receive
 or can get the source code.  And you must show them these terms so they
 know their rights.
  Developers that use the GNU GPL protect your rights with two steps:
 (1) assert copyright on the software, and (2) offer you this License
 giving you legal permission to copy, distribute and/or modify it.
  For the developers' and authors' protection, the GPL clearly explains
 that there is no warranty for this free software.  For both users' and
 authors' sake, the GPL requires that modified versions be marked as
 changed, so that their problems will not be attributed erroneously to
 authors of previous versions.
  Some devices are designed to deny users access to install or run
 modified versions of the software inside them, although the manufacturer
 can do so.  This is fundamentally incompatible with the aim of
 protecting users' freedom to change the software.  The systematic
 pattern of such abuse occurs in the area of products for individuals to
 use, which is precisely where it is most unacceptable.  Therefore, we
 have designed this version of the GPL to prohibit the practice for those
 products.  If such problems arise substantially in other domains, we
 stand ready to extend this provision to those domains in future versions
 of the GPL, as needed to protect the freedom of users.
  Finally, every program is threatened constantly by software patents.
 States should not allow patents to restrict development and use of
 software on general-purpose computers, but in those that do, we wish to
 avoid the special danger that patents applied to a free program could
 make it effectively proprietary.  To prevent this, the GPL assures that
 patents cannot be used to render the program non-free.
  The precise terms and conditions for copying, distribution and
 modification follow.
                       TERMS AND CONDITIONS
  0. Definitions.
  "This License" refers to version 3 of the GNU General Public License.
  "Copyright" also means copyright-like laws that apply to other kinds of
 works, such as semiconductor masks.
  "The Program" refers to any copyrightable work licensed under this
 License.  Each licensee is addressed as "you".  "Licensees" and
 "recipients" may be individuals or organizations.
  To "modify" a work means to copy from or adapt all or part of the work
 in a fashion requiring copyright permission, other than the making of an
 exact copy.  The resulting work is called a "modified version" of the
 earlier work or a work "based on" the earlier work.
  A "covered work" means either the unmodified Program or a work based
 on the Program.
  To "propagate" a work means to do anything with it that, without
 permission, would make you directly or secondarily liable for
 infringement under applicable copyright law, except executing it on a
 computer or modifying a private copy.  Propagation includes copying,
 distribution (with or without modification), making available to the
 public, and in some countries other activities as well.
  To "convey" a work means any kind of propagation that enables other
 parties to make or receive copies.  Mere interaction with a user through
 a computer network, with no transfer of a copy, is not conveying.
  An interactive user interface displays "Appropriate Legal Notices"
 to the extent that it includes a convenient and prominently visible
 feature that (1) displays an appropriate copyright notice, and (2)
 tells the user that there is no warranty for the work (except to the
 extent that warranties are provided), that licensees may convey the
 work under this License, and how to view a copy of this License.  If
 the interface presents a list of user commands or options, such as a
 menu, a prominent item in the list meets this criterion.
  1. Source Code.
  The "source code" for a work means the preferred form of the work
 for making modifications to it.  "Object code" means any non-source
 form of a work.
  A "Standard Interface" means an interface that either is an official
 standard defined by a recognized standards body, or, in the case of
 interfaces specified for a particular programming language, one that
 is widely used among developers working in that language.
  The "System Libraries" of an executable work include anything, other
 than the work as a whole, that (a) is included in the normal form of
 packaging a Major Component, but which is not part of that Major
 Component, and (b) serves only to enable use of the work with that
 Major Component, or to implement a Standard Interface for which an
 implementation is available to the public in source code form.  A
 "Major Component", in this context, means a major essential component
 (kernel, window system, and so on) of the specific operating system
 (if any) on which the executable work runs, or a compiler used to
 produce the work, or an object code interpreter used to run it.
  The "Corresponding Source" for a work in object code form means all
 the source code needed to generate, install, and (for an executable
 work) run the object code and to modify the work, including scripts to
 control those activities.  However, it does not include the work's
 System Libraries, or general-purpose tools or generally available free
 programs which are used unmodified in performing those activities but
 which are not part of the work.  For example, Corresponding Source
 includes interface definition files associated with source files for
 the work, and the source code for shared libraries and dynamically
 linked subprograms that the work is specifically designed to require,
 such as by intimate data communication or control flow between those
 subprograms and other parts of the work.
  The Corresponding Source need not include anything that users
 can regenerate automatically from other parts of the Corresponding
 Source.
  The Corresponding Source for a work in source code form is that
 same work.
  2. Basic Permissions.
  All rights granted under this License are granted for the term of
 copyright on the Program, and are irrevocable provided the stated
 conditions are met.  This License explicitly affirms your unlimited
 permission to run the unmodified Program.  The output from running a
 covered work is covered by this License only if the output, given its
 content, constitutes a covered work.  This License acknowledges your
 rights of fair use or other equivalent, as provided by copyright law.
  You may make, run and propagate covered works that you do not
 convey, without conditions so long as your license otherwise remains
 in force.  You may convey covered works to others for the sole purpose
 of having them make modifications exclusively for you, or provide you
 with facilities for running those works, provided that you comply with
 the terms of this License in conveying all material for which you do
 not control copyright.  Those thus making or running the covered works
 for you must do so exclusively on your behalf, under your direction
 and control, on terms that prohibit them from making any copies of
 your copyrighted material outside their relationship with you.
  Conveying under any other circumstances is permitted solely under
 the conditions stated below.  Sublicensing is not allowed; section 10
 makes it unnecessary.
  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
  No covered work shall be deemed part of an effective technological
 measure under any applicable law fulfilling obligations under article
 11 of the WIPO copyright treaty adopted on 20 December 1996, or
 similar laws prohibiting or restricting circumvention of such
 measures.
  When you convey a covered work, you waive any legal power to forbid
 circumvention of technological measures to the extent such circumvention
 is effected by exercising rights under this License with respect to
 the covered work, and you disclaim any intention to limit operation or
 modification of the work as a means of enforcing, against the work's
 users, your or third parties' legal rights to forbid circumvention of
 technological measures.
  4. Conveying Verbatim Copies.
  You may convey verbatim copies of the Program's source code as you
 receive it, in any medium, provided that you conspicuously and
 appropriately publish on each copy an appropriate copyright notice;
 keep intact all notices stating that this License and any
 non-permissive terms added in accord with section 7 apply to the code;
 keep intact all notices of the absence of any warranty; and give all
 recipients a copy of this License along with the Program.
  You may charge any price or no price for each copy that you convey,
 and you may offer support or warranty protection for a fee.
  5. Conveying Modified Source Versions.
  You may convey a work based on the Program, or the modifications to
 produce it from the Program, in the form of source code under the
 terms of section 4, provided that you also meet all of these conditions:
    a) The work must carry prominent notices stating that you modified
    it, and giving a relevant date.
    b) The work must carry prominent notices stating that it is
    released under this License and any conditions added under section
    7.  This requirement modifies the requirement in section 4 to
    "keep intact all notices".
    c) You must license the entire work, as a whole, under this
    License to anyone who comes into possession of a copy.  This
    License will therefore apply, along with any applicable section 7
    additional terms, to the whole of the work, and all its parts,
    regardless of how they are packaged.  This License gives no
    permission to license the work in any other way, but it does not
    invalidate such permission if you have separately received it.
    d) If the work has interactive user interfaces, each must display
    Appropriate Legal Notices; however, if the Program has interactive
    interfaces that do not display Appropriate Legal Notices, your
    work need not make them do so.
  A compilation of a covered work with other separate and independent
 works, which are not by their nature extensions of the covered work,
 and which are not combined with it such as to form a larger program,
 in or on a volume of a storage or distribution medium, is called an
 "aggregate" if the compilation and its resulting copyright are not
 used to limit the access or legal rights of the compilation's users
 beyond what the individual works permit.  Inclusion of a covered work
 in an aggregate does not cause this License to apply to the other
 parts of the aggregate.
  6. Conveying Non-Source Forms.
  You may convey a covered work in object code form under the terms
 of sections 4 and 5, provided that you also convey the
 machine-readable Corresponding Source under the terms of this License,
 in one of these ways:
    a) Convey the object code in, or embodied in, a physical product
    (including a physical distribution medium), accompanied by the
    Corresponding Source fixed on a durable physical medium
    customarily used for software interchange.
    b) Convey the object code in, or embodied in, a physical product
    (including a physical distribution medium), accompanied by a
    written offer, valid for at least three years and valid for as
    long as you offer spare parts or customer support for that product
    model, to give anyone who possesses the object code either (1) a
    copy of the Corresponding Source for all the software in the
    product that is covered by this License, on a durable physical
    medium customarily used for software interchange, for a price no
    more than your reasonable cost of physically performing this
    conveying of source, or (2) access to copy the
    Corresponding Source from a network server at no charge.
    c) Convey individual copies of the object code with a copy of the
    written offer to provide the Corresponding Source.  This
    alternative is allowed only occasionally and noncommercially, and
    only if you received the object code with such an offer, in accord
    with subsection 6b.
    d) Convey the object code by offering access from a designated
    place (gratis or for a charge), and offer equivalent access to the
    Corresponding Source in the same way through the same place at no
    further charge.  You need not require recipients to copy the
    Corresponding Source along with the object code.  If the place to
    copy the object code is a network server, the Corresponding Source
    may be on a different server (operated by you or a third party)
    that supports equivalent copying facilities, provided you maintain
    clear directions next to the object code saying where to find the
    Corresponding Source.  Regardless of what server hosts the
    Corresponding Source, you remain obligated to ensure that it is
    available for as long as needed to satisfy these requirements.
    e) Convey the object code using peer-to-peer transmission, provided
    you inform other peers where the object code and Corresponding
    Source of the work are being offered to the general public at no
    charge under subsection 6d.
  A separable portion of the object code, whose source code is excluded
 from the Corresponding Source as a System Library, need not be
 included in conveying the object code work.
  A "User Product" is either (1) a "consumer product", which means any
 tangible personal property which is normally used for personal, family,
 or household purposes, or (2) anything designed or sold for incorporation
 into a dwelling.  In determining whether a product is a consumer product,
 doubtful cases shall be resolved in favor of coverage.  For a particular
 product received by a particular user, "normally used" refers to a
 typical or common use of that class of product, regardless of the status
 of the particular user or of the way in which the particular user
 actually uses, or expects or is expected to use, the product.  A product
 is a consumer product regardless of whether the product has substantial
 commercial, industrial or non-consumer uses, unless such uses represent
 the only significant mode of use of the product.
  "Installation Information" for a User Product means any methods,
 procedures, authorization keys, or other information required to install
 and execute modified versions of a covered work in that User Product from
 a modified version of its Corresponding Source.  The information must
 suffice to ensure that the continued functioning of the modified object
 code is in no case prevented or interfered with solely because
 modification has been made.
  If you convey an object code work under this section in, or with, or
 specifically for use in, a User Product, and the conveying occurs as
 part of a transaction in which the right of possession and use of the
 User Product is transferred to the recipient in perpetuity or for a
 fixed term (regardless of how the transaction is characterized), the
 Corresponding Source conveyed under this section must be accompanied
 by the Installation Information.  But this requirement does not apply
 if neither you nor any third party retains the ability to install
 modified object code on the User Product (for example, the work has
 been installed in ROM).
  The requirement to provide Installation Information does not include a
 requirement to continue to provide support service, warranty, or updates
 for a work that has been modified or installed by the recipient, or for
 the User Product in which it has been modified or installed.  Access to a
 network may be denied when the modification itself materially and
 adversely affects the operation of the network or violates the rules and
 protocols for communication across the network.
  Corresponding Source conveyed, and Installation Information provided,
 in accord with this section must be in a format that is publicly
 documented (and with an implementation available to the public in
 source code form), and must require no special password or key for
 unpacking, reading or copying.
  7. Additional Terms.
  "Additional permissions" are terms that supplement the terms of this
 License by making exceptions from one or more of its conditions.
 Additional permissions that are applicable to the entire Program shall
 be treated as though they were included in this License, to the extent
 that they are valid under applicable law.  If additional permissions
 apply only to part of the Program, that part may be used separately
 under those permissions, but the entire Program remains governed by
 this License without regard to the additional permissions.
  When you convey a copy of a covered work, you may at your option
 remove any additional permissions from that copy, or from any part of
 it.  (Additional permissions may be written to require their own
 removal in certain cases when you modify the work.)  You may place
 additional permissions on material, added by you to a covered work,
 for which you have or can give appropriate copyright permission.
  Notwithstanding any other provision of this License, for material you
 add to a covered work, you may (if authorized by the copyright holders of
 that material) supplement the terms of this License with terms:
    a) Disclaiming warranty or limiting liability differently from the
    terms of sections 15 and 16 of this License; or
    b) Requiring preservation of specified reasonable legal notices or
    author attributions in that material or in the Appropriate Legal
    Notices displayed by works containing it; or
    c) Prohibiting misrepresentation of the origin of that material, or
    requiring that modified versions of such material be marked in
    reasonable ways as different from the original version; or
    d) Limiting the use for publicity purposes of names of licensors or
    authors of the material; or
    e) Declining to grant rights under trademark law for use of some
    trade names, trademarks, or service marks; or
    f) Requiring indemnification of licensors and authors of that
    material by anyone who conveys the material (or modified versions of
    it) with contractual assumptions of liability to the recipient, for
    any liability that these contractual assumptions directly impose on
    those licensors and authors.
  All other non-permissive additional terms are considered "further
 restrictions" within the meaning of section 10.  If the Program as you
 received it, or any part of it, contains a notice stating that it is
 governed by this License along with a term that is a further
 restriction, you may remove that term.  If a license document contains
 a further restriction but permits relicensing or conveying under this
 License, you may add to a covered work material governed by the terms
 of that license document, provided that the further restriction does
 not survive such relicensing or conveying.
  If you add terms to a covered work in accord with this section, you
 must place, in the relevant source files, a statement of the
 additional terms that apply to those files, or a notice indicating
 where to find the applicable terms.
  Additional terms, permissive or non-permissive, may be stated in the
 form of a separately written license, or stated as exceptions;
 the above requirements apply either way.
  8. Termination.
  You may not propagate or modify a covered work except as expressly
 provided under this License.  Any attempt otherwise to propagate or
 modify it is void, and will automatically terminate your rights under
 this License (including any patent licenses granted under the third
 paragraph of section 11).
  However, if you cease all violation of this License, then your
 license from a particular copyright holder is reinstated (a)
 provisionally, unless and until the copyright holder explicitly and
 finally terminates your license, and (b) permanently, if the copyright
 holder fails to notify you of the violation by some reasonable means
 prior to 60 days after the cessation.
  Moreover, your license from a particular copyright holder is
 reinstated permanently if the copyright holder notifies you of the
 violation by some reasonable means, this is the first time you have
 received notice of violation of this License (for any work) from that
 copyright holder, and you cure the violation prior to 30 days after
 your receipt of the notice.
  Termination of your rights under this section does not terminate the
 licenses of parties who have received copies or rights from you under
 this License.  If your rights have been terminated and not permanently
 reinstated, you do not qualify to receive new licenses for the same
 material under section 10.
  9. Acceptance Not Required for Having Copies.
  You are not required to accept this License in order to receive or
 run a copy of the Program.  Ancillary propagation of a covered work
 occurring solely as a consequence of using peer-to-peer transmission
 to receive a copy likewise does not require acceptance.  However,
 nothing other than this License grants you permission to propagate or
 modify any covered work.  These actions infringe copyright if you do
 not accept this License.  Therefore, by modifying or propagating a
 covered work, you indicate your acceptance of this License to do so.
  10. Automatic Licensing of Downstream Recipients.
  Each time you convey a covered work, the recipient automatically
 receives a license from the original licensors, to run, modify and
 propagate that work, subject to this License.  You are not responsible
 for enforcing compliance by third parties with this License.
  An "entity transaction" is a transaction transferring control of an
 organization, or substantially all assets of one, or subdividing an
 organization, or merging organizations.  If propagation of a covered
 work results from an entity transaction, each party to that
 transaction who receives a copy of the work also receives whatever
 licenses to the work the party's predecessor in interest had or could
 give under the previous paragraph, plus a right to possession of the
 Corresponding Source of the work from the predecessor in interest, if
 the predecessor has it or can get it with reasonable efforts.
  You may not impose any further restrictions on the exercise of the
 rights granted or affirmed under this License.  For example, you may
 not impose a license fee, royalty, or other charge for exercise of
 rights granted under this License, and you may not initiate litigation
 (including a cross-claim or counterclaim in a lawsuit) alleging that
 any patent claim is infringed by making, using, selling, offering for
 sale, or importing the Program or any portion of it.
  11. Patents.
  A "contributor" is a copyright holder who authorizes use under this
 License of the Program or a work on which the Program is based.  The
 work thus licensed is called the contributor's "contributor version".
  A contributor's "essential patent claims" are all patent claims
 owned or controlled by the contributor, whether already acquired or
 hereafter acquired, that would be infringed by some manner, permitted
 by this License, of making, using, or selling its contributor version,
 but do not include claims that would be infringed only as a
 consequence of further modification of the contributor version.  For
 purposes of this definition, "control" includes the right to grant
 patent sublicenses in a manner consistent with the requirements of
 this License.
  Each contributor grants you a non-exclusive, worldwide, royalty-free
 patent license under the contributor's essential patent claims, to
 make, use, sell, offer for sale, import and otherwise run, modify and
 propagate the contents of its contributor version.
  In the following three paragraphs, a "patent license" is any express
 agreement or commitment, however denominated, not to enforce a patent
 (such as an express permission to practice a patent or covenant not to
 sue for patent infringement).  To "grant" such a patent license to a
 party means to make such an agreement or commitment not to enforce a
 patent against the party.
  If you convey a covered work, knowingly relying on a patent license,
 and the Corresponding Source of the work is not available for anyone
 to copy, free of charge and under the terms of this License, through a
 publicly available network server or other readily accessible means,
 then you must either (1) cause the Corresponding Source to be so
 available, or (2) arrange to deprive yourself of the benefit of the
 patent license for this particular work, or (3) arrange, in a manner
 consistent with the requirements of this License, to extend the patent
 license to downstream recipients.  "Knowingly relying" means you have
 actual knowledge that, but for the patent license, your conveying the
 covered work in a country, or your recipient's use of the covered work
 in a country, would infringe one or more identifiable patents in that
 country that you have reason to believe are valid.
  If, pursuant to or in connection with a single transaction or
 arrangement, you convey, or propagate by procuring conveyance of, a
 covered work, and grant a patent license to some of the parties
 receiving the covered work authorizing them to use, propagate, modify
 or convey a specific copy of the covered work, then the patent license
 you grant is automatically extended to all recipients of the covered
 work and works based on it.
  A patent license is "discriminatory" if it does not include within
 the scope of its coverage, prohibits the exercise of, or is
 conditioned on the non-exercise of one or more of the rights that are
 specifically granted under this License.  You may not convey a covered
 work if you are a party to an arrangement with a third party that is
 in the business of distributing software, under which you make payment
 to the third party based on the extent of your activity of conveying
 the work, and under which the third party grants, to any of the
 parties who would receive the covered work from you, a discriminatory
 patent license (a) in connection with copies of the covered work
 conveyed by you (or copies made from those copies), or (b) primarily
 for and in connection with specific products or compilations that
 contain the covered work, unless you entered into that arrangement,
 or that patent license was granted, prior to 28 March 2007.
  Nothing in this License shall be construed as excluding or limiting
 any implied license or other defenses to infringement that may
 otherwise be available to you under applicable patent law.
  12. No Surrender of Others' Freedom.
  If conditions are imposed on you (whether by court order, agreement or
 otherwise) that contradict the conditions of this License, they do not
 excuse you from the conditions of this License.  If you cannot convey a
 covered work so as to satisfy simultaneously your obligations under this
 License and any other pertinent obligations, then as a consequence you may
 not convey it at all.  For example, if you agree to terms that obligate you
 to collect a royalty for further conveying from those to whom you convey
 the Program, the only way you could satisfy both those terms and this
 License would be to refrain entirely from conveying the Program.
  13. Use with the GNU Affero General Public License.
  Notwithstanding any other provision of this License, you have
 permission to link or combine any covered work with a work licensed
 under version 3 of the GNU Affero General Public License into a single
 combined work, and to convey the resulting work.  The terms of this
 License will continue to apply to the part which is the covered work,
 but the special requirements of the GNU Affero General Public License,
 section 13, concerning interaction through a network will apply to the
 combination as such.
  14. Revised Versions of this License.
  The Free Software Foundation may publish revised and/or new versions of
 the GNU General Public License from time to time.  Such new versions will
 be similar in spirit to the present version, but may differ in detail to
 address new problems or concerns.
  Each version is given a distinguishing version number.  If the
 Program specifies that a certain numbered version of the GNU General
 Public License "or any later version" applies to it, you have the
 option of following the terms and conditions either of that numbered
 version or of any later version published by the Free Software
 Foundation.  If the Program does not specify a version number of the
 GNU General Public License, you may choose any version ever published
 by the Free Software Foundation.
  If the Program specifies that a proxy can decide which future
 versions of the GNU General Public License can be used, that proxy's
 public statement of acceptance of a version permanently authorizes you
 to choose that version for the Program.
  Later license versions may give you additional or different
 permissions.  However, no additional obligations are imposed on any
 author or copyright holder as a result of your choosing to follow a
 later version.
  15. Disclaimer of Warranty.
  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
 APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
 HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
 OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
 THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
 IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
 ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
  16. Limitation of Liability.
  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
 WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
 THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
 GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
 USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
 DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
 PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
 EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
 SUCH DAMAGES.
  17. Interpretation of Sections 15 and 16.
  If the disclaimer of warranty and limitation of liability provided
 above cannot be given local legal effect according to their terms,
 reviewing courts shall apply local law that most closely approximates
 an absolute waiver of all civil liability in connection with the
 Program, unless a warranty or assumption of liability accompanies a
 copy of the Program in return for a fee.
                     END OF TERMS AND CONDITIONS
            How to Apply These Terms to Your New Programs
  If you develop a new program, and you want it to be of the greatest
 possible use to the public, the best way to achieve this is to make it
 free software which everyone can redistribute and change under these terms.
  To do so, attach the following notices to the program.  It is safest
 to attach them to the start of each source file to most effectively
 state the exclusion of warranty; and each file should have at least
 the "copyright" line and a pointer to where the full notice is found.
    <one line to give the program's name and a brief idea of what it does.>
    Copyright (C) <year>  <name of author>
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 Also add information on how to contact you by electronic and paper mail.
  If the program does terminal interaction, make it output a short
 notice like this when it starts in an interactive mode:
    <program>  Copyright (C) <year>  <name of author>
    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
    This is free software, and you are welcome to redistribute it
    under certain conditions; type `show c' for details.
 The hypothetical commands `show w' and `show c' should show the appropriate
 parts of the General Public License.  Of course, your program's commands
 might be different; for a GUI interface, you would use an "about box".
  You should also get your employer (if you work as a programmer) or school,
 if any, to sign a "copyright disclaimer" for the program, if necessary.
 For more information on this, and how to apply and follow the GNU GPL, see
 <http://www.gnu.org/licenses/>.
  The GNU General Public License does not permit incorporating your program
 into proprietary programs.  If your program is a subroutine library, you
 may consider it more useful to permit linking proprietary applications with
 the library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.  But first, please read
 <http://www.gnu.org/philosophy/why-not-lgpl.html>.
@@ -1,7 +1,7 @@
 Q: Why does dnsmasq open UDP ports >1024 as well as port 53.
   Is this a security problem/trojan/backdoor?
-A: The high ports that dnsmasq opens is for replies from the upstream
+A: The high ports that dnsmasq opens are for replies from the upstream
   nameserver(s). Queries from dnsmasq to upstream nameservers are sent
   from these ports and replies received to them. The reason for doing this is
   that most firewall setups block incoming packets _to_ port 53, in order
@@ -9,13 +9,21 @@ A: The high ports that dnsmasq opens is for replies from the upstream
   from port 53 the replies would be _to_ port 53 and get blocked.
   This is not a security hole since dnsmasq will only accept replies to that
-   port: queries are  dropped. The replies must be to oustanding queries
+   port: queries are dropped. The replies must be to outstanding queries
   which dnsmasq has forwarded, otherwise they are dropped too.
   Addendum: dnsmasq now has the option "query-port" (-Q), which allows
   you to specify the UDP port to be used for this purpose.  If not
   specified, the operating system will select an available port number
   just as it did before.
   Second addendum: following the discovery of a security flaw in the
   DNS protocol, dnsmasq from version 2.43 has changed behavior. It
   now uses a new, randomly selected, port for each query. The old
   default behaviour (use one port allocated by the OS) is available by
   setting --query-port=0, and setting the query port to a positive
   value still works. You should think hard and know what you are
   doing before using either of these options.
 Q: Why doesn't dnsmasq support DNS queries over TCP? Don't the RFC's specify
   that?
@@ -39,10 +47,9 @@ A: They are negative entries: that's what the N flag means. Dnsmasq asked
 Q: Will dnsmasq compile/run on non-Linux systems?
-A: Yes, there is explicit support for *BSD and MacOS X. There are
+A: Yes, there is explicit support for *BSD and MacOS X and Solaris. 
-   start-up scripts for MacOS X Tiger and Panther in /contrib. Earlier
+   There are start-up scripts for MacOS X Tiger and Panther 
-   dnsmasq releases ran under Solaris, but that capability has
+   in /contrib. Dnsmasq will link with uclibc to provide small
   rotted. Dnsmasq will link with uclibc to provide small
   binaries suitable for use in embedded systems such as
   routers. (There's special code to support machines with flash
   filesystems and no battery-backed RTC.)
@@ -50,9 +57,9 @@ A: Yes, there is explicit support for *BSD and MacOS X. There are
   ports and building dnsmasq with "make MAKE=gmake" 
   For other systems, try altering the settings in config.h.
-Q: My companies' nameserver knows about some names which aren't in the
+Q: My company's nameserver knows about some names which aren't in the
   public DNS. Even though I put it first in /etc/resolv.conf, it
-   dosen't work: dnsmasq seems not to use the nameservers in the order
+   doesn't work: dnsmasq seems not to use the nameservers in the order
   given. What am I doing wrong?
 A: By default, dnsmasq treats all the nameservers it knows about as
@@ -105,7 +112,7 @@ A: Resolver code sometime does strange things when given names without
   hostname  will fix things. (ie "ping myhost" fails, but "ping
   myhost." works. The solution is to make sure that all your hosts
   have a domain set ("domain" in resolv.conf, or set a domain in 
-   your DHCP server, see below fr Windows XP and Mac OS X). 
+   your DHCP server, see below for Windows XP and Mac OS X). 
   Any domain  will do, but "localnet" is traditional. Now when you
   resolve "myhost" the resolver will attempt to look up 
   "myhost.localnet" so you need to have dnsmasq reply to that name. 
@@ -137,19 +144,19 @@ Q: Who are Verisign, what do they have to do with the bogus-nxdomain
   option in dnsmasq and why should I wory about it?
 A: [note: this was written in September 2003, things may well change.]
-   Versign run the .com and .net top-level-domains. They have just
+   Verisign run the .com and .net top-level-domains. They have just
   changed the configuration of their servers so that unknown .com and
   .net domains, instead of returning an error code NXDOMAIN, (no such
-   domain) return the address of a host at Versign which runs a web
+   domain) return the address of a host at Verisign which runs a web
   server showing a search page. Most right-thinking people regard
   this new behaviour as broken :-).  You can test to see if you are
-   suffering Versign brokeness by run a command like 
+   suffering Verisign brokenness by run a command like 
   host jlsdajkdalld.com
   If you get "jlsdajkdalld.com" does not exist, then all is fine, if
   host returns an IP address, then the DNS is broken. (Try a few
-   different unlikely domains, just in case you picked a wierd one
+   different unlikely domains, just in case you picked a weird one
   which really _is_ registered.)
   Assuming that your DNS is broken, and you want to fix it, simply
@@ -173,7 +180,7 @@ A: There are a couple of configuration gotchas which have been
   whilst the ISC one works.
   The first thing to check is the broadcast address set for the
-   ethernet interface. This is normally the adddress on the connected
+   ethernet interface. This is normally the address on the connected
   network with all ones in the host part. For instance if the 
   address of the ethernet interface is 192.168.55.7 and the netmask
   is 255.255.255.0 then the broadcast address should be
@@ -198,7 +205,7 @@ A: By default, none of the DHCP clients send the host-name when asking
   send with the "hostname" keyword in /etc/network/interfaces. (See
   "man interfaces" for details.) That doesn't work for dhclient, were
   you have to add something like "send host-name daisy" to
-   /etc/dhclient.conf [Update: the lastest dhcpcd packages _do_ send
+   /etc/dhclient.conf [Update: the latest dhcpcd packages _do_ send
   the hostname by default.
 Q: I'm network booting my machines, and trying to give them static
@@ -227,55 +234,72 @@ A: What is happening is this: The boot process sends a DHCP
 Q: What network types are supported by the DHCP server?
 A: Ethernet (and 802.11 wireless) are supported on all platforms. On
-   Linux Token Ring is also supported.
+   Linux all network types (including FireWire) are supported.
-Q: What is this strange "bind-interface" option?
+Q: What are these strange "bind-interfaces" and "bind-dynamic" options?
-A: The DNS spec says that the reply to a DNS query must come from the
+A: Dnsmasq from v2.63 can operate in one of three different "networking
-   same address it was sent to. The traditional way to write an UDP
+   modes". This is unfortunate as it requires users configuring dnsmasq
-   server to do this is to find all of the addresses belonging to the
+   to take into account some rather bizarre constraints and select the
-   machine (ie all the interfaces on the machine) and then create a
+   mode which best fits the requirements of a particular installation.
-   socket for each interface which is bound to the address of the
+   The origin of these are deficiencies in the Unix networking
-   interface. Then when a packet is sent to address A, it is received
+   model and APIs and each mode has different advantages and
-   on the socket bound to address A and when the reply is also sent
+   problems. Just to add to the confusion, not all modes are available on
-   via that socket, the source address is set to A by the kernel and
+   all platforms (due the to lack of supporting network APIs).To further
-   everything works. This is the how dnsmasq works when
+   add to the confusion, the rules for the DHCP subsystem on dnsmasq are
-   "bind-interfaces" is set, with the obvious extension that is misses
+   different to the rules for the DNS and TFTP subsystems.
   out creating sockets for some interfaces depending on the
   --interface, --address and --except-interface flags.  The
   disadvantage of this approach is that it breaks if interfaces don't
   exist or are not configured when the daemon starts and does the
   socket creation step. In a hotplug-aware world this is a real
   problem.
-   The alternative approach is to have only one socket, which is bound
+   The three modes are "wildcard", "bind-interfaces" and "bind-dynamic".
   to the correct port and the wildcard IP address (0.0.0.0). That
   socket will receive _all_ packets sent to port 53, no matter what
   destination address they have. This solves the problem of
   interfaces which are created or reconfigured after daemon
   start-up. To make this work is more complicated because of the
   "reply source address" problem. When a UDP packet is sent by a
   socket bound to 0.0.0.0 its source address will be set to the
   address of one of the machine's interfaces, but which one is not
   determined and can vary depending on the OS being run. To get round
   this it is neccessary to use a scary advanced API to determine the
   address to which a query was sent, and force that to be the source
   address in the reply. For IPv4 this stuff in non-portable and quite
   often not even available (It's different between FreeBSD 5.x and
   Linux, for instance, and FreeBSD 4.x, Linux 2.0.x and OpenBSD don't
   have it at all.) Hence "bind-interfaces" has to always be available
   as a fall back. For IPv6 the API is standard and universally
   available.
-   It could be argued that if the --interface or --address flags are
+   In "wildcard" mode, dnsmasq binds the wildcard IP address (0.0.0.0 or
-   used then binding interfaces is more appropriate, but using
+   ::). This allows it to receive all the packets sent to the server on
-   wildcard binding means that dnsmasq will quite happily start up
+   the relevant port. Access control (--interface, --except-interface,
-   after being told to use interfaces which don't exist, but which are
+   --listen-address, etc) is implemented by dnsmasq: it queries the
-   created later. Wildcard binding breaks the scenario when dnsmasq is
+   kernel to determine the interface on which a packet was received and
-   listening on one interface and another server (most probably BIND)
+   the address to which it was sent, and applies the configured
-   is listening on another. It's not possible for BIND to bind to an
+   rules. Wildcard mode is the default if neither of the other modes are
-   (address,port) pair when dnsmasq has bound (wildcard,port), hence
+   specified. 
-   the ability to explicitly turn off wildcard binding.
+
   In "bind-interfaces" mode, dnsmasq runs through all the network
   interfaces available when it starts, finds the set of IP addresses on
   those interfaces, filters that set using the access control
   configuration, and then binds the set of IP addresses. Only packets
   sent to the allowed addresses are delivered by the kernel to dnsmasq.
   In "bind-dynamic" mode, access control filtering is done both by
   binding individual IP addresses, as for bind-interfaces, and by
   inspecting individual packets on arrival as for wildcard mode. In
   addition, dnsmasq notices when new interfaces appear or new addresses
   appear on existing interfaces, and the resulting IP addresses are
   bound automatically without having to restart dnsmasq.
   The mode chosen has four different effects: co-existence with other
   servers, semantics of --interface access control, effect of new
   interfaces, and legality of --interface specifications for
   non-existent interfaces. We will deal with these in order.
   A dnsmasq instance running in wildcard mode precludes a machine from
   running a second instance of dnsmasq or any other DNS, TFTP or DHCP
   server. Attempts to do so will fail with an "address in use" error. 
   Dnsmasq running in --bind-interfaces or bind-dynamic mode allow other
   instances of dnsmasq or other servers, as long as no two servers are
   configured to listen on the same interface address. 
   The semantics of --interface varies subtly between wildcard or
   bind-dynamic mode and bind-interfaces mode. The situation where this
   matters is a request which arrives via one interface (A), but with a
   destination address of a second interface (B) and when dnsmasq is
   configured to listen only on B. In wildcard or bind-dynamic mode, such
   a request will be ignored, in bind-interfaces mode, it will be
   accepted.
   The creation of new network interfaces after dnsmasq starts is ignored
   by dnsmasq when in --bind-interfaces mode. In wildcard or bind-dynamic
   mode, such interfaces are handled normally.
   An --interface specification for a non-existent interface is a fatal
   error at start-up when in --bind-interfaces mode, by just generates a
   warning in wildcard or bind-dynamic mode.
 Q: Why doesn't Kerberos work/why can't I get sensible answers to
   queries for SRV records.
@@ -289,15 +313,25 @@ Q: Can I get email notification when a new version of dnsmasq is
   released?
 A: Yes, new releases of dnsmasq are always announced through
-   freshmeat.net, and they allow you to subcribe to email alerts when
+   freshmeat.net, and they allow you to subscribe to email alerts when
   new versions of particular projects are released. New releases are
   also announced in the dnsmasq-discuss mailing list, subscribe at 
   http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
 Q: What does the dhcp-authoritative option do? 
-A: See http://www.isc.org/index.pl?/sw/dhcp/authoritative.php - that's
+A: The DHCP spec says that when a DHCP server receives a renewal request
-   for the ISC daemon, but the same applies to dnsmasq.
+   from a client it has no knowledge of, it should just ignore it.
   This is because it's supported to have more than one DHCP server
   on a network, and another DHCP server may be dealing with the client.
   This has the unfortunate effect that when _no_ DHCP replies to 
   the client, it takes some time for the client to time-out and start 
   to get a new lease. Setting this option makes dnsmasq violate the
   standard to the extent that it will send a NAK reply to the client, 
   causing it to immediately start to get a new lease. This improves 
   behaviour when machines move networks, and in the case that the DHCP
   lease database is lost. As long as there are not more tha one DHCP
   server on the network, it's safe to enable the option.
 Q: Why does my Gentoo box pause for a minute before getting a new
   lease?
@@ -311,7 +345,7 @@ A: Because when a Gentoo box shuts down, it releases its lease with
 Q: My laptop has two network interfaces, a wired one and a wireless
   one. I never use both interfaces at the same time, and I'd like the
-   same IP and configuration to be used irrespcetive of which
+   same IP and configuration to be used irrespective of which
   interface is in use. How can I do that?
 A: By default, the identity of a machine is determined by using the
@@ -326,6 +360,63 @@ A: By default, the identity of a machine is determined by using the
   dhcpcd uses the "-I" flag. Windows uses a registry setting,
   see http://www.jsiinc.com/SUBF/TIP2800/rh2845.htm
 Addendum:
   From version 2.46, dnsmasq has a solution to this which doesn't
   involve setting client-IDs. It's possible to put more than one MAC
   address in a --dhcp-host configuration. This tells dnsmasq that it
   should use the specified IP for any of the specified MAC addresses,
   and furthermore it gives dnsmasq permission to summarily abandon a
   lease to one of the MAC addresses if another one comes along. Note
   that this will work fine only as longer as only one interface is
   up at any time. There is no way for dnsmasq to enforce this
   constraint: if you configure multiple MAC addresses and violate 
   this rule, bad things will happen.
 Addendum-II: The link above is dead, the former contents of the link are:
 ------------------------------------------------------------------------------
 How can I keep the same DHCP client reservation, if the MAC address changes?
 When you reserve an IP address for a DHCP client, you provide the
 MAC address of the client's NIC.
 It is possible to use a custom identifier, which is sent as 
 option 61 in the client's DHCP Discover and Request packet.
 The DhcpClientIdentifier is a REG_DWORD value that is located at:
 Windows NT 4.0 SP2+
 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<Adapter Name>'X'\Parameters\Tcpip
 where <Adapter Name> is the NIC driver name and 'X' is the number of the NIC.
 Windows 2000
 HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TcpIp\Parameters\Interfaces\<NIC GUID>
 where <NIC GUID> is the GUID of the NIC.
 The valid range of data is 0x0 - 0xFFFFFFFF. The custom identifier is send as 4 bytes, 
 8 hexadecimal character, in groups of 2 hexadecimal characters, with the groups being 
 sent in reverse order. If the custom identifier is less than 8 hexadeciaml characters, 
 it is zero padded at the end. Examples:
 Custom Client                 Client Reservation
 Identifier                    on DHCP Server
 12345678                      78563412
 123456                        56341200
 1234                          34120000
 1234567                       67452301
 12345                         45230100
 123                           23010000
 A18F42                        428FA100
 CF432                         32F40C00
 C32D1BE                       BED1320C
 -------------------------------------------------------------------------------------------------------
 Q: Can dnsmasq do DHCP on IP-alias interfaces?
 A: Yes, from version-2.21. The support is only available running under
@@ -336,7 +427,7 @@ A: Yes, from version-2.21. The support is only available running under
   If a physical interface has more than one IP address or aliases
   with extra IP addresses, then any dhcp-ranges corresponding to
   these addresses can be used for address allocation. So if an
-   interface has addresses 192.168.1.0/24 and 192.68.2.0/24 and there
+   interface has addresses 192.168.1.0/24 and 192.168.2.0/24 and there
   are DHCP ranges 192.168.1.100-192.168.1.200 and
   192.168.2.100-192.168.2.200 then both ranges would be used for host
   connected to the physical interface. A more typical use might be to
@@ -363,7 +454,7 @@ A: Probably the nameserver is an authoritative nameserver for a
 Q: Does the dnsmasq DHCP server probe addresses before allocating
   them, as recommended in RFC2131?
-A: Yes, dynmaically allocated IP addresses are checked by sending an
+A: Yes, dynamically allocated IP addresses are checked by sending an
   ICMP echo request (ping). If a reply is received, then dnsmasq
   assumes that the address is in use, and attempts to allocate an
   different address. The wait for a reply is between two and three
@@ -380,19 +471,88 @@ A: This a variant on the iptables problem. Explicit details on how to
   http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2005q3/000431.html
-Q: Dnsmasq logs "running as root because setting capabilities failed"
+Q: I'm using dnsmasq on a machine with the shorewall firewall, and
-   when it starts up. Why did that happen and what can do to fix it?
+   DHCP doesn't work. What's the problem?
 A: This a variant on the iptables problem. Explicit details on how to
   proceed can be found at 
   http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2007q4/001764.html
 Q: Dnsmasq fails to start up with a message about capabilities.
   Why did that happen and what can do to fix it?
 A: Change your kernel configuration: either deselect CONFIG_SECURITY
-   _or_ select CONFIG_SECURITY_CAPABILITIES.
+   _or_ select CONFIG_SECURITY_CAPABILITIES. Alternatively, you can 
   remove the need to set capabilities by running dnsmasq as root.
-Q: Where can I get .rpms Suitable for Suse?
+Q: Where can I get .rpms Suitable for openSUSE/SLES?
-A: Dnsmasq is in Suse itself, and the latest releases are also
+A: Dnsmasq is in openSUSE itself, and the latest releases are also
-   available at ftp://ftp.suse.com/pub/people/ug/
+   available at http://download.opensuse.org/repositories/network/
 Q: Can I run dnsmasq in a Linux vserver?
 A: Yes, as a DNS server, dnsmasq will just work in a vserver.
   To use dnsmasq's DHCP function you need to give the vserver
   extra system capabilities. Please note that doing so will lesser 
   the overall security of your system. The capabilities 
   required are NET_ADMIN and NET_RAW. NET_ADMIN is essential, NET_RAW
   is required to do an ICMP "ping" check on newly allocated
   addresses. If you don't need this check, you can disable it with
   --no-ping and omit the NET_RAW capability. 
   Adding the capabilities is done by adding them, one per line, to
   either /etc/vservers/<vservername>/ccapabilities for a 2.4 kernel or
   /etc/vservers/<vservername>/bcapabilities for a 2.6 kernel (please
   refer to the vserver documentation for more information).
 Q: What's the problem with syslog and dnsmasq?
 A: In almost all cases: none. If you have the normal arrangement with
   local daemons logging to a local syslog, which then writes to disk,
   then there's never a problem. If you use network logging, then
   there's a potential problem with deadlock: the syslog daemon will
   do DNS lookups so that it can log the source of log messages,
   these lookups will (depending on exact configuration) go through
   dnsmasq, which also sends log messages. With bad timing, you can 
   arrive at a situation where syslog is waiting for dnsmasq, and
   dnsmasq is waiting for syslog; they will both wait forever. This
   problem is fixed from dnsmasq-2.39, which introduces asynchronous
   logging: dnsmasq no longer waits for syslog and the deadlock is
   broken. There is a remaining problem in 2.39, where "log-queries"
   is in use. In this case most DNS queries generate two log lines, if
   these go to a syslog which is doing a DNS lookup for each log line,
   then those queries will in turn generate two more log lines, and a 
   chain reaction runaway will occur. To avoid this, use syslog-ng
   and turn on syslog-ng's dns-cache function.
 Q: DHCP doesn't work with windows Vista, but everything else is fine.
 A: The DHCP client on windows Vista (and possibly later versions)
   demands that the DHCP server send replies as broadcasts. Most other
   clients don't do this. The broadcasts are send to
   255.255.255.255. A badly configured firewall which blocks such
   packets will show exactly these symptoms (Vista fails, others
   work).
 Q: DHCP doesn't work with windows 7 but everything else is fine.
 A: There seems to be a problem if Windows 7 doesn't get a value for
   DHCP option 252 in DHCP packets it gets from the server. The
   symptoms have been variously reported as continual DHCPINFORM
   requests in an attempt to get an option-252, or even ignoring DHCP
   offers completely (and failing to get an IP address) if there is no
   option-252 supplied. DHCP option 252 is for WPAD, WWW Proxy 
   Auto Detection and if you don't want or need to use that, then 
   simplest fix seems to be to supply an empty option with:
   dhcp-option=252,"\n"
@@ -1,44 +1,177 @@
-PREFIX?=/usr/local
+# dnsmasq is Copyright (c) 2000-2021 Simon Kelley
-BINDIR = ${PREFIX}/sbin
+#
-MANDIR = ${PREFIX}/share/man
+#  This program is free software; you can redistribute it and/or modify
-LOCALEDIR = ${PREFIX}/share/locale
+#  it under the terms of the GNU General Public License as published by
 #  the Free Software Foundation; version 2 dated June, 1991, or
 #  (at your option) version 3 dated 29 June, 2007.
 #
 #  This program is distributed in the hope that it will be useful,
 #  but WITHOUT ANY WARRANTY; without even the implied warranty of
 #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 #  GNU General Public License for more details.
 #    
 #  You should have received a copy of the GNU General Public License
 #  along with this program.  If not, see <http://www.gnu.org/licenses/>.
 # NOTE: Building the i18n targets requires GNU-make 
 # Variables you may well want to override.
 PREFIX        = /usr/local
 BINDIR        = $(PREFIX)/sbin
 MANDIR        = $(PREFIX)/share/man
 LOCALEDIR     = $(PREFIX)/share/locale
 BUILDDIR      = $(SRC)
 DESTDIR       = 
 CFLAGS        = -Wall -W -O2
 LDFLAGS       = 
 COPTS         = 
 RPM_OPT_FLAGS = 
 LIBS          = 
 #################################################################
 # Variables you might want to override.
 PKG_CONFIG = pkg-config
 INSTALL    = install
 MSGMERGE   = msgmerge
 MSGFMT     = msgfmt
 XGETTEXT   = xgettext
 SRC = src
-PO = po
+PO  = po
 MAN = man
-CFLAGS?= -O2
+#################################################################
-all :   dnsmasq
+# pmake way. (NB no spaces to keep gmake 3.82 happy)
 top!=pwd
 # GNU make way.
 top?=$(CURDIR)
-dnsmasq :
+dbus_cflags =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DBUS $(PKG_CONFIG) --cflags dbus-1` 
-	$(MAKE) I18N=-DNO_GETTEXT -f ../bld/Makefile -C $(SRC) dnsmasq 
+dbus_libs =     `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DBUS $(PKG_CONFIG) --libs dbus-1` 
 ubus_libs =     `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_UBUS "" --copy '-lubox -lubus'`
 idn_cflags =    `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_IDN $(PKG_CONFIG) --cflags libidn` 
 idn_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_IDN $(PKG_CONFIG) --libs libidn` 
 idn2_cflags =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LIBIDN2 $(PKG_CONFIG) --cflags libidn2`
 idn2_libs =     `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LIBIDN2 $(PKG_CONFIG) --libs libidn2`
 ct_cflags =     `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_CONNTRACK $(PKG_CONFIG) --cflags libnetfilter_conntrack`
 ct_libs =       `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_CONNTRACK $(PKG_CONFIG) --libs libnetfilter_conntrack`
 lua_cflags =    `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LUASCRIPT $(PKG_CONFIG) --cflags lua5.2` 
 lua_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LUASCRIPT $(PKG_CONFIG) --libs lua5.2` 
 nettle_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC     $(PKG_CONFIG) --cflags 'nettle hogweed' \
                                                        HAVE_CRYPTOHASH $(PKG_CONFIG) --cflags nettle \
                                                        HAVE_NETTLEHASH $(PKG_CONFIG) --cflags nettle`
 nettle_libs =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC     $(PKG_CONFIG) --libs 'nettle hogweed' \
                                                        HAVE_CRYPTOHASH $(PKG_CONFIG) --libs nettle \
                                                        HAVE_NETTLEHASH $(PKG_CONFIG) --libs nettle`
 gmp_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC NO_GMP --copy -lgmp`
 sunos_libs =    `if uname | grep SunOS >/dev/null 2>&1; then echo -lsocket -lnsl -lposix4; fi`
 version =     -DVERSION='\"`$(top)/bld/get-version $(top)`\"'
-clean :
+sum?=$(shell $(CC) -DDNSMASQ_COMPILE_OPTS $(COPTS) -E $(top)/$(SRC)/dnsmasq.h | ( md5sum 2>/dev/null || md5 ) | cut -f 1 -d ' ')
-	rm -f *~ $(SRC)/*.mo contrib/*/*~ */*~ $(SRC)/*.pot 
+sum!=$(CC) -DDNSMASQ_COMPILE_OPTS $(COPTS) -E $(top)/$(SRC)/dnsmasq.h | ( md5sum 2>/dev/null || md5 ) | cut -f 1 -d ' '
-	rm -f $(SRC)/*.o $(SRC)/dnsmasq.a $(SRC)/dnsmasq core */core
+copts_conf = .copts_$(sum)
 objs = cache.o rfc1035.o util.o option.o forward.o network.o \
       dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o \
       helper.o tftp.o log.o conntrack.o dhcp6.o rfc3315.o \
       dhcp-common.o outpacket.o radv.o slaac.o auth.o ipset.o pattern.o \
       domain.o dnssec.o blockdata.o tables.o loop.o inotify.o \
       poll.o rrfilter.o edns0.o arp.o crypto.o dump.o ubus.o \
       metrics.o hash-questions.o domain-match.o
 hdrs = dnsmasq.h config.h dhcp-protocol.h dhcp6-protocol.h \
       dns-protocol.h radv-protocol.h ip6addr.h metrics.h
 all : $(BUILDDIR)
 	@cd $(BUILDDIR) && $(MAKE) \
 top="$(top)" \
 build_cflags="$(version) $(dbus_cflags) $(idn2_cflags) $(idn_cflags) $(ct_cflags) $(lua_cflags) $(nettle_cflags)" \
 build_libs="$(dbus_libs) $(idn2_libs) $(idn_libs) $(ct_libs) $(lua_libs) $(sunos_libs) $(nettle_libs) $(gmp_libs) $(ubus_libs)" \
 -f $(top)/Makefile dnsmasq 
 mostly_clean :
 	rm -f $(BUILDDIR)/*.mo $(BUILDDIR)/*.pot 
 	rm -f $(BUILDDIR)/.copts_* $(BUILDDIR)/*.o $(BUILDDIR)/dnsmasq.a $(BUILDDIR)/dnsmasq
 clean : mostly_clean
 	rm -f $(BUILDDIR)/dnsmasq_baseline
 	rm -f core */core
 	rm -f *~ contrib/*/*~ */*~
 install : all install-common
 install-common :
-	install -d $(DESTDIR)$(BINDIR) -d $(DESTDIR)$(MANDIR)/man8
+	$(INSTALL) -d $(DESTDIR)$(BINDIR)
-	install -m 644 $(MAN)/dnsmasq.8 $(DESTDIR)$(MANDIR)/man8 
+	$(INSTALL) -d $(DESTDIR)$(MANDIR)/man8
-	install -m 755 $(SRC)/dnsmasq $(DESTDIR)$(BINDIR)
+	$(INSTALL) -m 644 $(MAN)/dnsmasq.8 $(DESTDIR)$(MANDIR)/man8 
 	$(INSTALL) -m 755 $(BUILDDIR)/dnsmasq $(DESTDIR)$(BINDIR)
-all-i18n :
+all-i18n : $(BUILDDIR)
-	$(MAKE) I18N=-DLOCALEDIR='\"$(LOCALEDIR)\"' -f ../bld/Makefile -C $(SRC) dnsmasq
+	@cd $(BUILDDIR) && $(MAKE) \
-	cd $(PO); for f in *.po; do \
+ top="$(top)" \
-		$(MAKE) -f ../bld/Makefile -C ../$(SRC) $${f%.po}.mo; \
+ i18n=-DLOCALEDIR=\'\"$(LOCALEDIR)\"\' \
 build_cflags="$(version) $(dbus_cflags) $(idn2_cflags) $(idn_cflags) $(ct_cflags) $(lua_cflags) $(nettle_cflags)" \
 build_libs="$(dbus_libs) $(idn2_libs) $(idn_libs) $(ct_libs) $(lua_libs) $(sunos_libs) $(nettle_libs) $(gmp_libs) $(ubus_libs)"  \
 -f $(top)/Makefile dnsmasq
 	for f in `cd $(PO); echo *.po`; do \
 		cd $(top) && cd $(BUILDDIR) && $(MAKE) top="$(top)" -f $(top)/Makefile $${f%.po}.mo; \
 	done
 install-i18n : all-i18n install-common
-	cd $(SRC); ../bld/install-mo $(DESTDIR)$(LOCALEDIR)
+	cd $(BUILDDIR); $(top)/bld/install-mo $(DESTDIR)$(LOCALEDIR) $(INSTALL)
-	cd $(MAN); ../bld/install-man $(DESTDIR)$(MANDIR)
+	cd $(MAN); ../bld/install-man $(DESTDIR)$(MANDIR) $(INSTALL)
-merge :
+merge : 
-	$(MAKE) I18N=-DLOCALEDIR='\"$(LOCALEDIR)\"' -f ../bld/Makefile -C $(SRC) dnsmasq.pot
+	@cd $(BUILDDIR) && $(MAKE) top="$(top)" -f $(top)/Makefile dnsmasq.pot
-	cd $(PO); for f in *.po; do \
+	for f in `cd $(PO); echo *.po`; do \
-		msgmerge -U $$f ../$(SRC)/dnsmasq.pot; \
+		echo -n msgmerge $(PO)/$$f && $(MSGMERGE) --no-wrap -U $(PO)/$$f $(BUILDDIR)/dnsmasq.pot; \
 	done
 # Canonicalise .po file.
 %.po : 
 	@cd $(BUILDDIR) && $(MAKE) -f $(top)/Makefile dnsmasq.pot
 	mv $(PO)/$*.po $(PO)/$*.po.orig && $(MSGMERGE) --no-wrap $(PO)/$*.po.orig $(BUILDDIR)/dnsmasq.pot >$(PO)/$*.po; 
 $(BUILDDIR):
 	mkdir -p $(BUILDDIR)
 # rules below are helpers for size tracking
 baseline : mostly_clean all
 	@cd $(BUILDDIR) && \
 	   mv dnsmasq dnsmasq_baseline
 bloatcheck : $(BUILDDIR)/dnsmasq_baseline mostly_clean all
 	@cd $(BUILDDIR) && \
           $(top)/bld/bloat-o-meter dnsmasq_baseline dnsmasq; \
           size dnsmasq_baseline dnsmasq
 # rules below are targets in recursive makes with cwd=$(BUILDDIR)
 $(copts_conf): $(hdrs)
 	@rm -f *.o .copts_*
 	@touch $@
 $(objs:.o=.c) $(hdrs):
 	ln -s $(top)/$(SRC)/$@ .
 $(objs): $(copts_conf) $(hdrs)
 .c.o:
 	$(CC) $(CFLAGS) $(COPTS) $(i18n) $(build_cflags) $(RPM_OPT_FLAGS) -c $<	
 dnsmasq : $(objs)
 	$(CC) $(LDFLAGS) -o $@ $(objs) $(build_libs) $(LIBS) 
 dnsmasq.pot : $(objs:.o=.c) $(hdrs)
 	$(XGETTEXT) -d dnsmasq --foreign-user --omit-header --keyword=_ -o $@ -i $(objs:.o=.c)
 %.mo : $(top)/$(PO)/%.po dnsmasq.pot
 	$(MSGMERGE) -o - $(top)/$(PO)/$*.po dnsmasq.pot | $(MSGFMT) -o $*.mo -
 .PHONY : all clean mostly_clean install install-common all-i18n install-i18n merge baseline bloatcheck
@@ -1,68 +0,0 @@
 	Upgrading to dnsmasq V2
        -----------------------
 Version 1.x of dnsmasq includes a facility for reading the dhcp.leases
 file written by ISC dhcpd. This allows the names of machines which
 have addresses allocated by DHCP to be included in the DNS.
 Version 2.x of dnsmasq replaces the ISC dhcpd integration with a DHCP 
 server integrated into dnsmasq. Versions 2.0-2.5 removed the ISC 
 integration completely, but in version 2.6 it was re-enabled for 
 backwards compatibility purposes. The change to an integrated DHCP 
 server has the following advantages:
 * Small. ISC dhcpd is a large and comprehensive DHCP solution. The
  dnsmasq DHCP server adds about 15k to DNS-only dnsmasq and provides
  all the facilities likely to be needed in the sort of networks
  which are targeted by dnsmasq.
 * Easy to configure. All configuration is in one file and there are
  sensible defaults for common settings. Many applications will need
  just one extra line in /etc/dnsmasq.conf which tells it the range of
  addresses to allocate to DHCP.
 * Support for static leases. When static leases are used with ISC DHCP
  they don't appear in the dhcp.leases file (since that file is used
  for storage of dynamic leases which aren't pre-configured.) Hence
  static leases cannot be used with dnsmasq unless each machine with a
  static lease is also inserted into /etc/hosts. This is not required
  with the dnsmasq DHCP server.
       DHCP configuration
       ------------------
 To convert an installation which is currently using ISC dhcpd, remove
 the ISC DHCP daemon. Unless you want dnsmasq to use the same file
 to store its leases it is necessary to remove the configuration line in
 /etc/dnsmasq.conf which specifies the dhcp.leases file.
 To enable DHCP, simply add a line like this to /etc/dnsmasq.conf
 dhcp-range=192.168.0.100,192.168.0.200,12h
 which tells dnsmasq to us the addresses 192.168.0.100 to 192.168.0.200
 for dynamic IP addresses, and to issue twelve hour leases.
 Each host will have its default route and DNS server set to be the
 address of the host running dnsmasq, and its netmask and broadcast 
 address set correctly, so nothing else at all is required for a
 minimal system. Hosts which include a hostname in their DHCP request 
 will have that name and their allocated address inserted into the DNS,
 in the same way as before.
 Having started dnsmasq, tell any hosts on the network to renew their
 DHCP lease, so that dnsmasq's  DHCP server becomes aware of them. For
 Linux, this is best done by killing-and-restarting the DHCP client
 daemon or taking the network interface down and then back up. For 
 Windows 9x/Me, use the graphical tool "winipcfg". For Windows
 NT/2000/XP, use the command-line "ipconfig /renew"
 For more complex DHCP configuration, refer to the doc/setup.html, the
 dnsmasq manpage and the annotated example configuration file. Also
 note that for some ISC dhcpd to dnsmasq DHCP upgrades there may be
 firewall issues: see the FAQ for details of this.
@@ -0,0 +1 @@
 $Format:%d$
@@ -0,0 +1,26 @@
 LOCAL_PATH := external/dnsmasq/src
 #########################
 include $(CLEAR_VARS)
 LOCAL_SRC_FILES :=  bpf.c cache.c dbus.c dhcp.c dnsmasq.c \
                    forward.c helper.c lease.c log.c \
                    netlink.c network.c option.c rfc1035.c \
 		    rfc2131.c tftp.c util.c conntrack.c \
 		    dhcp6.c rfc3315.c dhcp-common.c outpacket.c \
 		    radv.c slaac.c auth.c ipset.c domain.c \
 	            dnssec.c dnssec-openssl.c blockdata.c tables.c \
 		    loop.c inotify.c poll.c rrfilter.c edns0.c arp.c \
 		    crypto.c dump.c ubus.c metrics.c hash-questions.c \
                    domain-match.c
 LOCAL_MODULE := dnsmasq
 LOCAL_C_INCLUDES := external/dnsmasq/src
 LOCAL_CFLAGS := -O2 -g -W -Wall -D__ANDROID__ -DNO_IPV6 -DNO_TFTP -DNO_SCRIPT
 LOCAL_SYSTEM_SHARED_LIBRARIES := libc libcutils
 LOCAL_LDLIBS := -L$(SYSROOT)/usr/lib -llog
 include $(BUILD_EXECUTABLE)
@@ -1,18 +0,0 @@
 CFLAGS ?= -O2
 PKG_CONFIG ?= pkg-config
 OBJS = cache.o rfc1035.o util.o option.o forward.o isc.o network.o \
       dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o helper.o
 .c.o:
 	$(CC) $(CFLAGS) $(COPTS) $(I18N) `echo $(COPTS) | ../bld/pkg-wrapper $(PKG_CONFIG) --cflags dbus-1` $(RPM_OPT_FLAGS) -Wall -W -c $<
 dnsmasq : $(OBJS)
 	$(CC) $(LDFLAGS) -o $@  $(OBJS) `echo $(COPTS) | ../bld/pkg-wrapper $(PKG_CONFIG) --libs dbus-1` $(LIBS) 
 dnsmasq.pot : $(OBJS:.o=.c) dnsmasq.h config.h
 	xgettext -d dnsmasq --foreign-user --keyword=_ -o dnsmasq.pot -i $(OBJS:.o=.c)
 %.mo : ../po/%.po dnsmasq.pot
 	msgmerge -o - ../po/$*.po dnsmasq.pot | msgfmt -o $*.mo -
@@ -0,0 +1,130 @@
 #!/usr/bin/env python
 #
 # Copyright 2004 Matt Mackall <mpm@selenic.com>
 #
 # Inspired by perl Bloat-O-Meter (c) 1997 by Andi Kleen
 #
 # This software may be used and distributed according to the terms
 # of the GNU General Public License, incorporated herein by reference.
 import sys, os#, re
 def usage():
    sys.stderr.write("usage: %s [-t] file1 file2\n" % sys.argv[0])
    sys.exit(-1)
 f1, f2 = (None, None)
 flag_timing, dashes = (False, False)
 for f in sys.argv[1:]:
    if f.startswith("-"):
        if f == "--": # sym_args
            dashes = True
            break
        if f == "-t": # timings
            flag_timing = True
    else:
        if not os.path.exists(f):
            sys.stderr.write("Error: file '%s' does not exist\n" % f)
            usage()
        if f1 is None:
            f1 = f
        elif f2 is None:
            f2 = f
 if flag_timing:
    import time
 if f1 is None or f2 is None:
    usage()
 sym_args = " ".join(sys.argv[3 + flag_timing + dashes:])
 def getsizes(file):
    sym, alias, lut = {}, {}, {}
    for l in os.popen("readelf -W -s %s %s" % (sym_args, file)).readlines():
        l = l.strip()
        if not (len(l) and l[0].isdigit() and len(l.split()) == 8):
            continue
        num, value, size, typ, bind, vis, ndx, name = l.split()
        if ndx == "UND": continue # skip undefined
        if typ in ["SECTION", "FILES"]: continue # skip sections and files
        if "." in name: name = "static." + name.split(".")[0]
        value = int(value, 16)
        size = int(size, 16) if size.startswith('0x') else int(size)
        if vis != "DEFAULT" and bind != "GLOBAL": # see if it is an alias
            alias[(value, size)] = {"name" : name}
        else:
            sym[name] = {"addr" : value, "size":  size}
            lut[(value, size)] = 0
    for addr, sz in iter(alias.keys()):
        # If the non-GLOBAL sym has an implementation elsewhere then
        # it's an alias, disregard it.
        if not (addr, sz) in lut:
            # If this non-GLOBAL sym does not have an implementation at
            # another address, then treat it as a normal symbol.
            sym[alias[(addr, sz)]["name"]] = {"addr" : addr, "size": sz}
    for l in os.popen("readelf -W -S " + file).readlines():
        x = l.split()
        if len(x)<6: continue
        # Should take these into account too!
        #if x[1] not in [".text", ".rodata", ".symtab", ".strtab"]: continue
        if x[1] not in [".rodata"]: continue
        sym[x[1]] = {"addr" : int(x[3], 16), "size" : int(x[5], 16)}
    return sym
 if flag_timing:
    start_t1 = int(time.time() * 1e9)
 old = getsizes(f1)
 if flag_timing:
    end_t1 = int(time.time() * 1e9)
    start_t2 = int(time.time() * 1e9)
 new = getsizes(f2)
 if flag_timing:
    end_t2 = int(time.time() * 1e9)
    start_t3 = int(time.time() * 1e9)
 grow, shrink, add, remove, up, down = 0, 0, 0, 0, 0, 0
 delta, common = [], {}
 for name in iter(old.keys()):
    if name in new:
        common[name] = 1
 for name in old:
    if name not in common:
        remove += 1
        sz = old[name]["size"]
        down += sz
        delta.append((-sz, name))
 for name in new:
    if name not in common:
        add += 1
        sz = new[name]["size"]
        up += sz
        delta.append((sz, name))
 for name in common:
        d = new[name].get("size", 0) - old[name].get("size", 0)
        if d>0: grow, up = grow+1, up+d
        elif d<0: shrink, down = shrink+1, down-d
        else:
            continue
        delta.append((d, name))
 delta.sort()
 delta.reverse()
 if flag_timing:
    end_t3 = int(time.time() * 1e9)
 print("%-48s %7s %7s %+7s" % ("function", "old", "new", "delta"))
 for d, n in delta:
    if d:
        old_sz = old.get(n, {}).get("size", "-")
        new_sz = new.get(n, {}).get("size", "-")
        print("%-48s %7s %7s %+7d" % (n, old_sz, new_sz, d))
 print("-"*78)
 total="(add/remove: %s/%s grow/shrink: %s/%s up/down: %s/%s)%%sTotal: %s bytes"\
    % (add, remove, grow, shrink, up, -down, up-down)
 print(total % (" "*(80-len(total))))
 if flag_timing:
    print("\n%d/%d; %d Parse origin/new; processing nsecs" %
        (end_t1-start_t1, end_t2-start_t2, end_t3-start_t3))
    print("total nsecs: %d" % (end_t3-start_t1))
@@ -0,0 +1,41 @@
 #!/bin/sh
 # Determine the version string to build into a binary.
 # When building in the git repository, we can use the output 
 # of "git describe" which gives an unequivocal answer.
 #
 # Failing that, we use the contents of the VERSION file
 # which has a set of references substituted into it by git.
 # If we can find one which matches $v[0-9].* then we assume it's
 # a version-number tag, else we just use the whole string.
 # If there is more than one v[0-9].* tag, sort them and use the
 # first. The insane arguments to the sort command are to ensure
 # that, eg v2.64 comes before v2.63, but v2.63 comes before v2.63rc1
 # and v2.63rc1 comes before v2.63test1
 # Change directory to the toplevel source directory.
 if test -z "$1" || ! test -d "$1" || ! cd "$1"; then
    echo "$0: First argument $1 must be toplevel dir." >&2
    exit 1
 fi
 if which git >/dev/null 2>&1 && \
    ([ -d .git ] || grep '^gitdir:' .git >/dev/null 2>&1) && \
    git describe >/dev/null 2>&1; then 
    git describe | sed 's/^v//'
 elif grep '\$Format:%d\$' $1/VERSION >/dev/null 2>&1; then
    # unsubstituted VERSION, but no git available.
    echo UNKNOWN
 else
     vers=`cat $1/VERSION | sed 's/[(), ]/,/ g' | tr ',' '\n' | grep ^v[0-9]`
     if [ $? -eq 0 ]; then
         echo "${vers}" | sort -k1.2,1.5Vr -k1.6,1.6 -k1.8,1.9Vr -k1.10,1.11Vr | head -n 1 | sed 's/^v//'
     else
         cat $1/VERSION
     fi
 fi
 exit 0
@@ -2,8 +2,8 @@
 for f in *; do
  if [ -d $f ]; then
-     install -d $1/$f/man8 
+     $2 -m 755 -d $1/$f/man8 
-     install -m 644 $f/dnsmasq.8 $1/$f/man8
+     $2 -m 644 $f/dnsmasq.8 $1/$f/man8
-     echo installing $1/$f/man8/dnsmasq.8
+     echo installing $f/man8/dnsmasq.8
  fi
 done
@@ -1,9 +1,9 @@
 #!/bin/sh
 for f in *.mo; do
-  install -d $1/${f%.mo}/LC_MESSAGES
+  $2 -m 755 -d $1/${f%.mo}/LC_MESSAGES
-  install -m 644 $f $1/${f%.mo}/LC_MESSAGES/dnsmasq.mo
+  $2 -m 644 $f $1/${f%.mo}/LC_MESSAGES/dnsmasq.mo
-  echo installing $1/${f%.mo}/LC_MESSAGES/dnsmasq.mo
+  echo installing ${f%.mo}/LC_MESSAGES/dnsmasq.mo
 done
@@ -1,7 +1,45 @@
 #!/bin/sh
-if grep -q "^\#.*define.*HAVE_DBUS" config.h || grep -q HAVE_DBUS ; then
+in=`cat`
-  exec $*
+
 search()
 {
    grep "^\#[[:space:]]*define[[:space:]]*$1" config.h >/dev/null 2>&1 || \
    echo $in | grep $1 >/dev/null 2>&1
 }
 while [ "$#" -gt 0 ]; do
    search=$1
    pkg=$2
    op=$3
    lib=$4
    shift 4
 if search "$search"; then
 # Nasty, nasty, in --copy, arg 2 (if non-empty) is another config to search for, used with NO_GMP
    if [ $op = "--copy" ]; then
 	if [ -z "$pkg" ]; then
 	    pkg="$lib"
 	elif search "$pkg"; then
 	    pkg=""
 	else 
 	    pkg="$lib"
 	fi
    elif search "${search}_STATIC"; then
 	pkg=`$pkg  --static $op $lib`
    else
 	pkg=`$pkg $op $lib`
    fi
    if search "${search}_STATIC"; then
 	if [ $op = "--libs" ] || [ $op = "--copy" ]; then
 	    echo "-Wl,-Bstatic $pkg -Wl,-Bdynamic"
 	else
 	    echo "$pkg" 
 	fi
    else
 	echo "$pkg"
    fi
 fi
-
+done
@@ -0,0 +1,36 @@
 Dnsmasq from version 2.52 has a couple of rather application-specific
 features designed to allow for implementation of the DHCP part of CPE
 WAN management protocol.
 http://www.broadband-forum.org/technical/download/TR-069_Amendment-2.pdf
 http://en.wikipedia.org/wiki/TR-069
 The relevant sections are F.2.1 "Gateway Requirements" and F.2.5 "DHCP
 Vendor Options".
 First, dnsmasq checks for DHCP requests which contain an option-125
 vendor-class option which in turn holds a vendor section for IANA
 enterprise number 3561 which contains sub-options codes 1 and 2. If
 this is present  then the network-tag "cpewan-id" is set. 
 This allows dnsmasq to be configured to reply with the correct 
 GatewayManufacturerOUI, GatewaySerialNumber and GatewayProductClass like this:
 dhcp-option=cpewan-id,vi-encap:3561,4,"<GatewayManufacturerOUI>"
 dhcp-option=cpewan-id,vi-encap:3561,5,"<SerialNumber>"
 dhcp-option=cpewan-id,vi-encap:3561,6,"<ProductClass>"
 Second, the received sub-options 1, 2, and 3 are passed to the DHCP
 lease-change script as the environment variables DNSMASQ_CPEWAN_OUI,
 DNSMASQ_CPEWAN_SERIAL, and DNSMASQ_CPEWAN_CLASS respectively. This allows
 the script to be used to maintain a ManageableDevice table as
 specified in F.2.1. Note that this data is not retained in dnsmasq's
 internal DHCP lease database, so it is not available on every call to 
 the script (this is the same as some other data such as vendor and
 user classes). It will however be available for at least the "add"
 call, and should be stored then against the IP address as primary 
 key for future use.
 This feature was added to dnsmasq under sponsorship from Ericsson.
@@ -0,0 +1,38 @@
 This is a launchd item for Mac OS X and Mac OS X Server.
 For more information about launchd, the
 "System wide and per-user daemon/agent manager", see the launchd
 man page, or the wikipedia page: http://en.wikipedia.org/wiki/Launchd
 This launchd item uses the following flags:
 --keep-in-foreground - this is crucial for use with launchd
 --log-queries - this is optional and you can remove it
 --log-facility=/var/log/dnsmasq.log - again optional instead of system.log
 To use this launchd item for dnsmasq:
 If you don't already have a folder /Library/LaunchDaemons, then create one:
 sudo mkdir /Library/LaunchDaemons
 sudo chown root:admin /Library/LaunchDaemons
 sudo chmod 775 /Library/LaunchDaemons 
 Copy uk.org.thekelleys.dnsmasq.plist there and then set ownership/permissions:
 sudo cp uk.org.thekelleys.dnsmasq.plist /Library/LaunchDaemons/
 sudo chown root:admin /Library/LaunchDaemons/uk.org.thekelleys.dnsmasq.plist
 sudo chmod 644 /Library/LaunchDaemons/uk.org.thekelleys.dnsmasq.plist
 Optionally, edit your dnsmasq configuration file to your liking.
 To start the launchd job, which starts dnsmasq, reboot or use the command:
 sudo launchctl load /Library/LaunchDaemons/uk.org.thekelleys.dnsmasq.plist
 To stop the launchd job, which stops dnsmasq, use the command:
 sudo launchctl unload /Library/LaunchDaemons/uk.org.thekelleys.dnsmasq.plist
 If you want to permanently stop the launchd job, so it doesn't start the job even after a reboot, use the following command:
 sudo launchctl unload -w /Library/LaunchDaemons/uk.org.thekelleys.dnsmasq.plist
 If you make a change to the configuration file, you should relaunch dnsmasq;
 to do this unload and then load again:
 sudo launchctl unload /Library/LaunchDaemons/uk.org.thekelleys.dnsmasq.plist
 sudo launchctl load /Library/LaunchDaemons/uk.org.thekelleys.dnsmasq.plist
@@ -0,0 +1,15 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
 	<key>Label</key>
 	<string>uk.org.thekelleys.dnsmasq</string>
 	<key>ProgramArguments</key>
 	<array>
 		<string>/usr/local/sbin/dnsmasq</string>
 		<string>--keep-in-foreground</string>
 	</array>
 	<key>RunAtLoad</key>
 	<true/>
 </dict>
 </plist>
@@ -0,0 +1,28 @@
 From: David Connelly <dconnelly@gmail.com>
 Date: Mon, Apr 7, 2008 at 3:31 AM
 Subject: Solaris 10 service manifest
 To: dnsmasq-discuss@lists.thekelleys.org.uk
 I've found dnsmasq much easier to set up on my home server running Solaris
 10 than the stock dhcp/dns server, which is probably overkill anyway for my
 simple home network needs. Since Solaris now uses SMF (Service Management
 Facility) to manage services I thought I'd create a simple service manifest
 for the dnsmasq service. The manifest currently assumes that dnsmasq has
 been installed in '/usr/local/sbin/dnsmasq' and the configuration file in
 '/usr/local/etc/dnsmasq.conf', so you may have to adjust these paths for
 your local installation. Here are the steps I followed to install and enable
 the dnsmasq service:
  # svccfg import dnsmasq.xml
  # svcadm enable dnsmasq
 To confirm that the service is enabled and online:
  # svcs -l dnsmasq
 I've just started learning about SMF so if anyone has any
 corrections/feedback they are more than welcome.
 Thanks,
 David
@@ -0,0 +1,8 @@
 Hi Simon,
 I just wanted to let you know that I have built a Solaris .pkg install package of your dnsmasq utility for people to use.  Feel free to point them in my direction if you have people who want this sort of thing.
 http://ejesconsulting.wordpress.com/2010/05/12/gnu-dnsmasq-for-opensolaris-sparc/
 Thanks
 -evan
@@ -0,0 +1,25 @@
 Ok, script attached ... seems to be working ok for me, 
 tried to install and remove a few times. It does the
 right thing with the smf when installing, you can then 
 simply enable the service. Upon removal it cleans up the
 files but won't clean up the services (I think until
 a reboot) ... I've only started looking at the new 
 packages stuff in the last day or two, so I could be 
 missing something, but I can't find any way to force
 a proper cleanup.
 It requires that you have a writable repository setup 
 as per the docs on the opensolaris website and it will
 create a dnsmasq package (package name is a variable 
 in the script). The script takes a version number for 
 the package and assumes that it's in the contrib/Solaris10 
 directory, it then works out the base tree directory 
 from $0.
 i.e.  $ contrib/Solaris10/create_package 2.52-1
 or   $ cd contrib/Solaris10; ./create_package 2.52-1
 It's a bit more complex than it could be because I 
 prefer putting the daemon in /usr/sbin and the config 
 in /etc, so the script will actually create a new 
 version of the existing contrib dnsmasq.xml.
@@ -0,0 +1,87 @@
 #!/bin/sh
 #
 # For our package, and for the SMF script, we need to define where we
 # want things to go...
 #
 BIN_DIR="/usr/sbin"
 CONF_DIR="/etc"
 MAN_DIR="/usr/share/man/man8"
 PACKAGE_NAME="dnsmasq"
 #
 # Since we know we are in the contrib directory we can work out where
 # the rest of the tree is...
 #
 BASEDIR="`dirname $0`/../.."
 #
 # We need a version number to use for the package creation...
 #
 if [ $# != 1 ]; then
 	echo "Usage: $0 <package_version_number>" >&2
 	exit 1
 fi
 VERSION="$1"
 #
 # First thing we do is fix-up the smf file to use the paths we prefer...
 #
 if [ ! -f "${BASEDIR}/contrib/Solaris10/dnsmasq.xml" ]; then
 	echo "$0: unable to find contrib/Solaris10/dnsmasq.xml" >&2
 	exit 1
 fi
 echo "Fixing up smf file ... \c"
 cat "${BASEDIR}/contrib/Solaris10/dnsmasq.xml" | \
 	sed 	-e "s%/usr/local/etc%${CONF_DIR}%" \
 		-e "s%/usr/local/sbin%${BIN_DIR}%" \
 		-e "s%/usr/local/man%${MAN_DIR}%" > ${BASEDIR}/contrib/Solaris10/dnsmasq-pkg.xml
 echo "done."
 echo "Creating packaging file ... \c"
 cat <<EOF >${BASEDIR}/contrib/Solaris10/dnsmasq_package.inc
 #
 # header
 #
 set name=pkg.name		value="dnsmasq"
 set name=pkg.description	value="dnsmasq daemon - dns, dhcp, tftp etc"
 set name=pkg.detailed_url	value="http://www.thekelleys.org.uk/dnsmasq/doc.html"
 set name=info.maintainer	value="TBD (tbd@tbd.com)"
 set name=info.upstream		value="dnsmasq-discuss@lists.thekelleys.org.uk"
 set name=info.upstream_url	value="http://www.thekelleys.org.uk/dnsmasq/doc.html"
 #
 # dependencies ... none?
 #
 #
 # directories
 #
 dir mode=0755 owner=root group=bin path=${BIN_DIR}/
 dir mode=0755 owner=root group=sys path=${CONF_DIR}/
 dir mode=0755 owner=root group=sys path=${MAN_DIR}/
 dir mode=0755 owner=root group=sys path=/var/
 dir mode=0755 owner=root group=sys path=/var/svc
 dir mode=0755 owner=root group=sys path=/var/svc/manifest
 dir mode=0755 owner=root group=sys path=/var/svc/manifest/network
 #
 # files
 #
 file ${BASEDIR}/src/dnsmasq mode=0555 owner=root group=bin path=${BIN_DIR}/dnsmasq
 file ${BASEDIR}/man/dnsmasq.8 mode=0555 owner=root group=bin path=${MAN_DIR}/dnsmasq.8
 file ${BASEDIR}/dnsmasq.conf.example mode=0644 owner=root group=sys path=${CONF_DIR}/dnsmasq.conf preserve=strawberry
 file ${BASEDIR}/contrib/Solaris10/dnsmasq-pkg.xml mode=0644 owner=root group=sys path=/var/svc/manifest/network/dnsmasq.xml restart_fmri=svc:/system/manifest-import:default
 EOF
 echo "done."
 echo "Creating package..."
 eval `pkgsend open ${PACKAGE_NAME}@${VERSION}`
 pkgsend include ${BASEDIR}/contrib/Solaris10/dnsmasq_package.inc
 if [ "$?" = 0 ]; then
 	pkgsend close
 else
 	echo "Errors"
 fi
@@ -0,0 +1,65 @@
 <?xml version='1.0'?>
 <!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">
 <!-- Service manifest for dnsmasq -->
 <service_bundle type='manifest' name='dnsmasq'>
  <service name='network/dnsmasq' type='service' version='1'>
    <create_default_instance enabled='false'/>
    <single_instance/>
    <dependency name='multi-user'
                grouping='require_all'
                restart_on='refresh'
                type='service'>
      <service_fmri value='svc:/milestone/multi-user'/>
    </dependency>
    <dependency name='config'
 		grouping='require_all'
 		restart_on='restart'
 		type='path'>
      <service_fmri value='file:///usr/local/etc/dnsmasq.conf'/>
    </dependency>
    <dependent name='dnsmasq_multi-user-server'
               grouping='optional_all'
               restart_on='none'>
      <service_fmri value='svc:/milestone/multi-user-server' />
    </dependent>
    <exec_method type='method' name='start'
                 exec='/usr/local/sbin/dnsmasq -C /usr/local/etc/dnsmasq.conf'
                 timeout_seconds='60' >
      <method_context>
        <method_credential user='root' group='root' privileges='all'/>
      </method_context>
    </exec_method>
    <exec_method type='method'
                 name='stop'
                 exec=':kill'
                 timeout_seconds='60'/>
    <exec_method type='method'
                 name='refresh'
                 exec=':kill -HUP'
                 timeout_seconds='60' />
    <template>
      <common_name>
        <loctext xml:lang='C'>dnsmasq server</loctext>
      </common_name>
      <description>
        <loctext xml:lang='C'>
 dnsmasq - A lightweight DHCP and caching DNS server.
        </loctext>
      </description>
      <documentation>
        <manpage title='dnsmasq' section='8' manpath='/usr/local/man'/>
      </documentation>
    </template>
  </service>
 </service_bundle>
@@ -1,9 +1,9 @@
 This is a patch against SuSEfirewall2-3.1-206 (SuSE 9.x and older)
-It fixes the depancy from the dns daemon name 'named'
+It fixes the dependency from the dns daemon name 'named'
 After appending the patch, the SuSEfirewall is again able to autodetect 
 the dnsmasq named service.
 This is a very old bug in the SuSEfirewall script.
-The SuSE people think the name of the dns server will allways 'named'
+The SuSE people think the name of the dns server will always 'named'
 --- /sbin/SuSEfirewall2.orig	2004-01-23 13:30:09.000000000 +0100
@@ -0,0 +1,54 @@
 Linux iptables includes that ability to mark individual network packets
 with a "firewall mark".  Additionally there is a component called
 "conntrack" which tries to string sequences of related packets together
 into a "connection" (it even relates sequences of UDP and ICMP packets).
 There is a related mark for a connection called a "connection mark".
 Marks can be copied freely between the firewall and connection marks
 Using these two features it become possible to tag all related traffic
 in arbitrary ways, eg authenticated users, traffic from a particular IP,
 port, etc. Unfortunately any kind of "proxy" breaks this relationship
 because network packets go in one side of the proxy and a completely new
 connection comes out of the other side.  However, sometimes, we want to
 maintain that relationship through the proxy and continue the connection
 mark on packets upstream of our proxy
 Dnsmasq includes such a feature enabled by the --conntrack
 option. This allows, for example, using iptables to mark traffic from
 a particular IP, and that mark to be persisted to requests made *by*
 Dnsmasq. Such a feature could be useful for bandwidth accounting,
 captive portals and the like. Note a similar feature has been 
 implemented in Squid 2.2
 As an example consider the following iptables rules:
 1) iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
 2) iptables -t mangle -A PREROUTING -m mark --mark 0 -s 192.168.111.137
 -j MARK --set-mark 137
 3) iptables -t mangle -A PREROUTING -j CONNMARK --save-mark
 4) iptables -t mangle -A OUTPUT -m mark ! --mark 0 -j CONNMARK --save-mark
 1-3) are all applied to the PREROUTING table and affect all packets
 entering the firewall.
 1) copies any existing connection mark into the firewall mark. 2) Checks
 the packet not already marked and if not applies an arbitrary mark based
 on IP address. 3) Saves the firewall mark back to the connection mark
 (which will persist it across related packets)
 4) is applied to the OUTPUT table, which is where we first see packets
 generated locally. Dnsmasq will have already copied the firewall mark
 from the request, across to the new packet, and so all that remains is
 for iptables to copy it to the connection mark so it's persisted across
 packets.
 Note: iptables can be quite confusing to the beginner. The following
 diagram is extremely helpful in understanding the flows
 	http://linux-ip.net/nf/nfk-traversal.png
 Additionally the following URL contains a useful "starting guide" on
 linux connection tracking/marking
 	http://home.regit.org/netfilter-en/netfilter-connmark/
@@ -0,0 +1,43 @@
 #!/usr/bin/python
 import dbus
 bus = dbus.SystemBus()
 p = bus.get_object("uk.org.thekelleys.dnsmasq", "/uk/org/thekelleys/dnsmasq")
 l = dbus.Interface(p, dbus_interface="uk.org.thekelleys.dnsmasq")
 # The new more flexible SetServersEx method
 array = dbus.Array()
 array.append(["1.2.3.5"])
 array.append(["1.2.3.4#664", "foobar.com"])
 array.append(["1003:1234:abcd::1%eth0", "eng.mycorp.com", "lab.mycorp.com"])
 print l.SetServersEx(array)
 # Must create a new object for dnsmasq as the introspection gives the wrong
 # signature for SetServers (av) while the code only expects a bunch of arguments
 # instead of an array of variants
 p = bus.get_object("uk.org.thekelleys.dnsmasq", "/uk/org/thekelleys/dnsmasq", introspect=False)
 l = dbus.Interface(p, dbus_interface="uk.org.thekelleys.dnsmasq")
 # The previous method; all addresses in machine byte order
 print l.SetServers(dbus.UInt32(16909060), # 1.2.3.5
                   dbus.UInt32(16909061), # 1.2.3.4
                   "foobar.com",
                   dbus.Byte(0x10),       # 1003:1234:abcd::1
                   dbus.Byte(0x03),
                   dbus.Byte(0x12),
                   dbus.Byte(0x34),
                   dbus.Byte(0xab),
                   dbus.Byte(0xcd),
                   dbus.Byte(0x00),
                   dbus.Byte(0x00),
                   dbus.Byte(0x00),
                   dbus.Byte(0x00),
                   dbus.Byte(0x00),
                   dbus.Byte(0x00),
                   dbus.Byte(0x00),
                   dbus.Byte(0x00),
                   dbus.Byte(0x00),
                   dbus.Byte(0x01),
                   "eng.mycorp.com",
                   "lab.mycorp.com")
@@ -0,0 +1,12 @@
 Hi Simon
 Here is a patch against dnsmasq 2.39 which provides support for LOC  
 entries in order to assign location information to dns records  
 (rfc1876). I tested it on OSX and on OpenWRT.
 Cheers
 Lorenz
 More info:
 http://www.ckdhr.com/dns-loc/
 http://www.faqs.org/rfcs/rfc1876.html
@@ -0,0 +1,522 @@
 diff -Nur dnsmasq-2.39-orig/bld/Makefile dnsmasq-2.39/bld/Makefile
 --- dnsmasq-2.39-orig/bld/Makefile	2007-02-17 14:37:06.000000000 +0100
 +++ dnsmasq-2.39/bld/Makefile	2007-05-20 18:23:44.000000000 +0200
@@ -2,7 +2,7 @@
 PKG_CONFIG ?= pkg-config
 -OBJS = cache.o rfc1035.o util.o option.o forward.o isc.o network.o \
 +OBJS = cache.o rfc1035.o rfc1876.o util.o option.o forward.o isc.o network.o \
        dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o \
        helper.o tftp.o log.o
 diff -Nur dnsmasq-2.39-orig/src/dnsmasq.h dnsmasq-2.39/src/dnsmasq.h
 --- dnsmasq-2.39-orig/src/dnsmasq.h	2007-04-20 12:53:38.000000000 +0200
 +++ dnsmasq-2.39/src/dnsmasq.h	2007-05-20 19:50:37.000000000 +0200
@@ -162,6 +162,12 @@
   struct interface_name *next;
 };
 +struct loc_record {
 +  char *name, loc[16];
 +  unsigned short class;
 +  struct loc_record *next;
 +};
 +
 union bigname {
   char name[MAXDNAME];
   union bigname *next; /* freelist */
@@ -476,6 +482,7 @@
   struct mx_srv_record *mxnames;
   struct txt_record *txt;
   struct ptr_record *ptr;
 +	struct loc_record *loc;
   struct interface_name *int_names;
   char *mxtarget;
   char *lease_file; 
@@ -725,3 +732,6 @@
 void tftp_request(struct listener *listen, struct daemon *daemon, time_t now);
 void check_tftp_listeners(struct daemon *daemon, fd_set *rset, time_t now);
 #endif
 +
 +/* rfc1876 */
 +u_int32_t loc_aton(const char *ascii, u_char *binary);
 diff -Nur dnsmasq-2.39-orig/src/option.c dnsmasq-2.39/src/option.c
 --- dnsmasq-2.39-orig/src/option.c	2007-04-19 23:34:49.000000000 +0200
 +++ dnsmasq-2.39/src/option.c	2007-05-20 20:15:15.000000000 +0200
@@ -43,6 +43,7 @@
 #define LOPT_REMOTE    269
 #define LOPT_SUBSCR    270
 #define LOPT_INTNAME   271
 +#define LOPT_LOC       272
 #ifdef HAVE_GETOPT_LONG
 static const struct option opts[] =  
@@ -122,6 +123,7 @@
     {"tftp-root", 1, 0, LOPT_PREFIX },
     {"tftp-max", 1, 0, LOPT_TFTP_MAX },
     {"ptr-record", 1, 0, LOPT_PTR },
 +    {"loc-record", 1, 0, LOPT_LOC },
 #if defined(__FreeBSD__) || defined(__DragonFly__)
     {"bridge-interface", 1, 0 , LOPT_BRIDGE },
 #endif
@@ -235,6 +237,7 @@
   { "-y, --localise-queries", gettext_noop("Answer DNS queries based on the interface a query was sent to."), NULL },
   { "-Y  --txt-record=name,txt....", gettext_noop("Specify TXT DNS record."), NULL },
   { "    --ptr-record=name,target", gettext_noop("Specify PTR DNS record."), NULL },
 +  { "    --loc-record=name,lat lon alt", gettext_noop("Specify LOC DNS record."), NULL },
   { "    --interface-name=name,interface", gettext_noop("Give DNS name to IPv4 address of interface."), NULL },
   { "-z, --bind-interfaces", gettext_noop("Bind only to interfaces in use."), NULL },
   { "-Z, --read-ethers", gettext_noop("Read DHCP static host information from %s."), ETHERSFILE },
@@ -1835,6 +1838,37 @@
 	new->intr = safe_string_alloc(comma);
 	break;
       }
 +      
 +    case LOPT_LOC:
 +      {
 +	struct loc_record *new;
 +	unsigned char *p, *q;
 +	
 +	comma = split(arg);
 +	
 +	if (!canonicalise_opt(arg))
 +	  {
 +	    option = '?';
 +	    problem = _("bad LOC record");
 +	    break;
 +	  }
 +	
 +	new = safe_malloc(sizeof(struct loc_record));
 +	new->next = daemon->loc;
 +	daemon->loc = new;
 +	new->class = C_IN;
 +	if (!comma || loc_aton(comma,new->loc)!=16)
 +	  {
 +	    option = '?';
 +	    problem = _("bad LOC record");
 +	    break;
 +	  }
 +
 +	if (comma)
 +	  *comma = 0;
 +	new->name = safe_string_alloc(arg);
 +	break;
 +      }
     case LOPT_PTR:  /* --ptr-record */
       {
 diff -Nur dnsmasq-2.39-orig/src/rfc1035.c dnsmasq-2.39/src/rfc1035.c
 --- dnsmasq-2.39-orig/src/rfc1035.c	2007-04-20 12:54:26.000000000 +0200
 +++ dnsmasq-2.39/src/rfc1035.c	2007-05-20 18:22:46.000000000 +0200
@@ -1112,6 +1112,27 @@
 	    }
 	}
 +      if (qtype == T_LOC || qtype == T_ANY)
 +	{
 +	  struct loc_record *t;
 +	  for(t = daemon->loc; t ; t = t->next)
 +	    {
 +	      if (t->class == qclass && hostname_isequal(name, t->name))
 +		{
 +		  ans = 1;
 +		  if (!dryrun)
 +		    {
 +		      log_query(F_CNAME | F_FORWARD | F_CONFIG | F_NXDOMAIN, name, NULL, 0, NULL, 0);
 +		      if (add_resource_record(header, limit, &trunc, nameoffset, &ansp, 
 +					      daemon->local_ttl, NULL,
 +					      T_LOC, t->class, "t", 16, t->loc))
 +			anscount++;
 +
 +		    }
 +		}
 +	    }
 +	}
 +
       if (qclass == C_IN)
 	{
 	  if (qtype == T_PTR || qtype == T_ANY)
 diff -Nur dnsmasq-2.39-orig/src/rfc1876.c dnsmasq-2.39/src/rfc1876.c
 --- dnsmasq-2.39-orig/src/rfc1876.c	1970-01-01 01:00:00.000000000 +0100
 +++ dnsmasq-2.39/src/rfc1876.c	2007-05-20 19:50:10.000000000 +0200
@@ -0,0 +1,379 @@
 +/*
 + * routines to convert between on-the-wire RR format and zone file
 + * format.  Does not contain conversion to/from decimal degrees;
 + * divide or multiply by 60*60*1000 for that.
 + */
 +
 +#include "dnsmasq.h"
 +
 +static unsigned int poweroften[10] = {1, 10, 100, 1000, 10000, 100000,
 +                                 1000000,10000000,100000000,1000000000};
 +
 +/* takes an XeY precision/size value, returns a string representation.*/
 +static const char *
 +precsize_ntoa(u_int8_t prec)
 +{
 +        static char retbuf[sizeof("90000000.00")];
 +        unsigned long val;
 +        int mantissa, exponent;
 +
 +        mantissa = (int)((prec >> 4) & 0x0f) % 10;
 +        exponent = (int)((prec >> 0) & 0x0f) % 10;
 +
 +        val = mantissa * poweroften[exponent];
 +
 +        (void) sprintf(retbuf,"%d.%.2d", val/100, val%100);
 +        return (retbuf);
 +}
 +
 +/* converts ascii size/precision X * 10**Y(cm) to 0xXY. moves pointer.*/
 +static u_int8_t
 +precsize_aton(char **strptr)
 +{
 +        unsigned int mval = 0, cmval = 0;
 +        u_int8_t retval = 0;
 +        register char *cp;
 +        register int exponent;
 +        register int mantissa;
 +
 +        cp = *strptr;
 +
 +        while (isdigit(*cp))
 +                mval = mval * 10 + (*cp++ - '0');
 +
 +        if (*cp == '.') {               /* centimeters */
 +                cp++;
 +                if (isdigit(*cp)) {
 +                        cmval = (*cp++ - '0') * 10;
 +                        if (isdigit(*cp)) {
 +                                cmval += (*cp++ - '0');
 +                        }
 +                }
 +        }
 +        cmval = (mval * 100) + cmval;
 +
 +        for (exponent = 0; exponent < 9; exponent++)
 +                if (cmval < poweroften[exponent+1])
 +                        break;
 +
 +        mantissa = cmval / poweroften[exponent];
 +        if (mantissa > 9)
 +                mantissa = 9;
 +
 +        retval = (mantissa << 4) | exponent;
 +
 +        *strptr = cp;
 +
 +        return (retval);
 +}
 +
 +/* converts ascii lat/lon to unsigned encoded 32-bit number.
 + *  moves pointer. */
 +static u_int32_t
 +latlon2ul(char **latlonstrptr,int *which)
 +{
 +        register char *cp;
 +        u_int32_t retval;
 +        int deg = 0, min = 0, secs = 0, secsfrac = 0;
 +
 +        cp = *latlonstrptr;
 +
 +        while (isdigit(*cp))
 +                deg = deg * 10 + (*cp++ - '0');
 +
 +        while (isspace(*cp))
 +                cp++;
 +
 +        if (!(isdigit(*cp)))
 +                goto fndhemi;
 +
 +        while (isdigit(*cp))
 +                min = min * 10 + (*cp++ - '0');
 +        while (isspace(*cp))
 +                cp++;
 +
 +        if (!(isdigit(*cp)))
 +                goto fndhemi;
 +
 +        while (isdigit(*cp))
 +                secs = secs * 10 + (*cp++ - '0');
 +
 +        if (*cp == '.') {               /* decimal seconds */
 +                cp++;
 +                if (isdigit(*cp)) {
 +                        secsfrac = (*cp++ - '0') * 100;
 +                        if (isdigit(*cp)) {
 +                                secsfrac += (*cp++ - '0') * 10;
 +                                if (isdigit(*cp)) {
 +                                        secsfrac += (*cp++ - '0');
 +                                }
 +                        }
 +                }
 +        }
 +
 +        while (!isspace(*cp))   /* if any trailing garbage */
 +                cp++;
 +
 +        while (isspace(*cp))
 +                cp++;
 +
 + fndhemi:
 +        switch (*cp) {
 +        case 'N': case 'n':
 +        case 'E': case 'e':
 +                retval = ((unsigned)1<<31)
 +                        + (((((deg * 60) + min) * 60) + secs) * 1000)
 +                        + secsfrac;
 +                break;
 +        case 'S': case 's':
 +        case 'W': case 'w':
 +                retval = ((unsigned)1<<31)
 +                        - (((((deg * 60) + min) * 60) + secs) * 1000)
 +                        - secsfrac;
 +                break;
 +        default:
 +                retval = 0;     /* invalid value -- indicates error */
 +                break;
 +        }
 +
 +        switch (*cp) {
 +        case 'N': case 'n':
 +        case 'S': case 's':
 +                *which = 1;     /* latitude */
 +                break;
 +        case 'E': case 'e':
 +        case 'W': case 'w':
 +                *which = 2;     /* longitude */
 +                break;
 +        default:
 +                *which = 0;     /* error */
 +                break;
 +        }
 +
 +        cp++;                   /* skip the hemisphere */
 +
 +        while (!isspace(*cp))   /* if any trailing garbage */
 +                cp++;
 +
 +        while (isspace(*cp))    /* move to next field */
 +                cp++;
 +
 +        *latlonstrptr = cp;
 +
 +        return (retval);
 +}
 +
 +/* converts a zone file representation in a string to an RDATA
 + * on-the-wire representation. */
 +u_int32_t
 +loc_aton(const char *ascii, u_char *binary)
 +{
 +        const char *cp, *maxcp;
 +        u_char *bcp;
 +
 +        u_int32_t latit = 0, longit = 0, alt = 0;
 +        u_int32_t lltemp1 = 0, lltemp2 = 0;
 +        int altmeters = 0, altfrac = 0, altsign = 1;
 +        u_int8_t hp = 0x16;    /* default = 1e6 cm = 10000.00m = 10km */
 +        u_int8_t vp = 0x13;    /* default = 1e3 cm = 10.00m */
 +        u_int8_t siz = 0x12;   /* default = 1e2 cm = 1.00m */
 +        int which1 = 0, which2 = 0;
 +
 +        cp = ascii;
 +        maxcp = cp + strlen(ascii);
 +
 +        lltemp1 = latlon2ul(&cp, &which1);
 +        lltemp2 = latlon2ul(&cp, &which2);
 +
 +        switch (which1 + which2) {
 +        case 3:                 /* 1 + 2, the only valid combination */
 +                if ((which1 == 1) && (which2 == 2)) { /* normal case */
 +                        latit = lltemp1;
 +                        longit = lltemp2;
 +                } else if ((which1 == 2) && (which2 == 1)) {/*reversed*/
 +                        longit = lltemp1;
 +                        latit = lltemp2;
 +                } else {        /* some kind of brokenness */
 +                        return 0;
 +                }
 +                break;
 +        default:                /* we didn't get one of each */
 +                return 0;
 +        }
 +
 +        /* altitude */
 +        if (*cp == '-') {
 +                altsign = -1;
 +                cp++;
 +        }
 +
 +        if (*cp == '+')
 +                cp++;
 +
 +        while (isdigit(*cp))
 +                altmeters = altmeters * 10 + (*cp++ - '0');
 +
 +        if (*cp == '.') {               /* decimal meters */
 +                cp++;
 +                if (isdigit(*cp)) {
 +                        altfrac = (*cp++ - '0') * 10;
 +                        if (isdigit(*cp)) {
 +                                altfrac += (*cp++ - '0');
 +                        }
 +                }
 +        }
 +
 +        alt = (10000000 + (altsign * (altmeters * 100 + altfrac)));
 +
 +        while (!isspace(*cp) && (cp < maxcp))
 +                                           /* if trailing garbage or m */
 +                cp++;
 +
 +        while (isspace(*cp) && (cp < maxcp))
 +                cp++;
 +        if (cp >= maxcp)
 +                goto defaults;
 +
 +        siz = precsize_aton(&cp);
 +
 +        while (!isspace(*cp) && (cp < maxcp))/*if trailing garbage or m*/
 +                cp++;
 +
 +        while (isspace(*cp) && (cp < maxcp))
 +                cp++;
 +
 +        if (cp >= maxcp)
 +                goto defaults;
 +
 +        hp = precsize_aton(&cp);
 +
 +        while (!isspace(*cp) && (cp < maxcp))/*if trailing garbage or m*/
 +                cp++;
 +
 +        while (isspace(*cp) && (cp < maxcp))
 +                cp++;
 +
 +        if (cp >= maxcp)
 +                goto defaults;
 +
 +        vp = precsize_aton(&cp);
 +
 + defaults:
 +
 +        bcp = binary;
 +        *bcp++ = (u_int8_t) 0;  /* version byte */
 +        *bcp++ = siz;
 +        *bcp++ = hp;
 +        *bcp++ = vp;
 +        PUTLONG(latit,bcp);
 +        PUTLONG(longit,bcp);
 +        PUTLONG(alt,bcp);
 +
 +        return (16);            /* size of RR in octets */
 +}
 +
 +/* takes an on-the-wire LOC RR and prints it in zone file
 + * (human readable) format. */
 +char *
 +loc_ntoa(const u_char *binary,char *ascii)
 +{
 +        static char tmpbuf[255*3];
 +
 +        register char *cp;
 +        register const u_char *rcp;
 +
 +        int latdeg, latmin, latsec, latsecfrac;
 +        int longdeg, longmin, longsec, longsecfrac;
 +        char northsouth, eastwest;
 +        int altmeters, altfrac, altsign;
 +
 +        const int referencealt = 100000 * 100;
 +
 +        int32_t latval, longval, altval;
 +        u_int32_t templ;
 +        u_int8_t sizeval, hpval, vpval, versionval;
 +
 +        char *sizestr, *hpstr, *vpstr;
 +
 +        rcp = binary;
 +        if (ascii)
 +                cp = ascii;
 +        else {
 +                cp = tmpbuf;
 +        }
 +
 +        versionval = *rcp++;
 +
 +        if (versionval) {
 +                sprintf(cp,"; error: unknown LOC RR version");
 +                return (cp);
 +        }
 +
 +        sizeval = *rcp++;
 +
 +        hpval = *rcp++;
 +        vpval = *rcp++;
 +
 +        GETLONG(templ,rcp);
 +        latval = (templ - ((unsigned)1<<31));
 +
 +        GETLONG(templ,rcp);
 +        longval = (templ - ((unsigned)1<<31));
 +
 +        GETLONG(templ,rcp);
 +        if (templ < referencealt) { /* below WGS 84 spheroid */
 +                altval = referencealt - templ;
 +                altsign = -1;
 +        } else {
 +                altval = templ - referencealt;
 +                altsign = 1;
 +        }
 +
 +        if (latval < 0) {
 +                northsouth = 'S';
 +                latval = -latval;
 +        }
 +        else
 +                northsouth = 'N';
 +
 +        latsecfrac = latval % 1000;
 +        latval = latval / 1000;
 +        latsec = latval % 60;
 +        latval = latval / 60;
 +        latmin = latval % 60;
 +        latval = latval / 60;
 +        latdeg = latval;
 +
 +        if (longval < 0) {
 +                eastwest = 'W';
 +                longval = -longval;
 +        }
 +        else
 +                eastwest = 'E';
 +
 +        longsecfrac = longval % 1000;
 +        longval = longval / 1000;
 +        longsec = longval % 60;
 +        longval = longval / 60;
 +        longmin = longval % 60;
 +        longval = longval / 60;
 +        longdeg = longval;
 +
 +        altfrac = altval % 100;
 +        altmeters = (altval / 100) * altsign;
 +
 +        sizestr = strdup(precsize_ntoa(sizeval));
 +        hpstr = strdup(precsize_ntoa(hpval));
 +        vpstr = strdup(precsize_ntoa(vpval));
 +
 +        sprintf(cp,
 +                "%d %.2d %.2d.%.3d %c %d %.2d %.2d.%.3d %c %d.%.2dm %sm %sm %sm",
 +                latdeg, latmin, latsec, latsecfrac, northsouth,
 +                longdeg, longmin, longsec, longsecfrac, eastwest,
 +                altmeters, altfrac, sizestr, hpstr, vpstr);
 +        free(sizestr);
 +        free(hpstr);
 +        free(vpstr);
 +
 +        return (cp);
 +}
@@ -0,0 +1,20 @@
 Hello,
 For some specific application I needed to deny access to a MAC address
 to a lease. For this reason I modified the dhcp-script behavior and is
 called with an extra parameter "access" once a dhcp request or discover
 is received. In that case if the exit code of the script is zero,
 dnsmasq continues normally, and if non-zero the packet is ignored.
 This was not added as a security feature but as a mean to handle
 differently some addresses. It is also quite intrusive since it requires
 changes in several other subsystems.
 It attach the patch in case someone is interested.
 regards,
 Nikos
 nmav@gennetsa.com
@@ -0,0 +1,578 @@
 Index: src/dnsmasq.c
 ===================================================================
 --- src/dnsmasq.c	(revision 696)
 +++ src/dnsmasq.c	(revision 821)
@@ -59,7 +59,6 @@
 static int set_dns_listeners(time_t now, fd_set *set, int *maxfdp);
 static void check_dns_listeners(fd_set *set, time_t now);
 static void sig_handler(int sig);
 -static void async_event(int pipe, time_t now);
 static void fatal_event(struct event_desc *ev);
 static void poll_resolv(void);
@@ -275,7 +274,7 @@
   piperead = pipefd[0];
   pipewrite = pipefd[1];
   /* prime the pipe to load stuff first time. */
 -  send_event(pipewrite, EVENT_RELOAD, 0); 
 +  send_event(pipewrite, EVENT_RELOAD, 0, 0); 
   err_pipe[1] = -1;
@@ -340,7 +339,7 @@
 	    }
 	  else if (getuid() == 0)
 	    {
 -	      send_event(err_pipe[1], EVENT_PIDFILE, errno);
 +	      send_event(err_pipe[1], EVENT_PIDFILE, errno, 0);
 	      _exit(0);
 	    }
 	}
@@ -372,7 +371,7 @@
 	  (setgroups(0, &dummy) == -1 ||
 	   setgid(gp->gr_gid) == -1))
 	{
 -	  send_event(err_pipe[1], EVENT_GROUP_ERR, errno);
 +	  send_event(err_pipe[1], EVENT_GROUP_ERR, errno, 0);
 	  _exit(0);
 	}
@@ -415,14 +414,14 @@
 	  if (bad_capabilities != 0)
 	    {
 -	      send_event(err_pipe[1], EVENT_CAP_ERR, bad_capabilities);
 +	      send_event(err_pipe[1], EVENT_CAP_ERR, bad_capabilities, 0);
 	      _exit(0);
 	    }
 	  /* finally drop root */
 	  if (setuid(ent_pw->pw_uid) == -1)
 	    {
 -	      send_event(err_pipe[1], EVENT_USER_ERR, errno);
 +	      send_event(err_pipe[1], EVENT_USER_ERR, errno, 0);
 	      _exit(0);
 	    }     
@@ -434,7 +433,7 @@
 	  /* lose the setuid and setgid capabilities */
 	  if (capset(hdr, data) == -1)
 	    {
 -	      send_event(err_pipe[1], EVENT_CAP_ERR, errno);
 +	      send_event(err_pipe[1], EVENT_CAP_ERR, errno, 0);
 	      _exit(0);
 	    }
 #endif
@@ -647,7 +646,7 @@
 	}
       if (FD_ISSET(piperead, &rset))
 -	async_event(piperead, now);
 +	async_event(piperead, now, NULL, 0);
 #ifdef HAVE_LINUX_NETWORK
       if (FD_ISSET(daemon->netlinkfd, &rset))
@@ -674,7 +673,7 @@
 #endif      
       if (daemon->dhcp && FD_ISSET(daemon->dhcpfd, &rset))
 -	dhcp_packet(now);
 +	dhcp_packet(piperead, now);
 #ifndef NO_FORK
       if (daemon->helperfd != -1 && FD_ISSET(daemon->helperfd, &wset))
@@ -719,17 +718,18 @@
       else
 	return;
 -      send_event(pipewrite, event, 0); 
 +      send_event(pipewrite, event, 0, 0); 
       errno = errsave;
     }
 }
 -void send_event(int fd, int event, int data)
 +void send_event(int fd, int event, int data, int priv)
 {
   struct event_desc ev;
   ev.event = event;
   ev.data = data;
 +  ev.priv = priv;
   /* error pipe, debug mode. */
   if (fd == -1)
@@ -771,14 +771,17 @@
       die(_("cannot open %s: %s"), daemon->log_file ? daemon->log_file : "log", EC_FILE);
     }
 }	
 -      
 -static void async_event(int pipe, time_t now)
 +
 +/* returns the private data of the event
 + */
 +int async_event(int pipe, time_t now, struct event_desc* event, unsigned int secs)
 {
   pid_t p;
   struct event_desc ev;
   int i;
 -  if (read_write(pipe, (unsigned char *)&ev, sizeof(ev), 1))
 +  if (read_timeout(pipe, (unsigned char *)&ev, sizeof(ev), now, secs) > 0) 
 +    {
     switch (ev.event)
       {
       case EVENT_RELOAD:
@@ -872,6 +875,14 @@
 	flush_log();
 	exit(EC_GOOD);
       }
 +    }
 +  else
 +    return -1; /* timeout */
 +
 +  if (event)
 +    memcpy( event, &ev, sizeof(ev));
 +    
 +  return 0;
 }
 static void poll_resolv()
 Index: src/config.h
 ===================================================================
 --- src/config.h	(revision 696)
 +++ src/config.h	(revision 821)
@@ -51,6 +51,8 @@
 #define TFTP_MAX_CONNECTIONS 50 /* max simultaneous connections */
 #define LOG_MAX 5 /* log-queue length */
 #define RANDFILE "/dev/urandom"
 +#define SCRIPT_TIMEOUT 6
 +#define LEASE_CHECK_TIMEOUT 10
 /* DBUS interface specifics */
 #define DNSMASQ_SERVICE "uk.org.thekelleys.dnsmasq"
 Index: src/dnsmasq.h
 ===================================================================
 --- src/dnsmasq.h	(revision 696)
 +++ src/dnsmasq.h	(revision 821)
@@ -116,6 +116,7 @@
 /* Async event queue */
 struct event_desc {
   int event, data;
 +  unsigned int priv;
 };
 #define EVENT_RELOAD    1
@@ -390,6 +391,7 @@
 #define ACTION_OLD_HOSTNAME  2
 #define ACTION_OLD           3
 #define ACTION_ADD           4
 +#define ACTION_ACCESS        5
 #define DHCP_CHADDR_MAX 16
@@ -709,6 +711,7 @@
 char *print_mac(char *buff, unsigned char *mac, int len);
 void bump_maxfd(int fd, int *max);
 int read_write(int fd, unsigned char *packet, int size, int rw);
 +int read_timeout(int fd, unsigned char *packet, int size, time_t now, int secs);
 /* log.c */
 void die(char *message, char *arg1, int exit_code);
@@ -748,7 +751,7 @@
 /* dhcp.c */
 void dhcp_init(void);
 -void dhcp_packet(time_t now);
 +void dhcp_packet(int piperead, time_t now);
 struct dhcp_context *address_available(struct dhcp_context *context, 
 				       struct in_addr addr,
@@ -792,14 +795,16 @@
 void rerun_scripts(void);
 /* rfc2131.c */
 -size_t dhcp_reply(struct dhcp_context *context, char *iface_name, int int_index,
 +size_t dhcp_reply(int pipefd, struct dhcp_context *context, char *iface_name, int int_index,
 		  size_t sz, time_t now, int unicast_dest, int *is_inform);
 /* dnsmasq.c */
 int make_icmp_sock(void);
 int icmp_ping(struct in_addr addr);
 -void send_event(int fd, int event, int data);
 +void send_event(int fd, int event, int data, int priv);
 void clear_cache_and_reload(time_t now);
 +int wait_for_child(int pipe);
 +int async_event(int pipe, time_t now, struct event_desc*, unsigned int timeout);
 /* isc.c */
 #ifdef HAVE_ISC_READER
@@ -832,9 +837,9 @@
 /* helper.c */
 #ifndef NO_FORK
 int create_helper(int event_fd, int err_fd, uid_t uid, gid_t gid, long max_fd);
 -void helper_write(void);
 +int helper_write(void);
 void queue_script(int action, struct dhcp_lease *lease, 
 -		  char *hostname, time_t now);
 +		  char *hostname, time_t now, unsigned int uid);
 int helper_buf_empty(void);
 #endif
 Index: src/util.c
 ===================================================================
 --- src/util.c	(revision 696)
 +++ src/util.c	(revision 821)
@@ -444,3 +444,38 @@
   return 1;
 }
 +int read_timeout(int fd, unsigned char *packet, int size, time_t now, int secs)
 +{
 +  ssize_t n, done;
 +  time_t expire;
 +  
 +  expire = now + secs;
 +  
 +  for (done = 0; done < size; done += n)
 +    {
 +    retry:
 +      if (secs > 0) alarm(secs);
 +      n = read(fd, &packet[done], (size_t)(size - done));
 +
 +      if (n == 0)
 +        return 0;
 +      else if (n == -1)
 +        {
 +          if (errno == EINTR) {
 +            my_syslog(LOG_INFO, _("read timed out (errno %d)"), errno);
 +            return 0;
 +          }
 +
 +          if (retry_send() || errno == ENOMEM || errno == ENOBUFS || errno == EAGAIN)
 +            {
 +              if (secs == 0 || (secs > 0 && dnsmasq_time() < expire))
 +                goto retry;
 +            }
 +
 +          my_syslog(LOG_INFO, _("error in read (timeout %d, errno %d)"), secs, errno);
 +          return 0;
 +        }
 +    }
 +  return 1;
 +}
 +
 Index: src/dhcp.c
 ===================================================================
 --- src/dhcp.c	(revision 696)
 +++ src/dhcp.c	(revision 821)
@@ -103,7 +103,7 @@
   daemon->dhcp_packet.iov_base = safe_malloc(daemon->dhcp_packet.iov_len);
 }
 -void dhcp_packet(time_t now)
 +void dhcp_packet(int piperead, time_t now)
 {
   struct dhcp_packet *mess;
   struct dhcp_context *context;
@@ -239,7 +239,8 @@
   if (!iface_enumerate(&parm, complete_context, NULL))
     return;
   lease_prune(NULL, now); /* lose any expired leases */
 -  iov.iov_len = dhcp_reply(parm.current, ifr.ifr_name, iface_index, (size_t)sz, 
 +
 +  iov.iov_len = dhcp_reply(piperead, parm.current, ifr.ifr_name, iface_index, (size_t)sz, 
 			   now, unicast_dest, &is_inform);
   lease_update_file(now);
   lease_update_dns();
 Index: src/helper.c
 ===================================================================
 --- src/helper.c	(revision 696)
 +++ src/helper.c	(revision 821)
@@ -45,6 +45,7 @@
 #endif
   unsigned char hwaddr[DHCP_CHADDR_MAX];
   char interface[IF_NAMESIZE];
 +  unsigned int uid;
 };
 static struct script_data *buf = NULL;
@@ -60,7 +61,7 @@
      then fork our process. */
   if (pipe(pipefd) == -1 || !fix_fd(pipefd[1]) || (pid = fork()) == -1)
     {
 -      send_event(err_fd, EVENT_PIPE_ERR, errno);
 +      send_event(err_fd, EVENT_PIPE_ERR, errno, 0);
       _exit(0);
     }
@@ -87,13 +88,13 @@
 	{
 	  if (daemon->options & OPT_NO_FORK)
 	    /* send error to daemon process if no-fork */
 -	    send_event(event_fd, EVENT_HUSER_ERR, errno);
 +	    send_event(event_fd, EVENT_HUSER_ERR, errno, 0);
 	  else
 	    {
 	      /* kill daemon */
 -	      send_event(event_fd, EVENT_DIE, 0);
 +	      send_event(event_fd, EVENT_DIE, 0, 0);
 	      /* return error */
 -	      send_event(err_fd, EVENT_HUSER_ERR, errno);;
 +	      send_event(err_fd, EVENT_HUSER_ERR, errno, 0);
 	    }
 	  _exit(0);
 	}
@@ -122,6 +123,8 @@
 	action_str = "del";
       else if (data.action == ACTION_ADD)
 	action_str = "add";
 +      else if (data.action == ACTION_ACCESS)
 +	action_str = "access";
       else if (data.action == ACTION_OLD || data.action == ACTION_OLD_HOSTNAME)
 	action_str = "old";
       else
@@ -178,9 +181,11 @@
 		{
 		  /* On error send event back to main process for logging */
 		  if (WIFSIGNALED(status))
 -		    send_event(event_fd, EVENT_KILLED, WTERMSIG(status));
 -		  else if (WIFEXITED(status) && WEXITSTATUS(status) != 0)
 -		    send_event(event_fd, EVENT_EXITED, WEXITSTATUS(status));
 +		    send_event(event_fd, EVENT_KILLED, WTERMSIG(status), data.uid);
 +		  else if (WIFEXITED(status))
 +		    send_event(event_fd, EVENT_EXITED, WEXITSTATUS(status), data.uid);
 +                  else
 +		    send_event(event_fd, EVENT_EXITED, -1, data.uid);
 		  break;
 		}
@@ -263,7 +268,7 @@
 	  err = errno;
 	}
       /* failed, send event so the main process logs the problem */
 -      send_event(event_fd, EVENT_EXEC_ERR, err);
 +      send_event(event_fd, EVENT_EXEC_ERR, err, data.uid);
       _exit(0); 
     }
 }
@@ -295,7 +300,7 @@
 }
 /* pack up lease data into a buffer */    
 -void queue_script(int action, struct dhcp_lease *lease, char *hostname, time_t now)
 +void queue_script(int action, struct dhcp_lease *lease, char *hostname, time_t now, unsigned int uid)
 {
   unsigned char *p;
   size_t size;
@@ -332,6 +337,7 @@
       buf_size = size;
     }
 +  buf->uid = uid;
   buf->action = action;
   buf->hwaddr_len = lease->hwaddr_len;
   buf->hwaddr_type = lease->hwaddr_type;
@@ -393,12 +399,15 @@
   return bytes_in_buf == 0;
 }
 -void helper_write(void)
 +/* returns -1 if write failed for a reason, 1 if no data exist
 + * and 0 if everything was ok.
 + */
 +int helper_write(void)
 {
   ssize_t rc;
   if (bytes_in_buf == 0)
 -    return;
 +    return 1;
   if ((rc = write(daemon->helperfd, buf, bytes_in_buf)) != -1)
     {
@@ -409,9 +418,11 @@
   else
     {
       if (errno == EAGAIN || errno == EINTR)
 -	return;
 +	return -1;
       bytes_in_buf = 0;
     }
 +    
 +  return 0;
 }
 #endif
 Index: src/rfc2131.c
 ===================================================================
 --- src/rfc2131.c	(revision 696)
 +++ src/rfc2131.c	(revision 821)
@@ -100,8 +100,49 @@
 				      int clid_len, unsigned char *clid, int *len_out);
 static void match_vendor_opts(unsigned char *opt, struct dhcp_opt *dopt); 
 +static int check_access_script( int piperead, struct dhcp_lease *lease, struct dhcp_packet *mess, time_t now)
 +{
 +#ifndef NO_FORK
 +unsigned int uid;
 +struct event_desc ev;
 +int ret;
 +struct dhcp_lease _lease;
 +
 +  if (daemon->lease_change_command == NULL) return 0; /* ok */
 +
 +  if (!lease) { /* if host has not been seen before lease is NULL */
 +      memset(&_lease, 0, sizeof(_lease));
 +      lease = &_lease;
 +      lease_set_hwaddr(lease, mess->chaddr, NULL, mess->hlen, mess->htype, 0);
 +  }
 +
 +  uid = rand16();
 +  queue_script(ACTION_ACCESS, lease, NULL, now, uid);
 +
 +  /* send all data to helper process */
 +  do 
 +    {
 +      helper_write();
 +    } while (helper_buf_empty() == 0);
 +
 +  /* wait for our event */
 +  ret = 0;
 +  do 
 +    {
 +      ret = async_event( piperead, now, &ev, SCRIPT_TIMEOUT);
 +    }
 +  while(ev.priv != uid && ret >= 0);
 +
 +  if (ret < 0 || ev.data != 0) /* timeout or error */
 +    {
 +      return -1;
 +    }
 +
 +#endif
 +  return 0; /* ok */
 +}
 -size_t dhcp_reply(struct dhcp_context *context, char *iface_name, int int_index,
 +size_t dhcp_reply(int piperead, struct dhcp_context *context, char *iface_name, int int_index,
 		  size_t sz, time_t now, int unicast_dest, int *is_inform)
 {
   unsigned char *opt, *clid = NULL;
@@ -252,7 +293,7 @@
 	mac->netid.next = netid;
 	netid = &mac->netid;
       }
 -  
 +
   /* Determine network for this packet. Our caller will have already linked all the 
      contexts which match the addresses of the receiving interface but if the 
      machine has an address already, or came via a relay, or we have a subnet selector, 
@@ -329,7 +370,7 @@
 	    my_syslog(LOG_INFO, _("Available DHCP range: %s -- %s"), daemon->namebuff, inet_ntoa(context_tmp->end));
 	}
     }
 -
 +    
   mess->op = BOOTREPLY;
   config = find_config(daemon->dhcp_conf, context, clid, clid_len, 
@@ -418,7 +459,7 @@
 	      else
 		mess->yiaddr = lease->addr;
 	    }
 -	  
 +
 	  if (!message && 
 	      !lease && 
 	      (!(lease = lease_allocate(mess->yiaddr))))
@@ -641,7 +682,14 @@
       memcpy(req_options, option_ptr(opt, 0), option_len(opt));
       req_options[option_len(opt)] = OPTION_END;
     }
 -  
 +
 +  if (mess_type == DHCPREQUEST || mess_type == DHCPDISCOVER)
 +    if (check_access_script(piperead, lease, mess, now) < 0)
 +      {
 +        my_syslog(LOG_INFO, _("Ignoring client due to access script"));
 +        return 0;
 +      }
 +
   switch (mess_type)
     {
     case DHCPDECLINE:
 Index: src/log.c
 ===================================================================
 --- src/log.c	(revision 696)
 +++ src/log.c	(revision 821)
@@ -73,7 +73,7 @@
   if (!log_reopen(daemon->log_file))
     {
 -      send_event(errfd, EVENT_LOG_ERR, errno);
 +      send_event(errfd, EVENT_LOG_ERR, errno, 0);
       _exit(0);
     }
 Index: src/lease.c
 ===================================================================
 --- src/lease.c	(revision 696)
 +++ src/lease.c	(revision 821)
@@ -511,7 +511,7 @@
       if (lease->old_hostname)
 	{
 #ifndef NO_FORK
 -	  queue_script(ACTION_OLD_HOSTNAME, lease, lease->old_hostname, now);
 +	  queue_script(ACTION_OLD_HOSTNAME, lease, lease->old_hostname, now, 0);
 #endif
 	  free(lease->old_hostname);
 	  lease->old_hostname = NULL;
@@ -520,7 +520,7 @@
       else 
 	{
 #ifndef NO_FORK
 -	  queue_script(ACTION_DEL, lease, lease->hostname, now);
 +	  queue_script(ACTION_DEL, lease, lease->hostname, now, 0);
 #endif
 	  old_leases = lease->next;
@@ -540,7 +540,7 @@
     if (lease->old_hostname)
       {	
 #ifndef NO_FORK
 -	queue_script(ACTION_OLD_HOSTNAME, lease, lease->old_hostname, now);
 +	queue_script(ACTION_OLD_HOSTNAME, lease, lease->old_hostname, now, 0);
 #endif
 	free(lease->old_hostname);
 	lease->old_hostname = NULL;
@@ -552,7 +552,7 @@
 	(lease->aux_changed && (daemon->options & OPT_LEASE_RO)))
       {
 #ifndef NO_FORK
 -	queue_script(lease->new ? ACTION_ADD : ACTION_OLD, lease, lease->hostname, now);
 +	queue_script(lease->new ? ACTION_ADD : ACTION_OLD, lease, lease->hostname, now, 0);
 #endif
 	lease->new = lease->changed = lease->aux_changed = 0;
 Index: man/dnsmasq.8
 ===================================================================
 --- man/dnsmasq.8	(revision 696)
 +++ man/dnsmasq.8	(revision 821)
@@ -724,12 +724,15 @@
 .B \-6 --dhcp-script=<path>
 Whenever a new DHCP lease is created, or an old one destroyed, the
 binary specified by this option is run. The arguments to the process
 -are "add", "old" or "del", the MAC
 +are "add", "old", "access" or "del", the MAC
 address of the host (or "<null>"), the IP address, and the hostname,
 if known. "add" means a lease has been created, "del" means it has
 been destroyed, "old" is a notification of an existing lease when
 dnsmasq starts or a change to MAC address or hostname of an existing
 lease (also, lease length or expiry and client-id, if leasefile-ro is set).
 +The "access" keyword means that a request was just received and depending
 +on the script exit status request for address will be granted, if exit status
 +is zero or not if it is non-zero.
 The process is run as root (assuming that dnsmasq was originally run as
 root) even if dnsmasq is configured to change UID to an unprivileged user.
 The environment is inherited from the invoker of dnsmasq, and if the
@@ -0,0 +1,6 @@
 CFLAGS?= -O2 -Wall -W
 all: dhcp_release dhcp_release6 dhcp_lease_time
 clean:
 	rm -f *~ *.o core dhcp_release dhcp_release6 dhcp_lease_time
@@ -0,0 +1,25 @@
 .TH DHCP_LEASE_TIME 1
 .SH NAME
 dhcp_lease_time \- Query remaining time of a lease on a the local dnsmasq DHCP server.
 .SH SYNOPSIS
 .B  dhcp_lease_time <address>
 .SH "DESCRIPTION"
 Send a DHCPINFORM message to a dnsmasq server running on the local host
 and print (to stdout) the time remaining in any lease for the given
 address. The time is given as string printed to stdout.
 If an error occurs or no lease exists for the given address, 
 nothing is sent to stdout a message is sent to stderr and a
 non-zero error code is returned.
 Requires dnsmasq 2.67 or later and may not work with other DHCP servers.
 The address argument is a dotted-quad IP addresses and mandatory.
 .SH LIMITATIONS
 Only works with IPv4 addresses and DHCP leases. 
 .SH SEE ALSO
 .BR dnsmasq (8)
 .SH AUTHOR
 This manual page was written by Simon Kelley <simon@thekelleys.org.uk>.
@@ -0,0 +1,221 @@
 /* Copyright (c) 2007 Simon Kelley
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; version 2 dated June, 1991.
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
 */
 /* dhcp_lease_time <address> */
 /* Send a DHCPINFORM message to a dnsmasq server running on the local host
   and print (to stdout) the time remaining in any lease for the given
   address. The time is given as string printed to stdout.
   If an error occurs or no lease exists for the given address, 
   nothing is sent to stdout a message is sent to stderr and a
   non-zero error code is returned.
   This version requires dnsmasq 2.67 or later. 
 */
 #include <sys/types.h> 
 #include <netinet/in.h>
 #include <net/if.h>
 #include <arpa/inet.h>
 #include <sys/socket.h>
 #include <unistd.h>
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 #include <net/if_arp.h>
 #include <sys/ioctl.h>
 #include <linux/types.h>
 #include <linux/netlink.h>
 #include <linux/rtnetlink.h>
 #include <errno.h>
 #define DHCP_CHADDR_MAX          16
 #define BOOTREQUEST              1
 #define DHCP_COOKIE              0x63825363
 #define OPTION_PAD               0
 #define OPTION_LEASE_TIME        51
 #define OPTION_OVERLOAD          52
 #define OPTION_MESSAGE_TYPE      53
 #define OPTION_REQUESTED_OPTIONS 55
 #define OPTION_END               255
 #define DHCPINFORM               8
 #define DHCP_SERVER_PORT         67
 #define option_len(opt) ((int)(((unsigned char *)(opt))[1]))
 #define option_ptr(opt) ((void *)&(((unsigned char *)(opt))[2]))
 typedef unsigned char u8;
 typedef unsigned short u16;
 typedef unsigned int u32;
 struct dhcp_packet {
  u8 op, htype, hlen, hops;
  u32 xid;
  u16 secs, flags;
  struct in_addr ciaddr, yiaddr, siaddr, giaddr;
  u8 chaddr[DHCP_CHADDR_MAX], sname[64], file[128];
  u32 cookie;
  unsigned char options[308];
 };
 static unsigned char *option_find1(unsigned char *p, unsigned char *end, int opt, int minsize)
 {
  while (*p != OPTION_END) 
    {
      if (p >= end)
        return NULL; /* malformed packet */
      else if (*p == OPTION_PAD)
        p++;
      else 
        { 
          int opt_len;
          if (p >= end - 2)
            return NULL; /* malformed packet */
          opt_len = option_len(p);
          if (end - p < (2 + opt_len))
            return NULL; /* malformed packet */
          if (*p == opt && opt_len >= minsize)
            return p;
          p += opt_len + 2;
        }
    }
  return opt == OPTION_END ? p : NULL;
 }
 static unsigned char *option_find(struct dhcp_packet *mess, size_t size, int opt_type, int minsize)
 {
  unsigned char *ret, *overload;
  /* skip over DHCP cookie; */
  if ((ret = option_find1(&mess->options[0], ((unsigned char *)mess) + size, opt_type, minsize)))
    return ret;
  /* look for overload option. */
  if (!(overload = option_find1(&mess->options[0], ((unsigned char *)mess) + size, OPTION_OVERLOAD, 1)))
    return NULL;
  /* Can we look in filename area ? */
  if ((overload[2] & 1) &&
      (ret = option_find1(&mess->file[0], &mess->file[128], opt_type, minsize)))
    return ret;
  /* finally try sname area */
  if ((overload[2] & 2) &&
      (ret = option_find1(&mess->sname[0], &mess->sname[64], opt_type, minsize)))
    return ret;
  return NULL;
 }
 static unsigned int option_uint(unsigned char *opt, int size)
 {
  /* this worries about unaligned data and byte order */
  unsigned int ret = 0;
  int i;
  unsigned char *p = option_ptr(opt);
  for (i = 0; i < size; i++)
    ret = (ret << 8) | *p++;
  return ret;
 }
 int main(int argc, char **argv)
 { 
  struct in_addr lease;
  struct dhcp_packet packet;
  unsigned char *p = packet.options;
  struct sockaddr_in dest;
  int fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP);
  ssize_t rc;
  if (argc < 2)
    { 
      fprintf(stderr, "usage: dhcp_lease_time <address>\n");
      exit(1);
    }
  if (fd == -1)
    {
      perror("cannot create socket");
      exit(1);
    }
  lease.s_addr = inet_addr(argv[1]);
  memset(&packet, 0, sizeof(packet));
  packet.hlen = 0;
  packet.htype = 0;
  packet.op = BOOTREQUEST;
  packet.ciaddr = lease;
  packet.cookie = htonl(DHCP_COOKIE);
  *(p++) = OPTION_MESSAGE_TYPE;
  *(p++) = 1;
  *(p++) = DHCPINFORM;
  /* Explicitly request the lease time, it won't be sent otherwise:
     this is a dnsmasq extension, not standard. */
  *(p++) = OPTION_REQUESTED_OPTIONS;
  *(p++) = 1;
  *(p++) = OPTION_LEASE_TIME;
  *(p++) = OPTION_END;
  dest.sin_family = AF_INET; 
  dest.sin_addr.s_addr = inet_addr("127.0.0.1");
  dest.sin_port = ntohs(DHCP_SERVER_PORT);
  if (sendto(fd, &packet, sizeof(packet), 0, 
 	     (struct sockaddr *)&dest, sizeof(dest)) == -1)
    {
      perror("sendto failed");
      exit(1);
    }
  alarm(3); /* noddy timeout. */
  rc = recv(fd, &packet, sizeof(packet), 0);
  if (rc < (ssize_t)(sizeof(packet) - sizeof(packet.options)))
    {
      perror("recv failed");
      exit(1);
    }
  if ((p = option_find(&packet, (size_t)rc, OPTION_LEASE_TIME, 4)))
    {
      unsigned int t = option_uint(p, 4);
      if (t == 0xffffffff)
 	printf("infinite");
      else
 	{
 	  unsigned int x;
 	  if ((x = t/86400))
 	    printf("%ud", x);
 	  if ((x = (t/3600)%24))
 	    printf("%uh", x);
 	  if ((x = (t/60)%60))
 	    printf("%um", x);
 	  if ((x = t%60))
 	    printf("%us", x);
 	}
      return 0;
    }
  return 1; /* no lease */
 }
@@ -0,0 +1,37 @@
 .TH DHCP_RELEASE 1
 .SH NAME
 dhcp_release \- Release a DHCP lease on a the local dnsmasq DHCP server.
 .SH SYNOPSIS
 .B dhcp_release <interface> <address> <MAC address> <client_id>
 .SH "DESCRIPTION"
 A utility which forces the DHCP server running on this machine to release a 
 DHCP lease.
 .PP
 Send a DHCPRELEASE message via the specified interface to tell the
 local DHCP server to delete a particular lease. 
 The interface argument is the interface in which a DHCP
 request _would_ be received if it was coming from the client, 
 rather than being faked up here.
 The address argument is a dotted-quad IP addresses and mandatory. 
 The MAC address is colon separated hex, and is mandatory. It may be 
 prefixed by an address-type byte followed by -, eg
 10-11:22:33:44:55:66
 but if the address-type byte is missing it is assumed to be 1, the type 
 for ethernet. This encoding is the one used in dnsmasq lease files.
 The client-id is optional. If it is "*" then it treated as being missing.
 .SH NOTES
 MUST be run as root - will fail otherwise.
 .SH LIMITATIONS
 Only usable on IPv4 DHCP leases.
 .SH SEE ALSO
 .BR dnsmasq (8)
 .SH AUTHOR
 This manual page was written by Simon Kelley <simon@thekelleys.org.uk>.
@@ -117,7 +117,7 @@ static ssize_t netlink_recv(int fd)
      msg.msg_flags = 0;
      while ((rc = recvmsg(fd, &msg, MSG_PEEK)) == -1 && errno == EINTR);
-      /* 2.2.x doesn't suport MSG_PEEK at all, returning EOPNOTSUPP, so we just grab a 
+      /* 2.2.x doesn't support MSG_PEEK at all, returning EOPNOTSUPP, so we just grab a 
         big buffer and pray in that case. */
      if (rc == -1 && errno == EOPNOTSUPP)
        {
@@ -178,7 +178,7 @@ static int is_same_net(struct in_addr a, struct in_addr b, struct in_addr mask)
  return (a.s_addr & mask.s_addr) == (b.s_addr & mask.s_addr);
 }
-static struct in_addr find_interface(struct in_addr client, int fd, int index)
+static struct in_addr find_interface(struct in_addr client, int fd, unsigned int index, int ifrfd, struct ifreq *ifr)
 {
  struct sockaddr_nl addr;
  struct nlmsghdr *h;
@@ -218,7 +218,17 @@ static struct in_addr find_interface(struct in_addr client, int fd, int index)
      for (h = (struct nlmsghdr *)iov.iov_base; NLMSG_OK(h, (size_t)len); h = NLMSG_NEXT(h, len))
 	if (h->nlmsg_type == NLMSG_DONE)
-	  exit(0);
+          {
 	    /* No match found, return first address as src/dhcp.c code does */
 	    ifr->ifr_addr.sa_family = AF_INET;
 	    if (ioctl(ifrfd, SIOCGIFADDR, ifr) != -1)
 	      return ((struct sockaddr_in *)&ifr->ifr_addr)->sin_addr;
 	    else
 	      {
 		fprintf(stderr, "error: local IPv4 address not found\n");
 		exit(1);
 	      }
          }
 	else if (h->nlmsg_type == RTM_NEWADDR)
          {
            struct ifaddrmsg *ifa = NLMSG_DATA(h);  
@@ -255,10 +265,6 @@ int main(int argc, char **argv)
  struct ifreq ifr;
  int fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP);
  int nl = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
  struct iovec iov;
  iov.iov_len = 200;
  iov.iov_base = malloc(iov.iov_len);
  if (argc < 4 || argc > 5)
    { 
@@ -274,16 +280,22 @@ int main(int argc, char **argv)
  /* This voodoo fakes up a packet coming from the correct interface, which really matters for 
     a DHCP server */
-  strcpy(ifr.ifr_name, argv[1]);
+  strncpy(ifr.ifr_name, argv[1], sizeof(ifr.ifr_name)-1);
  ifr.ifr_name[sizeof(ifr.ifr_name)-1] = '\0';
  if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, &ifr, sizeof(ifr)) == -1)
    {
      perror("cannot setup interface");
      exit(1);
    }
  if (inet_addr(argv[2]) == INADDR_NONE)
    {
      perror("invalid ip address");
      exit(1);
    }
  lease.s_addr = inet_addr(argv[2]);
-  server = find_interface(lease, nl, if_nametoindex(argv[1]));
+  server = find_interface(lease, nl, if_nametoindex(argv[1]), fd, &ifr);
  memset(&packet, 0, sizeof(packet));
@@ -0,0 +1,38 @@
 .TH DHCP_RELEASE 1
 .SH NAME
 dhcp_release6 \- Release a DHCPv6 lease on a the local dnsmasq DHCP server.
 .SH SYNOPSIS
 .B dhcp_release6 --iface <interface> --client-id <client-id> --server-id
 server-id --iaid <iaid>  --ip <IP>  [--dry-run] [--help]
 .SH "DESCRIPTION"
 A utility which forces the DHCP server running on this machine to release a 
 DHCPv6 lease.
 .SS OPTIONS
 .IP "-a, --ip"
 IPv6 address to release.
 .IP "-c, --client-id"
 Colon-separated hex string representing DHCPv6 client id. Normally
 it can be found in leases file both on client and server.
 .IP "-d, --dry-run"
 Print hexadecimal representation of generated DHCPv6 release packet to standard
 output and exit.
 .IP "-h, --help"
 print usage information to standard output and exit.
 .IP "-i, --iaid"
 Decimal representation of DHCPv6 IAID. Normally it can be found in leases file
 both on client and server.
 .IP "-n, --iface"
 Network interface to send a DHCPv6 release packet from.
 .IP "-s, --server-id"
 Colon-separated hex string representing DHCPv6 server id. Normally
 it can be found in leases file both on client and server.
 .SH NOTES
 MUST be run as root - will fail otherwise.
 .SH LIMITATIONS
 Only usable on IPv6 DHCP leases.
 .SH SEE ALSO
 .BR dnsmasq (8)
 .SH AUTHOR
 This manual page was written by Simon Kelley <simon@thekelleys.org.uk>.
@@ -0,0 +1,499 @@
 /*
 dhcp_release6 --iface <interface> --client-id <client-id> --server-id
 server-id --iaid <iaid>  --ip <IP>  [--dry-run] [--help]
 MUST be run as root - will fail otherwise
 */
 /* Send a DHCPRELEASE message  to IPv6 multicast address  via the specified interface
 to tell the local DHCP server to delete a particular lease.
 The interface argument is the interface in which a DHCP
 request _would_ be received if it was coming from the client,
 rather than being faked up here.
 The client-id argument is colon-separated hex string and mandatory. Normally
 it can be found in leases file both on client and server
 The server-id argument is colon-separated hex string and mandatory. Normally
 it can be found in leases file both on client and server.
 The iaid argument is numeric string and mandatory. Normally
 it can be found in leases file both on client and server.
 IP is an IPv6 address to release
 If --dry-run is specified, dhcp_release6 just prints hexadecimal representation of
 packet to send to stdout and exits.
 If --help is specified, dhcp_release6 print usage information to stdout and exits
 */
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <strings.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <arpa/inet.h>
 #include <getopt.h>
 #include <errno.h>
 #include <unistd.h>
 #define NOT_REPLY_CODE 115
 typedef unsigned char u8;
 typedef unsigned short u16;
 typedef unsigned int u32;
 enum DHCP6_TYPES
  {
    SOLICIT = 1,
    ADVERTISE = 2,
    REQUEST = 3,
    CONFIRM = 4,
    RENEW = 5,
    REBIND = 6,
    REPLY = 7,
    RELEASE = 8,
    DECLINE = 9,
    RECONFIGURE = 10,
    INFORMATION_REQUEST = 11,
    RELAY_FORW = 12,
    RELAY_REPL = 13
  };
 enum DHCP6_OPTIONS
  {
    CLIENTID = 1,
    SERVERID = 2,
    IA_NA = 3,
    IA_TA = 4,
    IAADDR = 5,
    ORO = 6,
    PREFERENCE = 7,
    ELAPSED_TIME = 8,
    RELAY_MSG = 9,
    AUTH = 11,
    UNICAST = 12,
    STATUS_CODE = 13,
    RAPID_COMMIT = 14,
    USER_CLASS = 15,
    VENDOR_CLASS = 16,
    VENDOR_OPTS = 17,
    INTERFACE_ID = 18,
    RECONF_MSG = 19,
    RECONF_ACCEPT = 20,
  };
 enum DHCP6_STATUSES
  {
    SUCCESS = 0,
    UNSPEC_FAIL = 1,
    NOADDR_AVAIL=2,
    NO_BINDING  = 3,
    NOT_ON_LINK = 4,
    USE_MULTICAST =5
  };
 static struct option longopts[] = {
  {"ip", required_argument, 0, 'a' },
  {"server-id", required_argument, 0, 's' },
  {"client-id", required_argument, 0, 'c' },
  {"iface", required_argument, 0, 'n' },
  {"iaid", required_argument, 0, 'i' },
  {"dry-run", no_argument, 0, 'd' },
  {"help", no_argument, 0, 'h' },
  {0,     0,           0,   0 }
 };
 const short DHCP6_CLIENT_PORT = 546;
 const short DHCP6_SERVER_PORT = 547;
 const char*  DHCP6_MULTICAST_ADDRESS = "ff02::1:2";
 struct dhcp6_option {
  uint16_t type;
  uint16_t len;
  char  value[1024];
 };
 struct dhcp6_iaaddr_option {
  uint16_t type;
  uint16_t len;
  struct in6_addr ip;
  uint32_t preferred_lifetime;
  uint32_t valid_lifetime;
 };
 struct dhcp6_iana_option {
  uint16_t type;
  uint16_t len;
  uint32_t iaid;
  uint32_t t1;
  uint32_t t2;
  char options[1024];
 };
 struct dhcp6_packet {
  size_t len;
  char buf[2048];  
 };
 size_t pack_duid(const char* str, char* dst)
 {
  char* tmp = strdup(str);
  char* tmp_to_free = tmp;
  char *ptr;
  uint8_t write_pos = 0;
  while ((ptr = strtok (tmp, ":")))
    {
      dst[write_pos] = (uint8_t) strtol(ptr, NULL, 16);
      write_pos += 1;
      tmp = NULL;
    }
  free(tmp_to_free);
  return write_pos;
 }
 struct dhcp6_option create_client_id_option(const char* duid)
 {
  struct dhcp6_option option;
  option.type = htons(CLIENTID);
  bzero(option.value, sizeof(option.value));
  option.len  = htons(pack_duid(duid, option.value));
  return option;
 }
 struct dhcp6_option create_server_id_option(const char* duid)
 {
  struct dhcp6_option   option;
  option.type = htons(SERVERID);
  bzero(option.value, sizeof(option.value));
  option.len  = htons(pack_duid(duid, option.value));
  return option;
 }
 struct dhcp6_iaaddr_option create_iaadr_option(const char* ip)
 {
  struct dhcp6_iaaddr_option result;
  result.type =htons(IAADDR);
  /* no suboptions needed here, so length is 24  */
  result.len = htons(24);
  result.preferred_lifetime = 0;
  result.valid_lifetime = 0;
  int s = inet_pton(AF_INET6, ip, &(result.ip));
  if (s <= 0) {
    if (s == 0)
      fprintf(stderr, "Not in presentation format");
    else
      perror("inet_pton");
    exit(EXIT_FAILURE);
  }
  return result;
 }
 struct dhcp6_iana_option  create_iana_option(const char * iaid, struct dhcp6_iaaddr_option  ia_addr)
 {
  struct dhcp6_iana_option  result;
  result.type = htons(IA_NA);
  result.iaid = htonl(atoi(iaid));
  result.t1 = 0;
  result.t2 = 0;
  result.len = htons(12 + ntohs(ia_addr.len) + 2 * sizeof(uint16_t));
  memcpy(result.options, &ia_addr, ntohs(ia_addr.len) + 2 * sizeof(uint16_t));
  return result;
 }
 struct dhcp6_packet create_release_packet(const char* iaid, const char* ip, const char* client_id, const char* server_id)
 {
  struct dhcp6_packet result;
  bzero(result.buf, sizeof(result.buf));
  /* message_type */
  result.buf[0] = RELEASE;
  /* tx_id */
  bzero(result.buf+1, 3);
  struct dhcp6_option client_option = create_client_id_option(client_id);
  struct dhcp6_option server_option = create_server_id_option(server_id);
  struct dhcp6_iaaddr_option iaaddr_option = create_iaadr_option(ip);
  struct dhcp6_iana_option iana_option = create_iana_option(iaid, iaaddr_option);
  int offset = 4;
  memcpy(result.buf + offset, &client_option, ntohs(client_option.len) + 2*sizeof(uint16_t));
  offset += (ntohs(client_option.len)+ 2 *sizeof(uint16_t) );
  memcpy(result.buf + offset, &server_option, ntohs(server_option.len) + 2*sizeof(uint16_t) );
  offset += (ntohs(server_option.len)+ 2* sizeof(uint16_t));
  memcpy(result.buf + offset, &iana_option, ntohs(iana_option.len) + 2*sizeof(uint16_t) );
  offset += (ntohs(iana_option.len)+ 2* sizeof(uint16_t));
  result.len = offset;
  return result;
 }
 uint16_t parse_iana_suboption(char* buf, size_t len)
 {
  size_t current_pos = 0;
  char option_value[1024];
  while (current_pos < len)
    {
      uint16_t option_type, option_len;
      memcpy(&option_type,buf + current_pos, sizeof(uint16_t));
      memcpy(&option_len,buf + current_pos + sizeof(uint16_t), sizeof(uint16_t));
      option_type = ntohs(option_type);
      option_len = ntohs(option_len);
      current_pos += 2 * sizeof(uint16_t);
      if (option_type == STATUS_CODE)
 	{
 	  uint16_t status;
 	  memcpy(&status, buf + current_pos, sizeof(uint16_t));
 	  status = ntohs(status);
 	  if (status != SUCCESS)
 	    {
 	      memcpy(option_value, buf + current_pos + sizeof(uint16_t) , option_len - sizeof(uint16_t));
 	      option_value[option_len-sizeof(uint16_t)] ='\0';
 	      fprintf(stderr, "Error: %s\n", option_value);
            }
 	  return status;
        }
    }
  return -2;
 }
 int16_t parse_packet(char* buf, size_t len)
 {
  int16_t ret = -1;
  uint8_t type = buf[0];
  /*skipping tx id. you need it, uncomment following line
    uint16_t tx_id = ntohs((buf[1] <<16) + (buf[2] <<8) + buf[3]);
  */
  size_t current_pos = 4;
  if (type != REPLY )
    return NOT_REPLY_CODE;
  char option_value[1024];
  while (current_pos < len)
    {
      uint16_t option_type, option_len;
      memcpy(&option_type,buf + current_pos, sizeof(uint16_t));
      memcpy(&option_len,buf + current_pos + sizeof(uint16_t), sizeof(uint16_t));
      option_type = ntohs(option_type);
      option_len = ntohs(option_len);
      current_pos += 2 * sizeof(uint16_t);
      if (option_type == STATUS_CODE)
 	{
 	  uint16_t status;
 	  memcpy(&status, buf + current_pos, sizeof(uint16_t));
 	  status = ntohs(status);
 	  if (status != SUCCESS)
 	    {
 	      memcpy(option_value, buf + current_pos +sizeof(uint16_t) , option_len -sizeof(uint16_t));
 	      fprintf(stderr, "Error: %d %s\n", status, option_value);
 	      return status;
 	    }
 	  /* Got success status, return that if there's no specific error in an IA_NA. */
 	  ret = SUCCESS;   
        }
      if (option_type == IA_NA )
 	{
 	  uint16_t result = parse_iana_suboption(buf + current_pos +24, option_len -24);
 	  if (result)
 	    return result;
 	}
      current_pos += option_len;
    }
  return ret;
 }
 void usage(const char* arg, FILE* stream)
 {
  const char* usage_string ="--ip IPv6 --iface IFACE --server-id SERVER_ID --client-id CLIENT_ID --iaid IAID [--dry-run] | --help";
  fprintf (stream, "Usage: %s %s\n", arg, usage_string);   
 }
 int send_release_packet(const char* iface, struct dhcp6_packet* packet)
 {
  struct sockaddr_in6 server_addr, client_addr;
  char response[1400];
  int sock = socket(PF_INET6, SOCK_DGRAM, 0);
  int i = 0;
  if (sock < 0)
    {
      perror("creating socket");
      return -1;
    }
    if (setsockopt(sock, SOL_SOCKET, 25, iface, strlen(iface)) == -1)
      {
        perror("SO_BINDTODEVICE");
        close(sock);
        return -1;
      }
    memset(&server_addr, 0, sizeof(server_addr));
    server_addr.sin6_family = AF_INET6;
    client_addr.sin6_family = AF_INET6;
    client_addr.sin6_port = htons(DHCP6_CLIENT_PORT);
    client_addr.sin6_flowinfo = 0;
    client_addr.sin6_scope_id =0;
    inet_pton(AF_INET6, "::", &client_addr.sin6_addr);
    bind(sock, (struct sockaddr*)&client_addr, sizeof(struct sockaddr_in6));
    inet_pton(AF_INET6, DHCP6_MULTICAST_ADDRESS, &server_addr.sin6_addr);
    server_addr.sin6_port = htons(DHCP6_SERVER_PORT);
    int16_t recv_size = 0;
    for (i = 0; i < 5; i++)
      {
        if (sendto(sock, packet->buf, packet->len, 0, (struct sockaddr *)&server_addr, sizeof(server_addr)) < 0)
 	  {
 	    perror("sendto failed");
            exit(4);
 	  }
        recv_size = recvfrom(sock, response, sizeof(response), MSG_DONTWAIT, NULL, 0);
        if (recv_size == -1)
 	  {
            if (errno == EAGAIN)
 	      {
 		sleep(1);
 		continue;
 	      }
 	    else
 	      {
                perror("recvfrom");
 	      }
 	  }
        int16_t result = parse_packet(response, recv_size);
        if (result == NOT_REPLY_CODE)
 	  {
            sleep(1);
            continue;
 	  }
        close(sock);
        return result;
      }
    close(sock);
    fprintf(stderr, "Response timed out\n");
    return -1;   
 }
 int main(int argc, char *  const argv[])
 {
  const char* UNINITIALIZED = "";
  const char* iface = UNINITIALIZED;
  const char* ip = UNINITIALIZED;
  const char* client_id = UNINITIALIZED;
  const char* server_id = UNINITIALIZED;
  const char* iaid = UNINITIALIZED;
  int dry_run = 0;
  while (1)
    {
      int option_index = 0;
      int c = getopt_long(argc, argv, "a:s:c:n:i:hd", longopts, &option_index);
      if (c == -1)
 	break;
      switch(c)
 	{
 	case 0:
 	  if (longopts[option_index].flag !=0)
 	    break;
 	  printf ("option %s", longopts[option_index].name);
 	  if (optarg)
 	    printf (" with arg %s", optarg);
 	  printf ("\n");
 	  break;
 	case 'i':
 	  iaid = optarg;
 	  break;
 	case 'n':
 	  iface = optarg;
 	  break;
 	case 'a':
 	  ip = optarg;
 	  break;
 	case 'c':
 	  client_id = optarg;
 	  break;
 	case 'd':
 	  dry_run = 1;
 	  break;
 	case 's':
 	  server_id = optarg;
 	  break;
 	case 'h':
 	  usage(argv[0], stdout);
 	  return 0;
 	case '?':
 	  usage(argv[0], stderr);
 	  return -1;
 	default:
 	  abort();
        }
    }
  if (iaid == UNINITIALIZED)
    {
      fprintf(stderr, "Missing required iaid parameter\n");
      usage(argv[0], stderr);
      return -1;
    }
    if (server_id == UNINITIALIZED)
      {
        fprintf(stderr, "Missing required server-id parameter\n");
        usage(argv[0], stderr);
        return -1;
      }
    if (client_id == UNINITIALIZED)
      {
        fprintf(stderr, "Missing required client-id parameter\n");
        usage(argv[0], stderr);
        return -1;
      }
    if (ip == UNINITIALIZED)
      {
        fprintf(stderr, "Missing required ip parameter\n");
        usage(argv[0], stderr);
        return -1;
      }
    if (iface == UNINITIALIZED)
      {
 	fprintf(stderr, "Missing required iface parameter\n");
        usage(argv[0], stderr);
        return -1;
      }
    struct dhcp6_packet packet = create_release_packet(iaid, ip, client_id, server_id);
    if (dry_run)
      {
        uint16_t i;
        for(i=0; i<packet.len; i++)
 	  printf("%hhx", packet.buf[i]);
        printf("\n");
        return 0;
      }
    return send_release_packet(iface, &packet);
 }
@@ -0,0 +1,36 @@
 #!/bin/bash
 STATUS_FILE="/tmp/dnsmasq-ip-mac.status"
 # Script for dnsmasq lease-change hook.
 # Maintains the above file with an IP address/MAC address pairs,
 # one lease per line. Works with IPv4 and IPv6 leases, file is
 # atomically updated, so no races for users of the data.
 action="$1"
 mac="$2"   # IPv4
 ip="$3"
 # ensure it always exists.
 if [ ! -f "$STATUS_FILE" ]; then
  touch "$STATUS_FILE"
 fi
 if [  -n "$DNSMASQ_IAID" ]; then
    mac="$DNSMASQ_MAC"   # IPv6
 fi
 # worry about an add or old action when the MAC address is not known:
 # leave any old one in place in that case.
 if [ "$action" = "add" -o "$action" = "old" -o "$action" = "del" ]; then
  if [ -n "$mac" -o "$action" = "del" ]; then
    sed "/^${ip//./\.} / d" "$STATUS_FILE" > "$STATUS_FILE".new
    if [ "$action" = "add" -o "$action" = "old" ]; then
       echo "$ip $mac" >> "$STATUS_FILE".new
    fi
    mv  "$STATUS_FILE".new "$STATUS_FILE" # atomic update.
  fi
 fi
@@ -34,11 +34,21 @@ if [ ${DNSMASQ_OLD_HOSTNAME} ] && [ ${action} = old ] ; then
    hostname=${DNSMASQ_OLD_HOSTNAME}
 fi
 # IPv6 leases are not our concern. no NAT there!
 if [ ${DNSMASQ_IAID} ] ; then
   exit 0
 fi
 # action init is not relevant, and will only be seen when leasefile-ro is set.
 if [ ${action} = init ] ; then
    exit 0
 fi
 # action tftp is not relevant.
 if [ ${action} = tftp ] ; then
    exit 0
 fi
 if [ ${hostname} ]; then
    ports=$(sed -n -e "/^${hostname}\ .*/ s/^.* //p" ${PORTSFILE})
@@ -3,7 +3,7 @@
 # first column of this file, then a DNAT port-forward will be set up 
 # to the address which has just been allocated by DHCP . The second field 
 # is port number(s). If there is only one, then the port-forward goes to 
-# the same port on the DHCP-client, if there are two seperated with a 
+# the same port on the DHCP-client, if there are two separated with a 
 # colon, then the second number is the port to which the connection 
 # is forwarded on the DHCP-client. By default, forwarding is set up 
 # for TCP, but it can done for UDP instead by prefixing the port to "u". 
@@ -23,6 +23,6 @@
 # will port forward port 53 UDP and TCP from this host to port 53 on dnsserver.
 #
 # Port forwards will recreated when dnsmasq restarts after a reboot, and
-# removed when DHCP leases expire. After editing this file, restart dnsmasq 
+# removed when DHCP leases expire. After editing this file, send
-# to install new iptables entries in the kernel.
+# SIGHUP to dnsmasq to install new iptables entries in the kernel.
@@ -0,0 +1,18 @@
 The script reads stdin and replaces all IP addresses with names before
 outputting it again. IPs from private networks are reverse looked  up
 via dns. Other IP addresses are searched for in the dnsmasq query log.
 This gives names (CNAMEs if I understand DNS correctly) that are closer
 to the name the client originally asked for then the names obtained by
 reverse lookup. Just run
 netstat -n -4 | ./reverse_replace.sh 
 to see what it does. It needs 
 log-queries
 log-facility=/var/log/dnsmasq.log
 in the dnsmasq configuration.
 The script runs on debian (with dash installed) and on busybox.
@@ -0,0 +1,125 @@
 #!/bin/dash
 # $Id: reverse_replace.sh 18 2015-03-01 16:12:35Z jo $
 #
 # Usage e.g.: netstat -n -4 | reverse_replace.sh 
 # Parses stdin for IP4 addresses and replaces them 
 # with names retrieved by parsing the dnsmasq log.
 # This currently only gives CNAMEs. But these 
 # usually tell you more than the ones from reverse 
 # lookups. 
 #
 # This has been tested on debian and asuswrt. Please
 # report successful tests on other platforms.
 #
 # Author: Joachim Zobel <jz-2014@heute-morgen.de>
 # License: Consider this MIT style licensed. You can 
 #   do as you ike, but you must not remove my name.
 #
 LOG=/var/log/dnsmasq.log
 MAX_LINES=15000
 # sed regex do match IPs
 IP_regex='[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'
 # private IP ranges
 IP_private='\(^127\.\)\|\(^192\.168\.\)\|\(^10\.\)\|\(^172\.1[6-9]\.\)\|\(^172\.2[0-9]\.\)\|\(^172\.3[0-1]\.\)'
 #######################################################################
 # Find Commands
 HOST=nslookup
 if type host > /dev/null 2>&1; then
  # echo "No need for nslookup, host is there"
  HOST=host
 fi
 #######################################################################
 # Functions
 # Use shell variables for an (IP) lookup table
 create_lookup_table()
 {
  # Parse log into lookup table
  local CMDS="$( tail -"$MAX_LINES" "$LOG" | \
    grep " is $IP_regex" | \
    sed "s#.* \([^ ]*\) is \($IP_regex\).*#set_val \2 \1;#" )"
  local IFS='
 '
  for CMD in $CMDS
  do
    eval $CMD
  done
 }
 set_val()
 {
  local _IP=$(echo $1 | tr . _)
  local KEY="__IP__$_IP"
  eval "$KEY"=$2
 }
 get_val()
 {
  local _IP=$(echo $1 | tr . _)
  local KEY="__IP__$_IP"
  eval echo -n '${'"$KEY"'}'
 }
 dns_lookup()
 {
  local IP=$1
  local RTN="$($HOST $IP | \
        sed 's#\s\+#\n#g' | \
        grep -v '^$' | \
        tail -1 | tr -d '\n' | \
        sed 's#\.$##')"
  if echo $RTN | grep -q NXDOMAIN; then
    echo -n $IP
  else
    echo -n "$RTN"
  fi     
 }
 reverse_dns()
 {
  local IP=$1
  # Skip if it is not an IP
  if ! echo $IP | grep -q "^$IP_regex$"; then
    echo -n $IP
    return 
  fi
  # Do a dns lookup, if it is a local IP
  if echo $IP | grep -q $IP_private; then
    dns_lookup $IP
    return
  fi
  local NAME="$(get_val $IP)"
  if [ -z "$NAME" ]; then
    echo -n $IP
  else
    echo -n $NAME
  fi
 }
 #######################################################################
 # Main
 create_lookup_table
 while read LINE; do
  for IP in $(echo "$LINE" | \
              sed "s#\b\($IP_regex\)\b#\n\1\n#g" | \
              grep $IP_regex) 
  do
    NAME=`reverse_dns $IP `
    # echo "$NAME $IP"
    LINE=`echo "$LINE" | sed "s#$IP#$NAME#" ` 
  done
  echo $LINE
 done
@@ -0,0 +1,35 @@
 #!/bin/sh
 # Contributed by Darren Hoo <darren.hoo@gmail.com>
 # If you use dnsmasq as DHCP server on a router, you may have
 # met with attackers trying ARP Poison Routing (APR) on your
 # local area network. This script will setup a 'permanent' entry
 # in the router's ARP table upon each DHCP transaction so as to
 # make the attacker's efforts less successful.
 # Usage:
 # edit /etc/dnsmasq.conf and specify the path of this script
 # to  dhcp-script, for example:
 #  dhcp-script=/usr/sbin/static-arp
 # if $1 is add or old, update the static arp table entry.
 # if $1 is del, then delete the entry from the table
 # if $1 is init which is called by dnsmasq at startup, it's ignored
 ARP=/usr/sbin/arp
 # Arguments.
 # $1 is action (add, del, old)
 # $2 is MAC
 # $3 is address
 # $4 is hostname (optional, may be unset)
 if [ ${1} = del ] ; then
         ${ARP} -d $3
 fi
 if [ ${1} = old ] || [ ${1} = add ] ; then
         ${ARP} -s $3 $2
 fi
@@ -0,0 +1,16 @@
 Hello,
 I created a systemd service file for dnsmasq.
 systemd is a sysvinit replacement (see [1] for more information).
 One of the goals of systemd is to encourage standardization between different
 distributions. This means, while I also submitted a ticket in Debian GNU/Linux,
 I would like to ask you to accept this service file as the upstream
 distributor, so that other distributions can use the same service file and
 don’t have to ship their own.
 Please include this file in your next release (just like in init script).
 [1] http://en.wikipedia.org/wiki/Systemd
@@ -0,0 +1,57 @@
 To: dnsmasq-discuss@lists.thekelleys.org.uk
 From: Alex Elsayed <eternaleye+usenet@gmail.com>
 Date: Tue, 15 May 2012 01:53:54 -0700
 Subject: [Dnsmasq-discuss] [PATCH] Support dbus activation
 Introduce dbus service file and turn dbus on in the systemd
 unit.
 Note to packagers:
 To add support for dbus activation, you must install the dbus
 service file (dbus/uk.org.thekelleys.dnsmasq.service) into
 $DATADIR/dbus-1/system-services.
 ---
 contrib/systemd/dnsmasq.service        |    2 +-
 dbus/uk.org.thekelleys.dnsmasq.service |    7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 dbus/uk.org.thekelleys.dnsmasq.service
 diff --git a/contrib/systemd/dnsmasq.service 
 b/contrib/systemd/dnsmasq.service
 index a27fe6d..4a784d3 100644
 --- a/contrib/systemd/dnsmasq.service
 +++ b/contrib/systemd/dnsmasq.service
@@ -5,7 +5,7 @@ Description=A lightweight DHCP and caching DNS server
 Type=dbus
 BusName=uk.org.thekelleys.dnsmasq
 ExecStartPre=/usr/sbin/dnsmasq --test
 -ExecStart=/usr/sbin/dnsmasq -k
 +ExecStart=/usr/sbin/dnsmasq -k -1
 ExecReload=/bin/kill -HUP $MAINPID
 [Install]
 diff --git a/dbus/uk.org.thekelleys.dnsmasq.service 
 b/dbus/uk.org.thekelleys.dnsmasq.service
 new file mode 100644
 index 0000000..f5fe98d
 --- /dev/null
 +++ b/dbus/uk.org.thekelleys.dnsmasq.service
@@ -0,0 +1,7 @@
 +[D-BUS Service]
 +Name=uk.org.thekelleys.dnsmasq
 +Exec=/usr/sbin/dnsmasq -k -1
 +User=root
 +SystemdService=dnsmasq.service
 +
 +
 -- 
 1.7.10.2
 _______________________________________________
 Dnsmasq-discuss mailing list
 Dnsmasq-discuss@lists.thekelleys.org.uk
 http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
@@ -0,0 +1,15 @@
 [Unit]
 Description=dnsmasq - A lightweight DHCP and caching DNS server
 After=network.target
 Before=network-online.target nss-lookup.target
 Wants=nss-lookup.target
 [Service]
 Type=dbus
 BusName=uk.org.thekelleys.dnsmasq
 ExecStartPre=/usr/sbin/dnsmasq --test
 ExecStart=/usr/sbin/dnsmasq -k
 ExecReload=/bin/kill -HUP $MAINPID
 [Install]
 WantedBy=multi-user.target
@@ -0,0 +1,19 @@
 Date: Thu, 07 Dec 2006 00:41:43 -0500
 From: Bob Carroll <bob.carroll@rit.edu>
 Subject: dnsmasq suggestion
 To: simon@thekelleys.org.uk
 Hello,
 I recently needed a feature in dnsmasq for a very bizarre situation. I 
 placed a list of name servers in a special resolve file and told dnsmasq 
 to use that. But I wanted it to try requests in order and treat NXDOMAIN 
 requests as a failed tcp connection. I wrote the feature into dnsmasq 
 and it seems to work. I prepared a patch in the event that others might 
 find it useful as well.
 Thanks and keep up the good work.
 --Bob
@@ -0,0 +1,11 @@
 A remake of patch Bob Carroll had posted to dnsmasq,
 now compatible with version 2.47. Hopefully he doesn't 
 mind (sending a copy of this mail to him too).
 Maybe the patch in question is not acceptable
 as it doesn't add new switch, rather it binds itself to "strict-order".
 What it does is: if you have strict-order in the 
 dnsmasq config file and query a domain that would result 
 in NXDOMAIN, it iterates the whole given nameserver list 
 until the last one says NXDOMAIN.
@@ -0,0 +1,10 @@
 Hi,
 I updated the try-all-ns patch to work with the latest version of git. Ended up implementing it on top of master, 2.78test2-7-g63437ff. As that specific if-clause has been changed in the last few commits, it's not compatible for 2.77, sadly.
 Find the patch attached.
 Regards,
 Rasmus Ahlberg
 Software Developer, R&D
 Electrolux Small Appliances
@@ -0,0 +1,61 @@
 diff -Nau dnsmasq-2.35/src/dnsmasq.h dnsmasq/src/dnsmasq.h
 --- dnsmasq-2.35/src/dnsmasq.h	2006-10-18 16:24:50.000000000 -0400
 +++ dnsmasq/src/dnsmasq.h	2006-11-16 22:06:31.000000000 -0500
@@ -112,6 +112,7 @@
 #define OPT_NO_PING        2097152
 #define OPT_LEASE_RO       4194304
 #define OPT_RELOAD         8388608
 +#define OPT_TRY_ALL_NS     16777216
 struct all_addr {
   union {
 diff -Nau dnsmasq-2.35/src/forward.c dnsmasq/src/forward.c
 --- dnsmasq-2.35/src/forward.c	2006-10-18 16:24:50.000000000 -0400
 +++ dnsmasq/src/forward.c	2006-11-16 22:08:19.000000000 -0500
@@ -445,6 +445,10 @@
     {
        struct server *server = forward->sentto;
 +       // If strict-order and try-all-ns are set, treat NXDOMAIN as a failed request
 +       if( (daemon->options & OPT_ORDER) && (daemon->options && OPT_TRY_ALL_NS)
 +           && header->rcode == NXDOMAIN ) header->rcode = SERVFAIL;
 +
        if ((header->rcode == SERVFAIL || header->rcode == REFUSED) && forward->forwardall == 0)
 	 /* for broken servers, attempt to send to another one. */
 	 {
 diff -Nau dnsmasq-2.35/src/option.c dnsmasq/src/option.c
 --- dnsmasq-2.35/src/option.c	2006-10-18 16:24:50.000000000 -0400
 +++ dnsmasq/src/option.c	2006-11-16 22:10:36.000000000 -0500
@@ -28,7 +28,7 @@
 /* options which don't have a one-char version */
 #define LOPT_RELOAD 256
 -
 +#define LOPT_TRY_ALL_NS 257
 #ifdef HAVE_GETOPT_LONG
 static const struct option opts[] =  
@@ -102,6 +102,7 @@
     {"leasefile-ro", 0, 0, '9'},
     {"dns-forward-max", 1, 0, '0'},
     {"clear-on-reload", 0, 0, LOPT_RELOAD },
 +    {"try-all-ns", 0, 0, LOPT_TRY_ALL_NS },
     { NULL, 0, 0, 0 }
   };
@@ -134,6 +135,7 @@
   { '5',            OPT_NO_PING },
   { '9',            OPT_LEASE_RO },
   { LOPT_RELOAD,    OPT_RELOAD },
 +  { LOPT_TRY_ALL_NS,OPT_TRY_ALL_NS },
   { 'v',            0},
   { 'w',            0},
   { 0, 0 }
@@ -208,6 +210,7 @@
   { "-9, --leasefile-ro", gettext_noop("Read leases at startup, but never write the lease file."), NULL },
   { "-0, --dns-forward-max=<queries>", gettext_noop("Maximum number of concurrent DNS queries. (defaults to %s)"), "!" }, 
   { "    --clear-on-reload", gettext_noop("Clear DNS cache when reloading %s."), RESOLVFILE },
 +  { "    --try-all-ns", gettext_noop("Try all name servers in tandem on NXDOMAIN replies (use with strict-order)."), NULL },
   { NULL, NULL, NULL }
 }; 
@@ -0,0 +1,17 @@
 diff -ur dnsmasq-2.47/src/forward.c dnsmasq-2.47-patched/src/forward.c
 --- dnsmasq-2.47/src/forward.c	2009-02-01 17:59:48.000000000 +0200
 +++ dnsmasq-2.47-patched/src/forward.c	2009-03-18 19:10:22.000000000 +0200
@@ -488,9 +488,12 @@
     return;
   server = forward->sentto;
 +
 +  if ( (header->rcode == NXDOMAIN) && ((daemon->options & OPT_ORDER) != 0) && (server->next != NULL) )
 +    header->rcode = SERVFAIL;
   if ((header->rcode == SERVFAIL || header->rcode == REFUSED) &&
 -      !(daemon->options & OPT_ORDER) &&
 +      ((daemon->options & OPT_ORDER) != 0) &&
       forward->forwardall == 0)
     /* for broken servers, attempt to send to another one. */
     {
@@ -0,0 +1,29 @@
 From: Jesse Glick <jglick@cloudbees.com>
 To: dnsmasq-discuss@lists.thekelleys.org.uk
 Subject: Re: [Dnsmasq-discuss] Ability to delegate to one server but fall
 back to another after NXDOMAIN?
 On Wed, Jan 15, 2014 at 12:30 PM, Simon Kelley <simon@thekelleys.org.uk> wrote:
 > > There's a (very old) patch in contrib/try-all-ns that would make a starting point
 This does not apply against trunk, so I tried to rework it. The
 following appears to do what I expect:
 diff --git a/src/forward.c b/src/forward.c
 index 8167229..76070b5 100644
 --- a/src/forward.c
 +++ b/src/forward.c
@@ -610,7 +610,11 @@ void reply_query(int fd, int family, time_t now)
   if ((RCODE(header) == SERVFAIL || RCODE(header) == REFUSED) &&
       !option_bool(OPT_ORDER) &&
 -      forward->forwardall == 0)
 +      forward->forwardall == 0 ||
 +      /* try each in turn */
 +      RCODE(header) == NXDOMAIN &&
 +      option_bool(OPT_ORDER) &&
 +      server->next != NULL)
     /* for broken servers, attempt to send to another one. */
     {
       unsigned char *pheader;
@@ -0,0 +1,20 @@
 diff --git a/src/forward.c b/src/forward.c
 index e3fa94b..ecf3b98 100644
 --- a/src/forward.c
 +++ b/src/forward.c
@@ -789,9 +789,12 @@ void reply_query(int fd, int family, time_t now)
   /* Note: if we send extra options in the EDNS0 header, we can't recreate
      the query from the reply. */
 -  if (RCODE(header) == REFUSED &&
 -      forward->forwardall == 0 &&
 -      !(forward->flags & FREC_HAS_EXTRADATA))
 +  if ((RCODE(header) == REFUSED &&
 +        forward->forwardall == 0 &&
 +       !(forward->flags & FREC_HAS_EXTRADATA)) ||
 +      /* If strict-order is set, try next server on NXDOMAIN reply */
 +      (RCODE(header) == NXDOMAIN && option_bool(OPT_ORDER) &&
 +       server->next != NULL))
     /* for broken servers, attempt to send to another one. */
     {
       unsigned char *pheader;
@@ -1,5 +1,5 @@
-This is the README for the DNSmasq webmin module.
+This is the README for the Dnsmasq webmin module.
 Problems:
@@ -48,7 +48,7 @@ wade through the config file and man pages again.
 If you modify it, or add a language file, and you have a spare moment,
 please e-mail me - I won't be upset at all if you fix my poor coding!
-(rather the opposite - I'd be pleased someone found it usefull)
+(rather the opposite - I'd be pleased someone found it useful)
 Cheers,
 	Neil Fisher <neil@magnecor.com.au>
@@ -1,7 +0,0 @@
 CFLAGS?= -O2
 all: dhcp_release.c
 	$(CC) $(CFLAGS) $(RPM_OPT_FLAGS) -Wall -W dhcp_release.c -o dhcp_release
 clean:
 	rm -f *~ *.o core dhcp_release
@@ -4,7 +4,7 @@ reboot, then it will eventually be restored as hosts renew their
 leases. Until a host renews (which may take hours/days) it will
 not exist in the DNS if dnsmasq's DDNS function is in use.
-*WRT systems remount all non-volatile fileystems read-only after boot,
+*WRT systems remount all non-volatile filesystems read-only after boot,
 so the normal leasefile will not work. They do, however have NV
 storage, accessed with the nvram command:
@@ -62,7 +62,7 @@ about 100 bytes, so restricting the number of leases to 50 will limit
 use to half that. (The default limit in the distributed source is 150)
 Any UI script which reads the dnsmasq leasefile will have to be
-ammended, probably by changing it to read the output of 
+amended, probably by changing it to read the output of 
 `lease_update init` instead.
@@ -19,7 +19,11 @@ and avoids startup races with the provider of nameserver information.
 Dnsmasq provides one service on the DBus: uk.org.thekelleys.dnsmasq
-and a single object: /uk/org/thekelleys/dnsmasq
+and a single object: /uk/org/thekelleys/dnsmasq 
 The name of the service may be changed by giving an argument to --enable-dbus.
 1. METHODS
 ----------
 Methods are of the form
@@ -36,6 +40,14 @@ ClearCache
 Returns nothing. Clears the domain name cache and re-reads
 /etc/hosts. The same as sending dnsmasq a HUP signal.
 SetFilterWin2KOption
 --------------------
 Takes boolean, sets or resets the --filterwin2k option.
 SetBogusPrivOption
 ------------------
 Takes boolean, sets or resets the --bogus-priv option.
 SetServers
 ----------
 Returns nothing. Takes a set of arguments representing the new
@@ -91,4 +103,184 @@ Each call to SetServers completely replaces the set of servers
 specified by via the DBus, but it leaves any servers specified via the
 command line or /etc/dnsmasq.conf or /etc/resolv.conf alone.
 SetServersEx
 ------------
 This function is more flexible and the SetServers function, in that it can
 handle address scoping, port numbers, and is easier for clients to use.
 Returns nothing. Takes a set of arguments representing the new
 upstream DNS servers to be used by dnsmasq. All addresses (both IPv4 and IPv6)
 are represented as STRINGS.  Each server address may be followed by one or more
 STRINGS, which are the domains for which the preceding server should be used.
 This function takes an array of STRING arrays, where each inner array represents
 a set of DNS servers and domains for which those servers may be used.  Each
 string represents a list of upstream DNS servers first, and domains second.
 Mixing of domains and servers within a the string array is not allowed.
 Examples.
 [
  ["1.2.3.4", "foobar.com"],
  ["1003:1234:abcd::1%eth0", "eng.mycorp.com", "lab.mycorp.com"]
 ]
 is equivalent to
 --server=/foobar.com/1.2.3.4 \
  --server=/eng.mycorp.com/lab.mycorp.com/1003:1234:abcd::1%eth0
 An IPv4 address of 0.0.0.0 is interpreted as "no address, local only",
 so
 [ ["0.0.0.0", "local.domain"] ]
 is equivalent to
 --local=/local.domain/
 Each call to SetServersEx completely replaces the set of servers
 specified by via the DBus, but it leaves any servers specified via the
 command line or /etc/dnsmasq.conf or /etc/resolv.conf alone.
 SetDomainServers
 ----------------
 Yes another variation for setting DNS servers, with the capability of
 SetServersEx, but without using arrays of arrays, which are not
 sendable with dbus-send. The arguments are an array of strings which
 are identical to the equivalent arguments --server, so the example
 for SetServersEx is represented as
 [
  "/foobar.com/1.2.3.4"
  "/eng.mycorp.com/lab.mycorp.com/1003:1234:abcd::1%eth0"
 ]
 GetLoopServers
 --------------
 (Only available if dnsmasq compiled with HAVE_LOOP)
 Return an array of strings, each string is the IP address of an upstream
 server which has been found to loop queries back to this dnsmasq instance, and 
 it therefore not being used.
 AddDhcpLease
 ------------
 Returns nothing. Adds or updates a DHCP or DHCPv6 lease to the internal lease
 database, as if a client requested and obtained a lease.
 If a lease for the IPv4 or IPv6 address already exist, it is overwritten.
 Note that this function will trigger the DhcpLeaseAdded or DhcpLeaseUpdated
 D-Bus signal and will run the configured DHCP lease script accordingly.
 This function takes many arguments which are the lease parameters:
 - A string with the textual representation of the IPv4 or IPv6 address of the
  client.
  Examples:
  "192.168.1.115"
  "1003:1234:abcd::1%eth0"
  "2001:db8:abcd::1"
 - A string representing the hardware address of the client, using the same
  format as the one used in the lease database.
  Examples:
  "00:23:45:67:89:ab"
  "06-00:20:e0:3b:13:af" (token ring)
 - The hostname of the client, as an array of bytes (so there is no problem
  with non-ASCII character encoding). May be empty.
  Example (for "hostname.or.fqdn"):
  [104, 111, 115, 116, 110, 97, 109, 101, 46, 111, 114, 46, 102, 113, 100, 110]
 - The client identifier (IPv4) or DUID (IPv6) as an array of bytes. May be
  empty.
  Examples:
  DHCPv6 DUID:
  [0, 3, 0, 1, 0, 35, 69, 103, 137, 171]
  DHCPv4 client identifier:
  [255, 12, 34, 56, 78, 0, 1, 0, 1, 29, 9, 99, 190, 35, 69, 103, 137, 171]
 - The duration of the lease, in seconds. If the lease is updated, then
  the duration replaces the previous duration.
  Example:
  7200
 - The IAID (Identity association identifier) of the DHCPv6 lease, as a network
  byte-order unsigned integer. For DHCPv4 leases, this must be set to 0.
  Example (for IPv6):
  203569230
 - A boolean which, if true, indicates that the DHCPv6 lease is for a temporary
  address (IA_TA). If false, the DHCPv6 lease is for a non-temporary address
  (IA_NA). For DHCPv4 leases, this must be set to false.
 RemoveDhcpLease
 ---------------
 Returns nothing. Removes a DHCP or DHCPv6 lease to the internal lease
 database, as if a client sent a release message to abandon a lease.
 This function takes only one parameter: the text representation of the
 IPv4 or IPv6 address of the lease to remove.
 Note that this function will trigger the DhcpLeaseRemoved signal and the
 configured DHCP lease script will be run with the "del" action.
 GetMetrics
 ----------
 Returns an array with various metrics for DNS and DHCP.
 2. SIGNALS
 ----------
 If dnsmasq's DHCP server is active, it will send signals over DBUS whenever
 the DHCP lease database changes. Think of these signals as transactions on
 a database with the IP address acting as the primary key.
 Signals are of the form:
 uk.org.thekelleys.<signal>
 and their parameters are:
 STRING "192.168.1.115"
 STRING "01:23:45:67:89:ab"
 STRING "hostname.or.fqdn"
 Available signals are:
 DhcpLeaseAdded
 ---------------
 This signal is emitted when a DHCP lease for a given IP address is created.
 DhcpLeaseDeleted
 ----------------
 This signal is emitted when a DHCP lease for a given IP address is deleted.
 DhcpLeaseUpdated
 ----------------
 This signal is emitted when a DHCP lease for a given IP address is updated.
@@ -5,12 +5,10 @@
 	<policy user="root">
 		<allow own="uk.org.thekelleys.dnsmasq"/>
 		<allow send_destination="uk.org.thekelleys.dnsmasq"/>
                <allow send_interface="uk.org.thekelleys.dnsmasq"/>
 	</policy>
 	<policy context="default">
                <deny own="uk.org.thekelleys.dnsmasq"/>
                <deny send_destination="uk.org.thekelleys.dnsmasq"/>
                <deny send_interface="uk.org.thekelleys.dnsmasq"/>
        </policy>
 </busconfig>
@@ -0,0 +1,5 @@
 /etc/init.d/dnsmasq
 /etc/default/dnsmasq
 /etc/dnsmasq.conf
 /etc/resolvconf/update.d/dnsmasq
 /etc/insserv.conf.d/dnsmasq
@@ -0,0 +1,66 @@
 Source: dnsmasq
 Section: net
 Priority: optional
 Build-depends: gettext, libnetfilter-conntrack-dev [linux-any],
               libidn2-dev, libdbus-1-dev (>=0.61), libgmp-dev, 
               nettle-dev (>=2.4-3), libbsd-dev [kfreebsd-any],
 	       liblua5.2-dev, dh-runit, debhelper-compat (= 10),
               pkg-config
 Maintainer: Simon Kelley <simon@thekelleys.org.uk>
 Homepage: http://www.thekelleys.org.uk/dnsmasq/doc.html
 Vcs-Git: http://thekelleys.org.uk/git/dnsmasq.git
 Vcs-Browser: http://thekelleys.org.uk/gitweb/?p=dnsmasq.git
 Standards-Version: 3.9.8
 Package: dnsmasq
 Architecture: all
 Depends: netbase, dnsmasq-base,
         init-system-helpers (>= 1.18~), lsb-base (>= 3.0-6), ${misc:Depends}
 Suggests: resolvconf
 Breaks: ${runit:Breaks}
 Conflicts: resolvconf (<<1.15), ${runit:Conflicts}
 Description: Small caching DNS proxy and DHCP/TFTP server
 Dnsmasq is a lightweight, easy to configure, DNS forwarder and DHCP
 server. It is designed to provide DNS and optionally, DHCP, to a 
 small network. It can serve the names of local machines which are 
 not in the global DNS. The DHCP server integrates with the DNS 
 server and allows machines with DHCP-allocated addresses
 to appear in the DNS with names configured either in each host or
 in a central configuration file. Dnsmasq supports static and dynamic 
 DHCP leases and BOOTP/TFTP for network booting of diskless machines.
 Package: dnsmasq-base
 Architecture: any
 Depends: adduser, ${shlibs:Depends}
 Breaks: dnsmasq (<< 2.63-1~)
 Replaces: dnsmasq (<< 2.63-1~), dnsmasq-base
 Recommends: dns-root-data
 Provides: dnsmasq-base
 Conflicts: dnsmasq-base-lua
 Description: Small caching DNS proxy and DHCP/TFTP server
 This package contains the dnsmasq executable and documentation, but
 not the infrastructure required to run it as a system daemon. For
 that, install the dnsmasq package.
 Package: dnsmasq-base-lua
 Architecture: any
 Depends: adduser, ${shlibs:Depends}
 Breaks: dnsmasq (<< 2.63-1~)
 Replaces: dnsmasq (<< 2.63-1~), dnsmasq-base
 Recommends: dns-root-data
 Provides: dnsmasq-base
 Conflicts: dnsmasq-base
 Description: Small caching DNS proxy and DHCP/TFTP server
 This package contains the dnsmasq executable and documentation, but
 not the infrastructure required to run it as a system daemon. For
 that, install the dnsmasq package. This package is an alternative
 to dnsmasq-base which includes the LUA interpreter.
 Package: dnsmasq-utils
 Architecture: linux-any
 Depends: ${shlibs:Depends}
 Conflicts: dnsmasq (<<2.40)
 Description: Utilities for manipulating DHCP leases
 Small utilities to query a DHCP server's lease database and
 remove leases from it. These programs are distributed with dnsmasq
 and may not work correctly with other DHCP servers.
@@ -0,0 +1,21 @@
 dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 It was downloaded from: http://www.thekelleys.org.uk/dnsmasq/
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; version 2 dated June, 1991, or
   (at your option) version 3 dated 29 June, 2007.
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
 On Debian GNU/Linux systems, the text of the GNU general public license is 
 available in the file /usr/share/common-licenses/GPL-2 or 
 /usr/share/common-licenses/GPL-3
 The Debian package of dnsmasq was created by Simon Kelley with assistance 
 from Lars Bahner.
@@ -0,0 +1,18 @@
 <!DOCTYPE busconfig PUBLIC
 "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
 <busconfig>
 	<policy user="root">
 		<allow own="uk.org.thekelleys.dnsmasq"/>
 		<allow send_destination="uk.org.thekelleys.dnsmasq"/>
 	</policy>
        <policy user="dnsmasq">
                <allow own="uk.org.thekelleys.dnsmasq"/>
                <allow send_destination="uk.org.thekelleys.dnsmasq"/>
        </policy>
 	<policy context="default">
                <deny own="uk.org.thekelleys.dnsmasq"/>
                <deny send_destination="uk.org.thekelleys.dnsmasq"/>
        </policy>
 </busconfig>
@@ -0,0 +1,42 @@
 # This file has six functions:
 # 1) to completely disable starting this dnsmasq instance
 # 2) to set DOMAIN_SUFFIX by running `dnsdomainname`
 # 3) to select an alternative config file
 #    by setting DNSMASQ_OPTS to --conf-file=<file>
 # 4) to tell dnsmasq to read the files in /etc/dnsmasq.d for
 #    more configuration variables.
 # 5) to stop the resolvconf package from controlling dnsmasq's
 #    idea of which upstream nameservers to use.
 # 6) to avoid using this dnsmasq instance as the system's default resolver
 #    by setting DNSMASQ_EXCEPT="lo"
 # For upgraders from very old versions, all the shell variables set
 # here in previous versions are still honored by the init script
 # so if you just keep your old version of this file nothing will break.
 #DOMAIN_SUFFIX=`dnsdomainname`
 #DNSMASQ_OPTS="--conf-file=/etc/dnsmasq.alt"
 # Whether or not to run the dnsmasq daemon; set to 0 to disable.
 # Note that this is only valid when using SYSV init. For systemd,
 # use "systemctl disable dnsmasq"
 ENABLED=1
 # By default search this drop directory for configuration options.
 # Libvirt leaves a file here to make the system dnsmasq play nice.
 # Comment out this line if you don't want this. The dpkg-* are file
 # endings which cause dnsmasq to skip that file. This avoids pulling
 # in backups made by dpkg.
 CONFIG_DIR=/etc/dnsmasq.d,.dpkg-dist,.dpkg-old,.dpkg-new
 # If the resolvconf package is installed, dnsmasq will use its output
 # rather than the contents of /etc/resolv.conf to find upstream
 # nameservers. Uncommenting this line inhibits this behaviour.
 # Note that including a "resolv-file=<filename>" line in
 # /etc/dnsmasq.conf is not enough to override resolvconf if it is
 # installed: the line below must be uncommented.
 #IGNORE_RESOLVCONF=yes
 # If the resolvconf package is installed, dnsmasq will tell resolvconf
 # to use dnsmasq under 127.0.0.1 as the system's default resolver.
 # Uncommenting this line inhibits this behaviour.
 #DNSMASQ_EXCEPT="lo"
@@ -0,0 +1 @@
 /etc/dbus-1/system.d/dnsmasq.conf
@@ -0,0 +1,24 @@
 #!/bin/sh
 set -e
 # Create the dnsmasq user in dnsmasq-base, so that Dbus doesn't complain.
 # create a user to run as (code stolen from dovecot-common)
 if [ "$1" = "configure" ]; then
  if [ -z "`id -u dnsmasq 2> /dev/null`" ]; then
    adduser --system  --home /var/lib/misc --gecos "dnsmasq" \
            --no-create-home --disabled-password \
            --quiet dnsmasq || true
  fi
  # Make the directory where we keep the pid file - this
  # has to be owned by "dnsmasq" so that the file can be unlinked.
  # This is only actually used by the dnsmasq binary package, not
  # dnsmasq-base, but it's much easier to create it here so that
  # we don't have synchronisation issues with the creation of the
  # dnsmasq user. 
  if [ ! -d /run/dnsmasq ]; then
    mkdir /run/dnsmasq
    chown dnsmasq:nogroup /run/dnsmasq
  fi
 fi
@@ -0,0 +1,11 @@
 #!/bin/sh
 set -e
 if [ purge = "$1" ]; then
   if [ -x "$(command -v deluser)" ]; then
     deluser --quiet --system dnsmasq > /dev/null || true
  else
     echo >&2 "not removing dnsmasq system account because deluser command was not found"
  fi
  rm -rf /run/dnsmasq
 fi
@@ -0,0 +1 @@
 debian/dnsmasq.runscript name=dnsmasq,logscript,presubj
@@ -0,0 +1,5 @@
 #!/bin/sh -eu
 if [ -x /sbin/resolvconf ] ; then
 	/sbin/resolvconf -d lo.dnsmasq
 fi
@@ -0,0 +1,43 @@
 #!/lib/runit/invoke-run
 readonly name=dnsmasq
 readonly daemon=/usr/sbin/dnsmasq
 readonly marker=/usr/share/dnsmasq/installed-marker
 test -e "${marker}" || exec sv down "${name}"
 test -x "${daemon}" || exec sv down "${name}"
 if [ ! "${RESOLV_CONF:-}" ] &&
   [ "${IGNORE_RESOLVCONF:-}" != "yes" ] &&
   [ -x /sbin/resolvconf ]
 then
 	RESOLV_CONF=/run/dnsmasq/resolv.conf
 fi
 # This tells dnsmasq to ignore DNS requests that don't come from a local network.
 # It's automatically ignored if  --interface --except-interface, --listen-address 
 # or --auth-server exist in the configuration, so for most installations, it will
 # have no effect, but for otherwise-unconfigured installations, it stops dnsmasq
 # from being vulnerable to DNS-reflection attacks.
 DNSMASQ_OPTS="${DNSMASQ_OPTS:-} --local-service"
 # If the dns-root-data package is installed, then the trust anchors will be 
 # available in $ROOT_DS, in BIND zone-file format. Reformat as dnsmasq
 # --trust-anchor options.
 ROOT_DS="/usr/share/dns/root.ds"
 if [ -f $ROOT_DS ]; then
    DNSMASQ_OPTS="$DNSMASQ_OPTS `env LC_ALL=C sed -rne "s/^([.a-zA-Z0-9]+)([[:space:]]+[0-9]+)*([[:space:]]+IN)*[[:space:]]+DS[[:space:]]+/--trust-anchor=\1,/;s/[[:space:]]+/,/gp" $ROOT_DS | tr '\n' ' '`"
 fi
 mkdir -p /run/dnsmasq
 chown dnsmasq:nogroup /run/dnsmasq
 [ -x /sbin/restorecon ] && /sbin/restorecon /run/dnsmasq
 exec "${daemon}" \
 	--keep-in-foreground \
 	--log-facility=/dev/stdout \
 	${RESOLV_CONF:+ -r $RESOLV_CONF} \
 	${DNSMASQ_OPTS} \
 	-u dnsmasq
@@ -0,0 +1,325 @@
 #!/bin/sh
 ### BEGIN INIT INFO
 # Provides:       dnsmasq
 # Required-Start: $network $remote_fs $syslog
 # Required-Stop:  $network $remote_fs $syslog
 # Default-Start:  2 3 4 5
 # Default-Stop:   0 1 6
 # Description:    DHCP and DNS server
 ### END INIT INFO
 # Don't exit on error status
 set +e
 PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 DAEMON=/usr/sbin/dnsmasq
 NAME=dnsmasq
 DESC="DNS forwarder and DHCP server"
 INSTANCE="${2}"
 # Most configuration options in /etc/default/dnsmasq are deprecated
 # but still honoured.
 ENABLED=1
 if [ -r /etc/default/${NAME}${INSTANCE:+.${INSTANCE}} ]; then
    . /etc/default/${NAME}${INSTANCE:+.${INSTANCE}}
 fi
 # Get the system locale, so that messages are in the correct language, and the
 # charset for IDN is correct
 if [ -r /etc/default/locale ]; then
    . /etc/default/locale
    export LANG
 fi
 # The following test ensures the dnsmasq service is not started, when the
 # package 'dnsmasq' is removed but not purged, even if the dnsmasq-base
 # package is still in place.
 test -e /usr/share/dnsmasq/installed-marker || exit 0
 test -x ${DAEMON} || exit 0
 # Provide skeleton LSB log functions for backports which don't have LSB functions.
 if [ -f /lib/lsb/init-functions ]; then
    . /lib/lsb/init-functions
 else
    log_warning_msg () {
        echo "${@}."
    }
    log_success_msg () {
        echo "${@}."
    }
    log_daemon_msg () {
        echo -n "${1}: ${2}"
    }
    log_end_msg () {
        if [ "${1}" -eq 0 ]; then
            echo "."
        elif [ "${1}" -eq 255 ]; then
            /bin/echo -e " (warning)."
        else
            /bin/echo -e " failed!"
        fi
    }
 fi
 # RESOLV_CONF:
 # If the resolvconf package is installed then use the resolv conf file
 # that it provides as the default.  Otherwise use /etc/resolv.conf as
 # the default.
 #
 # If IGNORE_RESOLVCONF is set in /etc/default/dnsmasq or an explicit
 # filename is set there then this inhibits the use of the resolvconf-provided
 # information.
 #
 # Note that if the resolvconf package is installed it is not possible to
 # override it just by configuration in /etc/dnsmasq.conf, it is necessary
 # to set IGNORE_RESOLVCONF=yes in /etc/default/dnsmasq.
 if [ ! "${RESOLV_CONF}" ] &&
   [ "${IGNORE_RESOLVCONF}" != "yes" ] &&
   [ -x /sbin/resolvconf ]
 then
    RESOLV_CONF=/run/dnsmasq/resolv.conf
 fi
 for INTERFACE in ${DNSMASQ_INTERFACE}; do
    DNSMASQ_INTERFACES="${DNSMASQ_INTERFACES} -i ${INTERFACE}"
 done
 for INTERFACE in ${DNSMASQ_EXCEPT}; do
    DNSMASQ_INTERFACES="${DNSMASQ_INTERFACES} -I ${INTERFACE}"
 done
 if [ ! "${DNSMASQ_USER}" ]; then
   DNSMASQ_USER="dnsmasq"
 fi
 # This tells dnsmasq to ignore DNS requests that don't come from a local network.
 # It's automatically ignored if --interface --except-interface, --listen-address
 # or --auth-server exist in the configuration, so for most installations, it will
 # have no effect, but for otherwise-unconfigured installations, it stops dnsmasq
 # from being vulnerable to DNS-reflection attacks.
 DNSMASQ_OPTS="${DNSMASQ_OPTS} --local-service"
 # If the dns-root-data package is installed, then the trust anchors will be
 # available in ROOT_DS, in BIND zone-file format. Reformat as dnsmasq
 # --trust-anchor options.
 ROOT_DS="/usr/share/dns/root.ds"
 if [ -f ${ROOT_DS} ]; then
    DNSMASQ_OPTS="$DNSMASQ_OPTS `env LC_ALL=C sed -rne "s/^([.a-zA-Z0-9]+)([[:space:]]+[0-9]+)*([[:space:]]+IN)*[[:space:]]+DS[[:space:]]+/--trust-anchor=\1,/;s/[[:space:]]+/,/gp" $ROOT_DS | tr '\n' ' '`"
 fi
 start()
 {
    # Return
    #   0 if daemon has been started
    #   1 if daemon was already running
    #   2 if daemon could not be started
    # /run may be volatile, so we need to ensure that
    # /run/dnsmasq exists here as well as in postinst
    if [ ! -d /run/dnsmasq ]; then
        mkdir /run/dnsmasq || { [ -d /run/dnsmasq ] || return 2 ; }
        chown dnsmasq:nogroup /run/dnsmasq || return 2
    fi
    [ -x /sbin/restorecon ] && /sbin/restorecon /run/dnsmasq
    start-stop-daemon --start --quiet --pidfile /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid --exec ${DAEMON} --test > /dev/null || return 1
    start-stop-daemon --start --quiet --pidfile /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid --exec ${DAEMON} -- \
        -x /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid \
        ${MAILHOSTNAME:+ -m ${MAILHOSTNAME}} \
        ${MAILTARGET:+ -t ${MAILTARGET}} \
        ${DNSMASQ_USER:+ -u ${DNSMASQ_USER}} \
        ${DNSMASQ_INTERFACES:+ ${DNSMASQ_INTERFACES}} \
        ${DHCP_LEASE:+ -l ${DHCP_LEASE}} \
        ${DOMAIN_SUFFIX:+ -s ${DOMAIN_SUFFIX}} \
        ${RESOLV_CONF:+ -r ${RESOLV_CONF}} \
        ${CACHESIZE:+ -c ${CACHESIZE}} \
        ${CONFIG_DIR:+ -7 ${CONFIG_DIR}} \
        ${DNSMASQ_OPTS:+ ${DNSMASQ_OPTS}} \
        || return 2
 }
 start_resolvconf()
 {
 # If interface "lo" is explicitly disabled in /etc/default/dnsmasq
 # Then dnsmasq won't be providing local DNS, so don't add it to
 # the resolvconf server set.
    for interface in ${DNSMASQ_EXCEPT}; do
        [ ${interface} = lo ] && return
    done
    # Also skip this if DNS functionality is disabled in /etc/dnsmasq.conf
    if grep -qs '^port=0' /etc/dnsmasq.conf; then
        return
    fi
    if [ -x /sbin/resolvconf ] ; then
        echo "nameserver 127.0.0.1" | /sbin/resolvconf -a lo.${NAME}${INSTANCE:+.${INSTANCE}}
    fi
    return 0
 }
 stop()
 {
    # Return
    #   0 if daemon has been stopped
    #   1 if daemon was already stopped
    #   2 if daemon could not be stopped
    #   other if a failure occurred
    start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid --name ${NAME}
 }
 stop_resolvconf()
 {
    if [ -x /sbin/resolvconf ] ; then
        /sbin/resolvconf -d lo.${NAME}${INSTANCE:+.${INSTANCE}}
    fi
    return 0
 }
 status()
 {
    # Return
    #   0 if daemon is running
    #   1 if daemon is dead and pid file exists
    #   3 if daemon is not running
    #   4 if daemon status is unknown
    start-stop-daemon --start --quiet --pidfile /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid --exec ${DAEMON} --test > /dev/null
    case "${?}" in
      0) [ -e "/run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid" ] && return 1 ; return 3 ;;
      1) return 0 ;;
      *) return 4 ;;
    esac
 }
 case "${1}" in
  start)
    test "${ENABLED}" != "0" || exit 0
    log_daemon_msg "Starting ${DESC}" "${NAME}${INSTANCE:+.${INSTANCE}}"
    start
    case "${?}" in
      0)
        log_end_msg 0
        start_resolvconf
        exit 0
        ;;
      1)
        log_success_msg "(already running)"
        exit 0
        ;;
      *)
        log_end_msg 1
        exit 1
        ;;
    esac
    ;;
  stop)
    stop_resolvconf
    if [ "${ENABLED}" != "0" ]; then
        log_daemon_msg "Stopping ${DESC}" "${NAME}${INSTANCE:+.${INSTANCE}}"
    fi
    stop
    RETVAL="${?}"
    if [ "${ENABLED}" = "0" ]; then
        case "${RETVAL}" in
          0) log_daemon_msg "Stopping ${DESC}" "${NAME}${INSTANCE:+.${INSTANCE}}"; log_end_msg 0 ;;
        esac
        exit 0
    fi
    case "${RETVAL}" in
      0) log_end_msg 0 ; exit 0 ;;
      1) log_warning_msg "(not running)" ; exit 0 ;;
      *) log_end_msg 1; exit 1 ;;
    esac
    ;;
  checkconfig)
    ${DAEMON} --test ${CONFIG_DIR:+ -7 ${CONFIG_DIR}} ${DNSMASQ_OPTS:+ ${DNSMASQ_OPTS}} >/dev/null 2>&1
    RETVAL="${?}"
    exit ${RETVAL}
    ;;
  restart|force-reload)
    test "${ENABLED}" != "0" || exit 1
    ${DAEMON} --test ${CONFIG_DIR:+ -7 ${CONFIG_DIR}} ${DNSMASQ_OPTS:+ ${DNSMASQ_OPTS}} >/dev/null 2>&1
    if [ ${?} -ne 0 ]; then
        NAME="configuration syntax check"
        RETVAL="2"
    else
        stop_resolvconf
        stop
        RETVAL="${?}"
    fi
    log_daemon_msg "Restarting ${DESC}" "${NAME}${INSTANCE:+.${INSTANCE}}"
    case "${RETVAL}" in
      0|1)
        sleep 2
        start
        case "${?}" in
          0)
            log_end_msg 0
            start_resolvconf
            exit 0
            ;;
          *)
            log_end_msg 1
            exit 1
            ;;
        esac
        ;;
      *)
        log_end_msg 1
        exit 1
        ;;
    esac
    ;;
  status)
    log_daemon_msg "Checking ${DESC}" "${NAME}${INSTANCE:+.${INSTANCE}}"
    status
    case "${?}" in
      0) log_success_msg "(running)" ; exit 0 ;;
      1) log_success_msg "(dead, pid file exists)" ; exit 1 ;;
      3) log_success_msg "(not running)" ; exit 3 ;;
      *) log_success_msg "(unknown)" ; exit 4 ;;
    esac
    ;;
  dump-stats)
    kill -s USR1 `cat /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid`
    ;;
  systemd-start-resolvconf)
    start_resolvconf
    ;;
  systemd-stop-resolvconf)
    stop_resolvconf
    ;;
  systemd-exec)
    # /run may be volatile, so we need to ensure that
    # /run/dnsmasq exists here as well as in postinst
    if [ ! -d /run/dnsmasq ]; then
        mkdir /run/dnsmasq || { [ -d /run/dnsmasq ] || return 2 ; }
        chown dnsmasq:nogroup /run/dnsmasq || return 2
    fi
    exec ${DAEMON} -x /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid \
        ${MAILHOSTNAME:+ -m ${MAILHOSTNAME}} \
        ${MAILTARGET:+ -t ${MAILTARGET}} \
        ${DNSMASQ_USER:+ -u ${DNSMASQ_USER}} \
        ${DNSMASQ_INTERFACES:+ ${DNSMASQ_INTERFACES}} \
        ${DHCP_LEASE:+ -l ${DHCP_LEASE}} \
        ${DOMAIN_SUFFIX:+ -s ${DOMAIN_SUFFIX}} \
        ${RESOLV_CONF:+ -r ${RESOLV_CONF}} \
        ${CACHESIZE:+ -c ${CACHESIZE}} \
        ${CONFIG_DIR:+ -7 ${CONFIG_DIR}} \
        ${DNSMASQ_OPTS:+ ${DNSMASQ_OPTS}}
    ;;
  *)
    echo "Usage: /etc/init.d/${NAME} {start|stop|restart|force-reload|dump-stats|status}" >&2
    exit 3
    ;;
 esac
 exit 0
@@ -0,0 +1 @@
 $named dnsmasq
@@ -0,0 +1,2 @@
 # This file indicates dnsmasq (and not just dnsmasq-base) is installed.
 # It is an implementation detail of the dnsmasq init script.
@@ -0,0 +1,3 @@
 # dnsmasq-base and dnsmasq-base-lua are mutually exclusive and both
 # provide /usr/share/doc/dnsmasq-base
 dnsmasq-base-lua binary: usr-share-doc-symlink-without-dependency dnsmasq-base
@@ -0,0 +1,41 @@
 #!/bin/sh
 set -e
 # /usr/share/doc/dnsmasq was a symlink in versions < 2.81-1 (see #985282)
 dpkg-maintscript-helper symlink_to_dir /usr/share/doc/dnsmasq dnsmasq-base 2.84-1.2~ dnsmasq -- "$@"
 # Code copied from dh_systemd_enable ----------------------
 # This will only remove masks created by d-s-h on package removal.
 deb-systemd-helper unmask dnsmasq.service >/dev/null || true
 # was-enabled defaults to true, so new installations run enable.
 if deb-systemd-helper --quiet was-enabled dnsmasq.service; then
 	# Enables the unit on first installation, creates new
 	# symlinks on upgrades if the unit file has changed.
 	deb-systemd-helper enable dnsmasq.service >/dev/null || true
 else
 	# Update the statefile to add new symlinks (if any), which need to be
 	# cleaned up on purge. Also remove old symlinks.
 	deb-systemd-helper update-state dnsmasq.service >/dev/null || true
 fi
 # End code copied from dh_systemd_enable ------------------
 if [ -x /etc/init.d/dnsmasq ]; then
   update-rc.d dnsmasq defaults 15 85 >/dev/null
   if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ]; then
      if [ -e /run/dnsmasq/dnsmasq.pid ]; then
          ACTION=restart
      else
          ACTION=start
      fi
      if [ -x /usr/sbin/invoke-rc.d ] ; then
         invoke-rc.d dnsmasq $ACTION || true
      else
         /etc/init.d/dnsmasq $ACTION || true
      fi
   fi
 fi
@@ -0,0 +1,25 @@
 #!/bin/sh
 set -e
 # /usr/share/doc/dnsmasq was a symlink in versions < 2.81-1 (see #985282)
 dpkg-maintscript-helper symlink_to_dir /usr/share/doc/dnsmasq dnsmasq-base 2.84-1.2~ dnsmasq -- "$@"
 if [ purge = "$1" ]; then
   update-rc.d dnsmasq remove >/dev/null
 fi
 # Code copied from dh_systemd_enable ----------------------
 if [ "$1" = "remove" ]; then
 	if [ -x "/usr/bin/deb-systemd-helper" ]; then
 		deb-systemd-helper mask dnsmasq.service >/dev/null
 	fi
 fi
 if [ "$1" = "purge" ]; then
 	if [ -x "/usr/bin/deb-systemd-helper" ]; then
 		deb-systemd-helper purge dnsmasq.service >/dev/null
 		deb-systemd-helper unmask dnsmasq.service >/dev/null
 	fi
 fi
 # End code copied from dh_systemd_enable ------------------
@@ -0,0 +1,5 @@
 #!/bin/sh
 set -e
 # /usr/share/doc/dnsmasq was a symlink in versions < 2.81-1 (see #985282)
 dpkg-maintscript-helper symlink_to_dir /usr/share/doc/dnsmasq dnsmasq-base 2.84-1.2~ dnsmasq -- "$@"
@@ -0,0 +1,14 @@
 #!/bin/sh
 set -e
 if [ "$1" = "remove" ]; then
  if [ -x /usr/sbin/invoke-rc.d ] ; then
      invoke-rc.d dnsmasq stop || true
  else
      /etc/init.d/dnsmasq stop || true
  fi
 fi
 exit 0
@@ -0,0 +1,79 @@
 Notes on configuring dnsmasq as packaged for Debian.
 (1) To configure dnsmasq edit /etc/dnsmasq.conf. The file is well
    commented; see also the dnsmasq.8 man page for explanation of
    the options. The file /etc/default/dnsmasq also exists but it
    shouldn't need to be touched in most cases. To set up DHCP
    options you might need to refer to a copy of RFC 2132. This is 
    available on Debian systems in the package doc-rfc-std as the file
    /usr/share/doc/RFC/draft-standard/rfc2132.txt.gz .
 (2) Installing the dnsmasq package also creates the directory
    /etc/dnsmasq.d which is searched by dnsmasq for configuration file
    fragments. This behaviour can be disabled by editing 
    /etc/default/dnsmasq.
 (3) If the Debian resolvconf package is installed then, regardless
    of what interface configuration daemons are employed, the list of
    nameservers to which dnsmasq should forward queries can be found
    in /var/run/dnsmasq/resolv.conf; also, 127.0.0.1 is listed as the
    first nameserver address in /etc/resolv.conf. This works using the
    default configurations of resolvconf and dnsmasq.
 (4) In the absence of resolvconf, if you are using dhcpcd then
    dnsmasq should read the list of nameservers from the automatically
    generated file /etc/dhcpc/resolv.conf.  You should list 127.0.0.1
    as the first nameserver address in /etc/resolv.conf.
 (5) In the absence of resolvconf, if you are using pppd then
    dnsmasq should read the list of nameservers from the automatically
    generated file /etc/ppp/resolv.conf.  You should list 127.0.0.1
    as the first nameserver address in /etc/resolv.conf.
 (6) In the absence of resolvconf, dns-nameservers lines in 
    /etc/network/interfaces are ignored. If you do not use
    resolvconf, list 127.0.0.1 as the first nameserver address
    in /etc/resolv.conf and configure your nameservers using
    "server=<IP-address>" lines in /etc/dnsmasq.conf.
 (7) If you run multiple DNS servers on a single machine, each
    listening on a different interface, then it is necessary to use 
    the bind-interfaces option by uncommenting "bind-interfaces" in 
    /etc/dnsmasq.conf. This option stops dnsmasq from binding the 
    wildcard address and allows servers listening on port 53 on
    interfaces not in use by dnsmasq to work. The Debian 
    libvirt package will add a configuration file in /etc/dnsmasq.d
    which does this so that the "system" dnsmasq and "private" dnsmasq
    instances started by libvirt do not clash.
 (8) The following options are supported in DEB_BUILD_OPTIONS
      noopt       : compile without optimisation.
      nostrip     : don't remove symbols from binary. 
      nodocs      : omit documentation.
      notftp      : omit TFTP support.
      nodhcp      : omit DHCP support.
      nodhcp6     : omit DHCPv6 support.
      noscript    : omit lease-change script support.
      uselua      : provide support for lease-change scripts written
                    in Lua.
      noipv6      : omit IPv6 support.
      nodbus      : omit DBus support.
      noconntrack : omit connection tracking support. 
      noipset     : omit IPset support.
      nortc       : compile alternate mode suitable for systems without an RTC.
      noi18n      : omit translations and internationalisation support.
      noidn       : omit international domain name support, must be
                    combined with noi18n to be effective.
      gitversion  : set the version of the produced packages from the
                    git-derived versioning information on the source,
                    rather than the debian changelog. 
 (9) Dnsmasq comes as three packages - dnsmasq-utils, dnsmasq-base and
    dnsmasq. Dnsmasq-base provides the dnsmasq executable and
    documentation (including this file). Dnsmasq, which depends on
    dnsmasq-base, provides the init script and configuration
    infrastructure. This file assumes that both are installed. It is
    possible to install only dnsmasq-base and use dnsmasq as a
    non-"system" daemon. Libvirt, for instance, does this.
    Dnsmasq-utils provides the utilities dhcp_release and 
    dhcp_lease_time.
@@ -0,0 +1,7 @@
 # All files in this directory will be read by dnsmasq as 
 # configuration files, except if their names end in 
 # ".dpkg-dist",".dpkg-old" or ".dpkg-new"
 #
 # This can be changed by editing /etc/default/dnsmasq
@@ -0,0 +1,84 @@
 #!/bin/sh
 #
 # Script to update the resolver list for dnsmasq
 #
 # N.B. Resolvconf may run us even if dnsmasq is not (yet) running.
 # If dnsmasq is installed then we go ahead and update the resolver list
 # in case dnsmasq is started later.
 #
 # Assumption: On entry, PWD contains the resolv.conf-type files.
 #
 # This file is part of the dnsmasq package.
 #
 set -e
 RUN_DIR="/run/dnsmasq"
 RSLVRLIST_FILE="${RUN_DIR}/resolv.conf"
 TMP_FILE="${RSLVRLIST_FILE}_new.$$"
 MY_NAME_FOR_RESOLVCONF="dnsmasq"
 [ -x /usr/sbin/dnsmasq ] || exit 0
 [ -x /lib/resolvconf/list-records ] || exit 1
 PATH=/bin:/sbin
 report_err() { echo "$0: Error: $*" >&2 ; }
 # Stores arguments (minus duplicates) in RSLT, separated by spaces
 # Doesn't work properly if an argument itself contains whitespace
 uniquify()
 {
 	RSLT=""
 	while [ "$1" ] ; do
 		for E in $RSLT ; do
 			[ "$1" = "$E" ] && { shift ; continue 2 ; }
 		done
 		RSLT="${RSLT:+$RSLT }$1"
 		shift
 	done
 }
 if [ ! -d "$RUN_DIR" ] && ! mkdir --parents --mode=0755 "$RUN_DIR" ; then
 	report_err "Failed trying to create directory $RUN_DIR"
 	exit 1
 fi
 RSLVCNFFILES=""
 for F in $(/lib/resolvconf/list-records --after "lo.$MY_NAME_FOR_RESOLVCONF") ; do
 	case "$F" in
 	    "lo.$MY_NAME_FOR_RESOLVCONF")
 		# Omit own record	 
 		;;
 	    lo.*)
 		# Include no more records after one for a local nameserver
 		RSLVCNFFILES="${RSLVCNFFILES:+$RSLVCNFFILES }$F"
 		break
 		;;
 	  *)
 		RSLVCNFFILES="${RSLVCNFFILES:+$RSLVCNFFILES }$F"
 		;;
 	esac
 done
 NMSRVRS=""
 if [ "$RSLVCNFFILES" ] ; then
 	uniquify $(sed -n -e 's/^[[:space:]]*nameserver[[:space:]]\+//p' $RSLVCNFFILES)
 	NMSRVRS="$RSLT"
 fi
 # Dnsmasq uses the mtime of $RSLVRLIST_FILE, with a resolution of one second,
 # to detect changes in the file. This means that if a resolvconf update occurs
 # within one second of the previous one then dnsmasq may fail to notice the
 # more recent change. To work around this problem we sleep one second here
 # if necessary in order to ensure that the new mtime is different.
 if [ -f "$RSLVRLIST_FILE" ] && [ "$(ls -go --time-style='+%s' "$RSLVRLIST_FILE" | { read p h s t n ; echo "$t" ; })" = "$(date +%s)" ] ; then
 	sleep 1
 fi
 clean_up() { rm -f "$TMP_FILE" ; }
 trap clean_up EXIT
 : >| "$TMP_FILE"
 for N in $NMSRVRS ; do echo "nameserver $N" >> "$TMP_FILE" ; done
 mv -f "$TMP_FILE" "$RSLVRLIST_FILE"
@@ -0,0 +1,13 @@
 #!/bin/sh
 # Resolvconf packaging event hook script for the dnsmasq package
 restart_dnsmasq() {
    if which invoke-rc.d >/dev/null 2>&1 ; then
        invoke-rc.d dnsmasq restart
    elif [ -x /etc/init.d/dnsmasq ] ; then
        /etc/init.d/dnsmasq restart
    fi
 }
 case "$1" in
  install) restart_dnsmasq ;;
 esac
@@ -0,0 +1,305 @@
 #!/usr/bin/make -f
 # debian/rules file - for dnsmasq.
 # Copyright 2001-2020 by Simon Kelley
 # Based on the sample in the debian hello package which carries the following:
 # Copyright 1994,1995 by Ian Jackson.
 # I hereby give you perpetual unlimited permission to copy,
 # modify and relicense this file, provided that you do not remove
 # my name from the file itself.  (I assert my moral right of
 # paternity under the Copyright, Designs and Patents Act 1988.)
 # This file may have to be extensively modified
 package=dnsmasq-base
 dpkg_buildflags := DEB_BUILD_MAINT_OPTIONS="hardening=+all,+pie,+bindnow" dpkg-buildflags
 CFLAGS = $(shell $(dpkg_buildflags) --get CFLAGS)
 CFLAGS += $(shell $(dpkg_buildflags) --get CPPFLAGS)
 CFLAGS += -Wall -W
 LDFLAGS = $(shell $(dpkg_buildflags) --get LDFLAGS)
 DEB_COPTS = $(COPTS)
 TARGET = install-i18n
 DEB_HOST_ARCH_OS := $(shell dpkg-architecture -qDEB_HOST_ARCH_OS)
 DEB_HOST_GNU_TYPE := $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
 DEB_BUILD_GNU_TYPE := $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
 BUILD_DATE := $(shell dpkg-parsechangelog --show-field Date)
 ifeq ($(origin CC),default)
     CC = $(DEB_HOST_GNU_TYPE)-gcc
 endif
 # Support non-cross-builds on systems without gnu-triplet-binaries for pkg-config.
 ifeq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE))
     PKG_CONFIG=pkg-config
 else
     PKG_CONFIG=$(DEB_HOST_GNU_TYPE)-pkg-config	
 endif
 # Force package version based on git tags.
 ifneq (,$(filter gitversion,$(DEB_BUILD_OPTIONS)))
     PACKAGE_VERSION = $(shell bld/get-version `pwd` |  sed 's/test/~&/; s/[a-z]/~&/;  s/-/./g; s/$$/-1/; s/^/-v/';)
 endif
 ifeq (,$(filter nodbus,$(DEB_BUILD_OPTIONS)))
     DEB_COPTS += -DHAVE_DBUS
 endif
 ifeq (,$(filter noidn, $(DEB_BUILD_OPTIONS)))
 	DEB_COPTS += -DHAVE_LIBIDN2
 endif
 ifeq (,$(filter noconntrack,$(DEB_BUILD_OPTIONS)))
 ifeq ($(DEB_HOST_ARCH_OS),linux)
     DEB_COPTS += -DHAVE_CONNTRACK
 endif
 endif
 ifneq (,$(filter noipset,$(DEB_BUILD_OPTIONS)))
     DEB_COPTS += -DNO_IPSET
 endif
 ifneq (,$(filter nodhcp6,$(DEB_BUILD_OPTIONS)))
     DEB_COPTS += -DNO_DHCP6
 endif
 ifneq (,$(filter noipv6,$(DEB_BUILD_OPTIONS)))
     DEB_COPTS += -DNO_IPV6
 endif
 ifneq (,$(filter notftp,$(DEB_BUILD_OPTIONS)))
     DEB_COPTS += -DNO_TFTP
 endif
 ifneq (,$(filter nodhcp,$(DEB_BUILD_OPTIONS)))
     DEB_COPTS += -DNO_DHCP
 endif
 ifneq (,$(filter noscript,$(DEB_BUILD_OPTIONS)))
     DEB_COPTS += -DNO_SCRIPT
 endif
 ifneq (,$(filter nortc,$(DEB_BUILD_OPTIONS)))
     DEB_COPTS += -DHAVE_BROKEN_RTC
 endif
 ifneq (,$(filter noi18n,$(DEB_BUILD_OPTIONS)))
     TARGET = install
 endif
 ifneq (,$(filter uselua,$(DEB_BUILD_OPTIONS)))
     DEB_COPTS += -DHAVE_LUASCRIPT
 endif
 ifeq (,$(filter nodnssec,$(DEB_BUILD_OPTIONS)))
     DEB_COPTS += -DHAVE_DNSSEC
 endif
 ifeq ($(DEB_HOST_ARCH_OS),kfreebsd)
     # For strlcpy in FreeBSD
     LIBS += $(shell ${PKG_CONFIG} --libs libbsd-overlay)
     CFLAGS += $(shell ${PKG_CONFIG} --cflags libbsd-overlay)
 endif
 define build_tree
 	rm -rf $1
 	install -m 755 \
 		-d $1/DEBIAN \
 		-d $1/etc/dbus-1/system.d \
 	        -d $1/usr/share/doc/$(package) \
 		-d $1/usr/share/doc/$(package)/examples \
 		-d $1/usr/share/$(package) \
 	        -d $1/var/lib/misc
 endef
 define add_docs
 # Need to remove paypal links in Debian Package for policy reasons.
 	sed -e /\<H2\>Donations/Q -e /icon.png/d doc.html -e /favicon.ico/d >$1/usr/share/doc/$(package)/doc.html
 	echo "</BODY>" >>$1/usr/share/doc/$(package)/doc.html 
 	install -m 644 setup.html $1/usr/share/doc/$(package)/.
 	install -m 644 dnsmasq.conf.example $1/usr/share/doc/$(package)/examples/.
 	install -m 644 FAQ $1/usr/share/doc/$(package)/.
 	gzip -9n $1/usr/share/doc/$(package)/FAQ
 	install -m 644 CHANGELOG $1/usr/share/doc/$(package)/changelog
 	gzip -9n $1/usr/share/doc/$(package)/changelog
 	install -m 644 CHANGELOG.archive $1/usr/share/doc/$(package)/changelog.archive
 	gzip -9n $1/usr/share/doc/$(package)/changelog.archive
 	install -m 644 dbus/DBus-interface $1/usr/share/doc/$(package)/.
 	gzip -9n $1/usr/share/doc/$(package)/DBus-interface	
 	install -m 644 debian/systemd_howto $1/usr/share/doc/$(package)/.
 	gzip -9n $1/usr/share/doc/$(package)/systemd_howto
 	gzip -9n $1/usr/share/man/man8/dnsmasq.8
 	for f in $1/usr/share/man/*; do \
 		if [ -f $$f/man8/dnsmasq.8 ]; then \
                       gzip -9n $$f/man8/dnsmasq.8 ; \
                fi \
 	done
 endef
 define add_files
 	install -m 644 trust-anchors.conf $1/usr/share/$(package)/.
 	install -m 644 debian/dnsmasq-base.conffiles $1/DEBIAN/conffiles
 	install -m 755 debian/dnsmasq-base.postinst $1/DEBIAN/postinst
 	install -m 755 debian/dnsmasq-base.postrm  $1/DEBIAN/postrm
 	install -m 644 debian/changelog $1/usr/share/doc/$(package)/changelog.Debian
 	gzip -9n $1/usr/share/doc/$(package)/changelog.Debian
 	install -m 644 debian/readme $1/usr/share/doc/$(package)/README.Debian
 	install -m 644 debian/copyright $1/usr/share/doc/$(package)/copyright
 	install -m 644 debian/dbus.conf $1/etc/dbus-1/system.d/dnsmasq.conf
 endef
 clean:
 	$(checkdir)
 	make BUILDDIR=debian/build/no-lua clean
 	make BUILDDIR=debian/build/lua clean
 	make -C contrib/lease-tools clean
 	rm -rf debian/build debian/trees debian/*~ debian/files debian/substvars debian/utils-substvars
 binary-indep:	checkroot
 	$(checkdir)
 	rm -rf debian/trees/daemon
 	install -m 755 \
 	        -d debian/trees/daemon/DEBIAN \
 		-d debian/trees/daemon/usr/share/doc/dnsmasq \
 	        -d debian/trees/daemon/etc/init.d \
 		-d debian/trees/daemon/etc/dnsmasq.d \
 	        -d debian/trees/daemon/etc/resolvconf/update.d \
 		-d debian/trees/daemon/usr/lib/resolvconf/dpkg-event.d \
 		-d debian/trees/daemon/usr/share/dnsmasq \
 		-d debian/trees/daemon/usr/share/doc/dnsmasq \
 	        -d debian/trees/daemon/etc/default \
 		-d debian/trees/daemon/lib/systemd/system \
 		-d debian/trees/daemon/usr/lib/tmpfiles.d \
                -d debian/trees/daemon/etc/insserv.conf.d
 	install -m 644 debian/conffiles debian/trees/daemon/DEBIAN
 	install -m 755 debian/postinst debian/postrm debian/preinst debian/prerm debian/trees/daemon/DEBIAN
 	if ! dpkg-vendor --derives-from Ubuntu; then \
                rm -f debian/dnsmasq.postinst.debhelper debian/dnsmasq.postrm.debhelper; \
 	      	dh_runit -pdnsmasq -Pdebian/trees/daemon; \
 		cat debian/dnsmasq.postinst.debhelper >> debian/trees/daemon/DEBIAN/postinst; \
 		cat debian/dnsmasq.postrm.debhelper   >> debian/trees/daemon/DEBIAN/postrm; \
 		cd debian/trees/daemon && find etc/sv -type f -printf '/%p\n' >>DEBIAN/conffiles; \
 	fi
 	install -m 755 debian/init debian/trees/daemon/etc/init.d/dnsmasq
 	install -m 755 debian/resolvconf debian/trees/daemon/etc/resolvconf/update.d/dnsmasq
 	install -m 755 debian/resolvconf-package debian/trees/daemon/usr/lib/resolvconf/dpkg-event.d/dnsmasq
 	install -m 644 debian/installed-marker debian/trees/daemon/usr/share/dnsmasq
 	install -m 644 debian/default debian/trees/daemon/etc/default/dnsmasq
 	install -m 644 dnsmasq.conf.example debian/trees/daemon/etc/dnsmasq.conf
 	install -m 644 debian/readme.dnsmasq.d debian/trees/daemon/etc/dnsmasq.d/README
 	install -m 644 debian/systemd.service debian/trees/daemon/lib/systemd/system/dnsmasq.service
 	install -m 644 debian/systemd@.service debian/trees/daemon/lib/systemd/system/dnsmasq@.service
 	install -m 644 debian/tmpfiles.conf debian/trees/daemon/usr/lib/tmpfiles.d/dnsmasq.conf
 	install -m 644 debian/insserv debian/trees/daemon/etc/insserv.conf.d/dnsmasq
 	install -m 644 debian/copyright debian/trees/daemon/usr/share/doc/dnsmasq/copyright
 	install -m 644 debian/changelog debian/trees/daemon/usr/share/doc/dnsmasq/changelog.Debian
 	gzip -9n debian/trees/daemon/usr/share/doc/dnsmasq/changelog.Debian
 	cd debian/trees/daemon && find . -type f ! -regex '.*DEBIAN/.*' -printf '%P\0' | LC_ALL=C sort -z | xargs -r0 md5sum > DEBIAN/md5sums	
 	dpkg-gencontrol $(PACKAGE_VERSION) -Tdebian/dnsmasq.substvars -pdnsmasq -Pdebian/trees/daemon
 	find debian/trees/daemon -depth -newermt '$(BUILD_DATE)' -print0 | xargs -0r touch --no-dereference --date='$(BUILD_DATE)'
 	chown -R root.root debian/trees/daemon
 	chmod -R g-ws debian/trees/daemon
 	dpkg --build debian/trees/daemon ..
 binary-arch:	checkroot 
 	$(call build_tree,debian/trees/base)
 	make $(TARGET) BUILDDIR=debian/build/no-lua PREFIX=/usr DESTDIR=`pwd`/debian/trees/base CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" COPTS="$(DEB_COPTS)" CC=$(CC) PKG_CONFIG=$(PKG_CONFIG) LIBS="$(LIBS)"
 ifeq (,$(findstring nodoc,$(DEB_BUILD_OPTIONS)))
 	$(call add_docs,debian/trees/base)
 else	
 	rm -rf debian/trees/base/usr/share/man
 endif
 	$(call add_files,debian/trees/base)
 ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
 	$(DEB_HOST_GNU_TYPE)-strip -R .note -R .comment debian/trees/base/usr/sbin/dnsmasq
 endif
 	cd debian/trees/base && find . -type f ! -regex '.*DEBIAN/.*' -printf '%P\0' | LC_ALL=C sort -z | xargs -r0 md5sum > DEBIAN/md5sums
 	dpkg-shlibdeps --warnings=1 debian/trees/base/usr/sbin/dnsmasq
 	dpkg-gencontrol $(PACKAGE_VERSION) -pdnsmasq-base -Pdebian/trees/base
 	find debian/trees/base -depth -newermt '$(BUILD_DATE)' -print0 | xargs -0r touch --no-dereference --date='$(BUILD_DATE)'
 	chown -R root.root debian/trees/base
 	chmod -R g-ws debian/trees/base 
 	dpkg --build debian/trees/base ..
 	$(call build_tree,debian/trees/lua-base)
 	make $(TARGET) BUILDDIR=debian/build/lua PREFIX=/usr DESTDIR=`pwd`/debian/trees/lua-base CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" COPTS="-DHAVE_LUASCRIPT $(DEB_COPTS)" CC=$(CC) PKG_CONFIG=$(PKG_CONFIG) LIBS="$(LIBS)"
 ifeq (,$(findstring nodoc,$(DEB_BUILD_OPTIONS)))
 	$(call add_docs,debian/trees/lua-base)
 else	
 	rm -rf debian/trees/lua-base/usr/share/man
 endif
 	$(call add_files,debian/trees/lua-base)
 	install -m 755 -d debian/trees/lua-base/usr/share/lintian/overrides
 	install -m 644 debian/lintian-override debian/trees/lua-base/usr/share/lintian/overrides/dnsmasq-base-lua
 ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
 	$(DEB_HOST_GNU_TYPE)-strip -R .note -R .comment debian/trees/lua-base/usr/sbin/dnsmasq
 endif
 	ln -s $(package) debian/trees/lua-base/usr/share/doc/dnsmasq-base-lua
 	cd debian/trees/lua-base && find . -type f ! -regex '.*DEBIAN/.*' -printf '%P\0' | LC_ALL=C sort -z | xargs -r0 md5sum > DEBIAN/md5sums
 	dpkg-shlibdeps --warnings=1 debian/trees/lua-base/usr/sbin/dnsmasq
 	dpkg-gencontrol $(PACKAGE_VERSION) -pdnsmasq-base-lua -Pdebian/trees/lua-base
 	find debian/trees/lua-base -depth -newermt '$(BUILD_DATE)' -print0 | xargs -0r touch --no-dereference --date='$(BUILD_DATE)'
 	chown -R root.root debian/trees/lua-base
 	chmod -R g-ws debian/trees/lua-base 
 	dpkg --build debian/trees/lua-base ..
 ifeq ($(DEB_HOST_ARCH_OS),linux)
 	rm -rf debian/trees/utils
 	install -m 755 -d debian/trees/utils/DEBIAN \
 	               -d debian/trees/utils/usr/bin \
                       -d debian/trees/utils/usr/share/doc/dnsmasq-utils
 ifeq (,$(findstring nodoc,$(DEB_BUILD_OPTIONS)))
 	install -m 755 -d debian/trees/utils/usr/share/man/man1
 endif
 	make -C contrib/lease-tools PREFIX=/usr DESTDIR=`pwd`/debian/trees/utils CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" COPTS="$(DEB_COPTS)" CC=$(CC) PKG_CONFIG=$(PKG_CONFIG) LIBS="$(LIBS)"
 	install -m 755 contrib/lease-tools/dhcp_release debian/trees/utils/usr/bin/dhcp_release
 	install -m 755 contrib/lease-tools/dhcp_release6 debian/trees/utils/usr/bin/dhcp_release6
 	install -m 755 contrib/lease-tools/dhcp_lease_time debian/trees/utils/usr/bin/dhcp_lease_time
 ifeq (,$(findstring nodoc,$(DEB_BUILD_OPTIONS)))
 	install -m 644 contrib/lease-tools/dhcp_release.1 debian/trees/utils/usr/share/man/man1/dhcp_release.1
 	gzip -9n debian/trees/utils/usr/share/man/man1/dhcp_release.1
 	install -m 644 contrib/lease-tools/dhcp_release6.1 debian/trees/utils/usr/share/man/man1/dhcp_release6.1
 	gzip -9n debian/trees/utils/usr/share/man/man1/dhcp_release6.1
 	install -m 644 contrib/lease-tools/dhcp_lease_time.1 debian/trees/utils/usr/share/man/man1/dhcp_lease_time.1
 	gzip -9n debian/trees/utils/usr/share/man/man1/dhcp_lease_time.1
 endif
 	install -m 644 debian/copyright debian/trees/utils/usr/share/doc/dnsmasq-utils/copyright
 	install -m 644 debian/changelog debian/trees/utils/usr/share/doc/dnsmasq-utils/changelog.Debian
 	gzip -9n debian/trees/utils/usr/share/doc/dnsmasq-utils/changelog.Debian
 ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
 	$(DEB_HOST_GNU_TYPE)-strip -R .note -R .comment debian/trees/utils/usr/bin/dhcp_release
 	$(DEB_HOST_GNU_TYPE)-strip -R .note -R .comment debian/trees/utils/usr/bin/dhcp_release6
 	$(DEB_HOST_GNU_TYPE)-strip -R .note -R .comment debian/trees/utils/usr/bin/dhcp_lease_time
 endif	
 	cd debian/trees/utils && find . -type f ! -regex '.*DEBIAN/.*' -printf '%P\0' | LC_ALL=C sort -z | xargs -r0 md5sum > DEBIAN/md5sums
 	dpkg-shlibdeps -Tdebian/utils-substvars debian/trees/utils/usr/bin/dhcp_release debian/trees/utils/usr/bin/dhcp_release6 debian/trees/utils/usr/bin/dhcp_lease_time 
 	dpkg-gencontrol $(PACKAGE_VERSION) -Tdebian/utils-substvars -pdnsmasq-utils -Pdebian/trees/utils
 	find debian/trees/utils -depth -newermt '$(BUILD_DATE)' -print0 | xargs -0r touch --no-dereference --date='$(BUILD_DATE)'
 	chown -R root.root debian/trees/utils
 	chmod -R g-ws debian/trees/utils 
 	dpkg --build debian/trees/utils ..
 endif
 define checkdir
 	test -f Makefile -a -f debian/rules
 endef
 # Below here is fairly generic really
 binary:		binary-arch binary-indep
 build:		
 build-arch:
 build-indep:
 checkroot:
 	test root = "`whoami`"
 .PHONY: binary binary-arch binary-indep clean checkroot
@@ -0,0 +1 @@
 1.0
@@ -0,0 +1,31 @@
 [Unit]
 Description=dnsmasq - A lightweight DHCP and caching DNS server
 Requires=network.target
 Wants=nss-lookup.target
 Before=nss-lookup.target
 After=network.target
 [Service]
 Type=forking
 PIDFile=/run/dnsmasq/dnsmasq.pid
 # Test the config file and refuse starting if it is not valid.
 ExecStartPre=/etc/init.d/dnsmasq checkconfig
 # We run dnsmasq via the /etc/init.d/dnsmasq script which acts as a
 # wrapper picking up extra configuration files and then execs dnsmasq
 # itself, when called with the "systemd-exec" function.
 ExecStart=/etc/init.d/dnsmasq systemd-exec
 # The systemd-*-resolvconf functions configure (and deconfigure)
 # resolvconf to work with the dnsmasq DNS server. They're called like
 # this to get correct error handling (ie don't start-resolvconf if the
 # dnsmasq daemon fails to start).
 ExecStartPost=/etc/init.d/dnsmasq systemd-start-resolvconf
 ExecStop=/etc/init.d/dnsmasq systemd-stop-resolvconf
 ExecReload=/bin/kill -HUP $MAINPID
 [Install]
 WantedBy=multi-user.target
@@ -0,0 +1,31 @@
 [Unit]
 Description=dnsmasq (%i) - A lightweight DHCP and caching DNS server
 Requires=network.target
 Wants=nss-lookup.target
 Before=nss-lookup.target
 After=network.target
 [Service]
 Type=forking
 PIDFile=/run/dnsmasq/dnsmasq.%i.pid
 # Test the config file and refuse starting if it is not valid.
 ExecStartPre=/etc/init.d/dnsmasq checkconfig "%i"
 # We run dnsmasq via the /etc/init.d/dnsmasq script which acts as a
 # wrapper picking up extra configuration files and then execs dnsmasq
 # itself, when called with the "systemd-exec" function.
 ExecStart=/etc/init.d/dnsmasq systemd-exec "%i"
 # The systemd-*-resolvconf functions configure (and deconfigure)
 # resolvconf to work with the dnsmasq DNS server. They're called like
 # this to get correct error handling (ie don't start-resolvconf if the
 # dnsmasq daemon fails to start).
 ExecStartPost=/etc/init.d/dnsmasq systemd-start-resolvconf "%i"
 ExecStop=/etc/init.d/dnsmasq systemd-stop-resolvconf "%i"
 ExecReload=/bin/kill -HUP $MAINPID
 [Install]
 WantedBy=multi-user.target
@@ -0,0 +1,41 @@
 HOWTO
 =====
 dnsmasq comes with the possibility to run multiple systemd service instances on the same machine.
 There is the main service which is enabled by default via `systemctl enable dnsmasq.service` and uses the configuration from `/etc/default/dnsmasq`.
 Additional service instances can be enabled via `systemctl enable dnsmasq@<instance name>.service` that use the configuration from `/etc/default/dnsmasq.<instance name>`.
 It is recommended to use a separate configuration file and directory for each instance.
 Additionally make sure that all instances use either different ports and/or ip addresses to avoid binding collisions.
 Example setup for an instance called "alt"
 #1 File `/etc/dnsmasq.alt.conf` copied from `/etc/dnsmasq.conf`
 #2 Directory `/etc/dnsmasq.alt.d`
 #3 File `/etc/default/dnsmasq.alt` copied from `/etc/default/dnsmasq` with following adaptions:
   * The options DNSMASQ_OPTS and CONFIG_DIR point to the correct configuration file and directory.
     DNSMASQ_OPTS="... --conf-file=/etc/dnsmasq.alt.conf ..."
     CONFIG_DIR=/etc/dnsmasq.alt.d,.dpkg-dist,.dpkg-old,.dpkg-new
   * The option DNSMASQ_EXCEPT must contain "lo" to avoid that an instance becomes the machine's DNS resolver.
     DNSMASQ_EXCEPT="lo"
  * If the additional instance should bind to all IP addresses of a specific interface, e.g. "dnsalt01", then the following addition could be used:
    DNSMASQ_OPTS="... --bind-dynamic --interface=dnsalt01 ..."
    Additionally the main instance must be stopped from binding to interfaces that are used by other instances:
    DNSMASQ_OPTS="... --bind-dynamic --except-interface=dnsalt* ..."
  * If the additional instance should not use the machine's DNS resolver, normally that's the dnsmasq main instance, as upstream server, then the following addition could be used:
    IGNORE_RESOLVCONF=yes
 #4 Enable additional instance via `systemctl enable dnsmasq@alt.service`
 #5 Start additional instance without reboot via `systemctl start dnsmasq@alt.service`
 TODO
 ====
 #1 - Found shortcoming on 2019-03-10
 Only the option DNSMASQ_EXCEPT="lo" avoids that an DNS instance will be set as the machine's DNS resolver.
 This may interfere with the wish to run an additional instance on a different port on the localhost addresses.
 My suggestion in the initial Debian report [1] was to specify an explicit variable for this.
 [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914305#5
 #2 - Preferred configuration way
 Should the variables DNSMASQ_INTERFACE and DNSMASQ_EXCEPT be used instead of --interface and --except-interface?  (while "lo" still has to be in DNSMASQ_EXCEPT as of now)
@@ -0,0 +1 @@
 d /run/dnsmasq 755 dnsmasq nogroup
@@ -4,22 +4,39 @@
 # as the long options legal on the command line. See
 # "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details.
 # Listen on this specific port instead of the standard DNS port
 # (53). Setting this to zero completely disables DNS function,
 # leaving only DHCP and/or TFTP.
 #port=5353
 # The following two options make you a better netizen, since they
 # tell dnsmasq to filter out queries which the public DNS cannot
 # answer, and which load the servers (especially the root servers)
-# uneccessarily. If you have a dial-on-demand link they also stop
+# unnecessarily. If you have a dial-on-demand link they also stop
-# these requests from bringing up the link uneccessarily.
+# these requests from bringing up the link unnecessarily.
 # Never forward plain names (without a dot or domain part)
 #domain-needed
 # Never forward addresses in the non-routed address spaces.
 #bogus-priv
 # Uncomment these to enable DNSSEC validation and caching:
 # (Requires dnsmasq to be built with DNSSEC option.)
 #conf-file=%%PREFIX%%/share/dnsmasq/trust-anchors.conf
 #dnssec
 # Replies which are not DNSSEC signed may be legitimate, because the domain
 # is unsigned, or may be forgeries. Setting this option tells dnsmasq to
 # check that an unsigned reply is OK, by finding a secure proof that a DS 
 # record somewhere between the root and the domain does not exist. 
 # The cost of setting this is that even queries in unsigned domains will need
 # one or more extra DNS queries to verify.
 #dnssec-check-unsigned
 # Uncomment this to filter useless windows-originated DNS requests
 # which can trigger dial-on-demand links needlessly.
 # Note that (amongst other things) this blocks all SRV requests,
-# so don't use it if you use eg Kerberos.
+# so don't use it if you use eg Kerberos, SIP, XMMP or Google-talk.
 # This option only affects forwarding, SRV records originating for
 # dnsmasq (via srv-host= lines) are not suppressed by it.
 #filterwin2k
@@ -37,7 +54,7 @@
 # If you don't want dnsmasq to read /etc/resolv.conf or any other
 # file, getting its servers from this file instead (see below), then
-# uncomment this
+# uncomment this.
 #no-resolv
 # If you don't want dnsmasq to poll /etc/resolv.conf or other resolv
@@ -48,14 +65,34 @@
 # non-public domains.
 #server=/localnet/192.168.0.1
 # Example of routing PTR queries to nameservers: this will send all
 # address->name queries for 192.168.3/24 to nameserver 10.1.2.3
 #server=/3.168.192.in-addr.arpa/10.1.2.3
 # Add local-only domains here, queries in these domains are answered
 # from /etc/hosts or DHCP only.
 #local=/localnet/
 # Add domains which you want to force to an IP address here.
-# The example below send any host in doubleclick.net to a local
+# The example below send any host in double-click.net to a local
-# webserver.
+# web-server.
-#address=/doubleclick.net/127.0.0.1
+#address=/double-click.net/127.0.0.1
 # --address (and --server) work with IPv6 addresses too.
 #address=/www.thekelleys.org.uk/fe80::20d:60ff:fe36:f83
 # Add the IPs of all queries to yahoo.com, google.com, and their
 # subdomains to the vpn and search ipsets:
 #ipset=/yahoo.com/google.com/vpn,search
 # You can control how dnsmasq talks to a server: this forces
 # queries to 10.1.2.3 to be routed via eth1
 # server=10.1.2.3@eth1
 # and this sets the source (ie local) address used to talk to
 # 10.1.2.3 to 192.168.1.1 port 55 (there must be an interface with that
 # IP on the machine, obviously).
 # server=10.1.2.3@192.168.1.1#55
 # If you want dnsmasq to change uid and gid to something other
 # than the default, edit the following lines.
@@ -74,7 +111,7 @@
 #listen-address=
 # If you want dnsmasq to provide only DNS service on an interface,
 # configure it as shown above, and then use the following line to
-# disable DHCP on it.
+# disable DHCP and TFTP on it.
 #no-dhcp-interface=
 # On systems which support it, dnsmasq binds the wildcard address,
@@ -106,6 +143,12 @@
 # 3) Provides the domain part for "expand-hosts"
 #domain=thekelleys.org.uk
 # Set a different domain for a particular subnet
 #domain=wireless.thekelleys.org.uk,192.168.2.0/24
 # Same idea, but range rather then subnet
 #domain=reserved.thekelleys.org.uk,192.68.3.100,192.168.3.200
 # Uncomment this to enable the integrated DHCP server, you need
 # to supply the range of addresses available for lease and optionally
 # a lease time. If you have more than one network, you will need to
@@ -119,17 +162,68 @@
 # don't need to worry about this.
 #dhcp-range=192.168.0.50,192.168.0.150,255.255.255.0,12h
-# This is an example of a DHCP range with a network-id, so that
+# This is an example of a DHCP range which sets a tag, so that
 # some DHCP options may be set only for this network.
-#dhcp-range=red,192.168.0.50,192.168.0.150
+#dhcp-range=set:red,192.168.0.50,192.168.0.150
 # Use this DHCP range only when the tag "green" is set.
 #dhcp-range=tag:green,192.168.0.50,192.168.0.150,12h
 # Specify a subnet which can't be used for dynamic address allocation,
 # is available for hosts with matching --dhcp-host lines. Note that
 # dhcp-host declarations will be ignored unless there is a dhcp-range
 # of some type for the subnet in question.
 # In this case the netmask is implied (it comes from the network
 # configuration on the machine running dnsmasq) it is possible to give
 # an explicit netmask instead.
 #dhcp-range=192.168.0.0,static
 # Enable DHCPv6. Note that the prefix-length does not need to be specified
 # and defaults to 64 if missing/
 #dhcp-range=1234::2, 1234::500, 64, 12h
 # Do Router Advertisements, BUT NOT DHCP for this subnet.
 #dhcp-range=1234::, ra-only 
 # Do Router Advertisements, BUT NOT DHCP for this subnet, also try and
 # add names to the DNS for the IPv6 address of SLAAC-configured dual-stack 
 # hosts. Use the DHCPv4 lease to derive the name, network segment and 
 # MAC address and assume that the host will also have an
 # IPv6 address calculated using the SLAAC algorithm.
 #dhcp-range=1234::, ra-names
 # Do Router Advertisements, BUT NOT DHCP for this subnet.
 # Set the lifetime to 46 hours. (Note: minimum lifetime is 2 hours.)
 #dhcp-range=1234::, ra-only, 48h
 # Do DHCP and Router Advertisements for this subnet. Set the A bit in the RA
 # so that clients can use SLAAC addresses as well as DHCP ones.
 #dhcp-range=1234::2, 1234::500, slaac
 # Do Router Advertisements and stateless DHCP for this subnet. Clients will
 # not get addresses from DHCP, but they will get other configuration information.
 # They will use SLAAC for addresses.
 #dhcp-range=1234::, ra-stateless
 # Do stateless DHCP, SLAAC, and generate DNS names for SLAAC addresses
 # from DHCPv4 leases.
 #dhcp-range=1234::, ra-stateless, ra-names
 # Do router advertisements for all subnets where we're doing DHCPv6
 # Unless overridden by ra-stateless, ra-names, et al, the router 
 # advertisements will have the M and O bits set, so that the clients
 # get addresses and configuration from DHCPv6, and the A bit reset, so the 
 # clients don't use SLAAC addresses.
 #enable-ra
 # Supply parameters for specified hosts using DHCP. There are lots
 # of valid alternatives, so we will give examples of each. Note that
 # IP addresses DO NOT have to be in the range given above, they just
 # need to be on the same network. The order of the parameters in these
-# do not matter, it's permissble to give name,adddress and MAC in any order
+# do not matter, it's permissible to give name, address and MAC in any
 # order.
-# Always allocate the host with ethernet address 11:22:33:44:55:66
+# Always allocate the host with Ethernet address 11:22:33:44:55:66
 # The IP address 192.168.0.60
 #dhcp-host=11:22:33:44:55:66,192.168.0.60
@@ -137,11 +231,19 @@
 # 11:22:33:44:55:66 to be "fred"
 #dhcp-host=11:22:33:44:55:66,fred
-# Always give the host with ethernet address 11:22:33:44:55:66
+# Always give the host with Ethernet address 11:22:33:44:55:66
 # the name fred and IP address 192.168.0.60 and lease time 45 minutes
 #dhcp-host=11:22:33:44:55:66,fred,192.168.0.60,45m
-# Give the machine which says it's name is "bert" IP address
+# Give a host with Ethernet address 11:22:33:44:55:66 or
 # 12:34:56:78:90:12 the IP address 192.168.0.60. Dnsmasq will assume
 # that these two Ethernet interfaces will never be in use at the same
 # time, and give the IP address to the second, even if it is already
 # in use by the first. Useful for laptops with wired and wireless
 # addresses.
 #dhcp-host=11:22:33:44:55:66,12:34:56:78:90:12,192.168.0.60
 # Give the machine which says its name is "bert" IP address
 # 192.168.0.70 and an infinite lease
 #dhcp-host=bert,192.168.0.70,infinite
@@ -149,6 +251,13 @@
 # the IP address 192.168.0.60
 #dhcp-host=id:01:02:02:04,192.168.0.60
 # Always give the InfiniBand interface with hardware address
 # 80:00:00:48:fe:80:00:00:00:00:00:00:f4:52:14:03:00:28:05:81 the
 # ip address 192.168.0.61. The client id is derived from the prefix
 # ff:00:00:00:00:00:02:00:00:02:c9:00 and the last 8 pairs of
 # hex digits of the hardware address.
 #dhcp-host=id:ff:00:00:00:00:00:02:00:00:02:c9:00:f4:52:14:03:00:28:05:81,192.168.0.61
 # Always give the host with client identifier "marjorie"
 # the IP address 192.168.0.60
 #dhcp-host=id:marjorie,192.168.0.60
@@ -158,35 +267,47 @@
 # it asks for a DHCP lease.
 #dhcp-host=judge
-# Never offer DHCP service to a machine whose ethernet
+# Never offer DHCP service to a machine whose Ethernet
 # address is 11:22:33:44:55:66
 #dhcp-host=11:22:33:44:55:66,ignore
-# Ignore any client-id presented by the machine with ethernet
+# Ignore any client-id presented by the machine with Ethernet
 # address 11:22:33:44:55:66. This is useful to prevent a machine
 # being treated differently when running under different OS's or
 # between PXE boot and OS boot.
 #dhcp-host=11:22:33:44:55:66,id:*
 # Send extra options which are tagged as "red" to
-# the machine with ethernet address 11:22:33:44:55:66
+# the machine with Ethernet address 11:22:33:44:55:66
-#dhcp-host=11:22:33:44:55:66,net:red
+#dhcp-host=11:22:33:44:55:66,set:red
 # Send extra options which are tagged as "red" to
-# any machine with ethernet address starting 11:22:33:
+# any machine with Ethernet address starting 11:22:33:
-#dhcp-host=11:22:33:*:*:*,net:red
+#dhcp-host=11:22:33:*:*:*,set:red
 # Give a fixed IPv6 address and name to client with 
 # DUID 00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2
 # Note the MAC addresses CANNOT be used to identify DHCPv6 clients.
 # Note also that the [] around the IPv6 address are obligatory.
 #dhcp-host=id:00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2, fred, [1234::5] 
 # Ignore any clients which are not specified in dhcp-host lines
 # or /etc/ethers. Equivalent to ISC "deny unknown-clients".
 # This relies on the special "known" tag which is set when
 # a host is matched.
 #dhcp-ignore=tag:!known
 # Send extra options which are tagged as "red" to any machine whose
 # DHCP vendorclass string includes the substring "Linux"
-#dhcp-vendorclass=red,Linux
+#dhcp-vendorclass=set:red,Linux
 # Send extra options which are tagged as "red" to any machine one
 # of whose DHCP userclass strings includes the substring "accounts"
-#dhcp-userclass=red,accounts
+#dhcp-userclass=set:red,accounts
 # Send extra options which are tagged as "red" to any machine whose
 # MAC address matches the pattern.
-#dhcp-mac=red,00:60:8C:*:*:*
+#dhcp-mac=set:red,00:60:8C:*:*:*
 # If this line is uncommented, dnsmasq will read /etc/ethers and act
 # on the ethernet-address/IP pairs found there just as if they had
@@ -196,24 +317,48 @@
 # Send options to hosts which ask for a DHCP lease.
 # See RFC 2132 for details of available options.
 # Common options can be given to dnsmasq by name:
 # run "dnsmasq --help dhcp" to get a list.
 # Note that all the common settings, such as netmask and
 # broadcast address, DNS server and default route, are given
-# sane defaults by dnsmasq. You very likely will not need any
+# sane defaults by dnsmasq. You very likely will not need
 # any dhcp-options. If you use Windows clients and Samba, there
 # are some options which are recommended, they are detailed at the
 # end of this section.
 # For reference, the common options are:
 # subnet mask - 1
 # default router - 3
 # DNS server - 6
 # broadcast address - 28
 # Override the default route supplied by dnsmasq, which assumes the
 # router is the same machine as the one running dnsmasq.
 #dhcp-option=3,1.2.3.4
 # Do the same thing, but using the option name
 #dhcp-option=option:router,1.2.3.4
 # Override the default route supplied by dnsmasq and send no default
 # route at all. Note that this only works for the options sent by
 # default (1, 3, 6, 12, 28) the same line will send a zero-length option
 # for all other option numbers.
 #dhcp-option=3
 # Set the NTP time server addresses to 192.168.0.4 and 10.10.0.5
-#dhcp-option=42,192.168.0.4,10.10.0.5
+#dhcp-option=option:ntp-server,192.168.0.4,10.10.0.5
 # Send DHCPv6 option. Note [] around IPv6 addresses.
 #dhcp-option=option6:dns-server,[1234::77],[1234::88]
 # Send DHCPv6 option for namservers as the machine running 
 # dnsmasq and another.
 #dhcp-option=option6:dns-server,[::],[1234::88]
 # Ask client to poll for option changes every six hours. (RFC4242)
 #dhcp-option=option6:information-refresh-time,6h
 # Set option 58 client renewal time (T1). Defaults to half of the
 # lease time if not specified. (RFC2132)
 #dhcp-option=option:T1,1m
 # Set option 59 rebinding time (T2). Defaults to 7/8 of the
 # lease time if not specified. (RFC2132)
 #dhcp-option=option:T2,2m
 # Set the NTP time server address to be the same machine as
 # is running dnsmasq
@@ -234,39 +379,156 @@
 # Specify an option which will only be sent to the "red" network
 # (see dhcp-range for the declaration of the "red" network)
-#dhcp-option=red,42,192.168.1.1
+# Note that the tag: part must precede the option: part.
 #dhcp-option = tag:red, option:ntp-server, 192.168.1.1
 # The following DHCP options set up dnsmasq in the same way as is specified
 # for the ISC dhcpcd in
 # http://www.samba.org/samba/ftp/docs/textdocs/DHCP-Server-Configuration.txt
 # adapted for a typical dnsmasq installation where the host running
 # dnsmasq is also the host running samba.
-# you may want to uncomment them if you use Windows clients and Samba.
+# you may want to uncomment some or all of them if you use
 # Windows clients and Samba.
 #dhcp-option=19,0           # option ip-forwarding off
 #dhcp-option=44,0.0.0.0     # set netbios-over-TCP/IP nameserver(s) aka WINS server(s)
 #dhcp-option=45,0.0.0.0     # netbios datagram distribution server
 #dhcp-option=46,8           # netbios node type
-#dhcp-option=47             # empty netbios scope.
+
 # Send an empty WPAD option. This may be REQUIRED to get windows 7 to behave.
 #dhcp-option=252,"\n"
 # Send RFC-3397 DNS domain search DHCP option. WARNING: Your DHCP client
 # probably doesn't support this......
-#dhcp-option=119,eng.apple.com,marketing.apple.com
+#dhcp-option=option:domain-search,eng.apple.com,marketing.apple.com
 # Send RFC-3442 classless static routes (note the netmask encoding)
 #dhcp-option=121,192.168.1.0/24,1.2.3.4,10.0.0.0/8,5.6.7.8
-# Send encapsulated vendor-class specific options. The vendor-class
+# Send vendor-class specific options encapsulated in DHCP option 43.
-# is sent as DHCP option 60, and all the options marked with the
+# The meaning of the options is defined by the vendor-class so
-# vendor class are send encapsulated in DHCP option 43. The meaning of
+# options are sent only when the client supplied vendor class
-# the options is defined by the vendor-class. This example sets the
+# matches the class given here. (A substring match is OK, so "MSFT"
-# mtftp address to 0.0.0.0 for PXEClients
+# matches "MSFT" and "MSFT 5.0"). This example sets the
 # mtftp address to 0.0.0.0 for PXEClients.
 #dhcp-option=vendor:PXEClient,1,0.0.0.0
-# Set the boot filename and tftpd server name and address
+# Send microsoft-specific option to tell windows to release the DHCP lease
-# for BOOTP. You will only need this is you want to
+# when it shuts down. Note the "i" flag, to tell dnsmasq to send the
-# boot machines over the network.
+# value as a four-byte integer - that's what microsoft wants. See
 # http://technet2.microsoft.com/WindowsServer/en/library/a70f1bb7-d2d4-49f0-96d6-4b7414ecfaae1033.mspx?mfr=true
 #dhcp-option=vendor:MSFT,2,1i
 # Send the Encapsulated-vendor-class ID needed by some configurations of
 # Etherboot to allow is to recognise the DHCP server.
 #dhcp-option=vendor:Etherboot,60,"Etherboot"
 # Send options to PXELinux. Note that we need to send the options even
 # though they don't appear in the parameter request list, so we need
 # to use dhcp-option-force here.
 # See http://syslinux.zytor.com/pxe.php#special for details.
 # Magic number - needed before anything else is recognised
 #dhcp-option-force=208,f1:00:74:7e
 # Configuration file name
 #dhcp-option-force=209,configs/common
 # Path prefix
 #dhcp-option-force=210,/tftpboot/pxelinux/files/
 # Reboot time. (Note 'i' to send 32-bit value)
 #dhcp-option-force=211,30i
 # Set the boot filename for netboot/PXE. You will only need
 # this if you want to boot machines over the network and you will need
 # a TFTP server; either dnsmasq's built-in TFTP server or an
 # external one. (See below for how to enable the TFTP server.)
 #dhcp-boot=pxelinux.0
 # The same as above, but use custom tftp-server instead machine running dnsmasq
 #dhcp-boot=pxelinux,server.name,192.168.1.100
 # Boot for iPXE. The idea is to send two different
 # filenames, the first loads iPXE, and the second tells iPXE what to
 # load. The dhcp-match sets the ipxe tag for requests from iPXE.
 #dhcp-boot=undionly.kpxe
 #dhcp-match=set:ipxe,175 # iPXE sends a 175 option.
 #dhcp-boot=tag:ipxe,http://boot.ipxe.org/demo/boot.php
 # Encapsulated options for iPXE. All the options are
 # encapsulated within option 175
 #dhcp-option=encap:175, 1, 5b         # priority code
 #dhcp-option=encap:175, 176, 1b       # no-proxydhcp
 #dhcp-option=encap:175, 177, string   # bus-id
 #dhcp-option=encap:175, 189, 1b       # BIOS drive code
 #dhcp-option=encap:175, 190, user     # iSCSI username
 #dhcp-option=encap:175, 191, pass     # iSCSI password
 # Test for the architecture of a netboot client. PXE clients are
 # supposed to send their architecture as option 93. (See RFC 4578)
 #dhcp-match=peecees, option:client-arch, 0 #x86-32
 #dhcp-match=itanics, option:client-arch, 2 #IA64
 #dhcp-match=hammers, option:client-arch, 6 #x86-64
 #dhcp-match=mactels, option:client-arch, 7 #EFI x86-64
 # Do real PXE, rather than just booting a single file, this is an
 # alternative to dhcp-boot.
 #pxe-prompt="What system shall I netboot?"
 # or with timeout before first available action is taken:
 #pxe-prompt="Press F8 for menu.", 60
 # Available boot services. for PXE.
 #pxe-service=x86PC, "Boot from local disk"
 # Loads <tftp-root>/pxelinux.0 from dnsmasq TFTP server.
 #pxe-service=x86PC, "Install Linux", pxelinux
 # Loads <tftp-root>/pxelinux.0 from TFTP server at 1.2.3.4.
 # Beware this fails on old PXE ROMS.
 #pxe-service=x86PC, "Install Linux", pxelinux, 1.2.3.4
 # Use bootserver on network, found my multicast or broadcast.
 #pxe-service=x86PC, "Install windows from RIS server", 1
 # Use bootserver at a known IP address.
 #pxe-service=x86PC, "Install windows from RIS server", 1, 1.2.3.4
 # If you have multicast-FTP available,
 # information for that can be passed in a similar way using options 1
 # to 5. See page 19 of
 # http://download.intel.com/design/archives/wfm/downloads/pxespec.pdf
 # Enable dnsmasq's built-in TFTP server
 #enable-tftp
 # Set the root directory for files available via FTP.
 #tftp-root=/var/ftpd
 # Do not abort if the tftp-root is unavailable
 #tftp-no-fail
 # Make the TFTP server more secure: with this set, only files owned by
 # the user dnsmasq is running as will be send over the net.
 #tftp-secure
 # This option stops dnsmasq from negotiating a larger blocksize for TFTP
 # transfers. It will slow things down, but may rescue some broken TFTP
 # clients.
 #tftp-no-blocksize
 # Set the boot file name only when the "red" tag is set.
 #dhcp-boot=tag:red,pxelinux.red-net
 # An example of dhcp-boot with an external TFTP server: the name and IP
 # address of the server are given after the filename.
 # Can fail with old PXE ROMS. Overridden by --pxe-service.
 #dhcp-boot=/var/ftpd/pxelinux.0,boothost,192.168.0.3
 # If there are multiple external tftp servers having a same name
 # (using /etc/hosts) then that name can be specified as the
 # tftp_servername (the third option to dhcp-boot) and in that
 # case dnsmasq resolves this name and returns the resultant IP
 # addresses in round robin fashion. This facility can be used to
 # load balance the tftp load among a set of servers.
 #dhcp-boot=/var/ftpd/pxelinux.0,boothost,tftp_server_name
 # Set the limit on DHCP leases, the default is 150
 #dhcp-lease-max=150
@@ -279,16 +541,24 @@
 # and take over the lease for any client which broadcasts on the network,
 # whether it has a record of the lease or not. This avoids long timeouts
 # when a machine wakes up on a new network. DO NOT enable this if there's
-# the slighest chance that you might end up accidentally configuring a DHCP
+# the slightest chance that you might end up accidentally configuring a DHCP
-# server for your campus/company accidentally. The ISC server uses the same
+# server for your campus/company accidentally. The ISC server uses
 # the same option, and this URL provides more information:
-# http://www.isc.org/index.pl?/sw/dhcp/authoritative.php
+# http://www.isc.org/files/auth.html
 #dhcp-authoritative
 # Set the DHCP server to enable DHCPv4 Rapid Commit Option per RFC 4039.
 # In this mode it will respond to a DHCPDISCOVER message including a Rapid Commit
 # option with a DHCPACK including a Rapid Commit option and fully committed address
 # and configuration information. This must only be enabled if either the server is 
 # the only server for the subnet, or multiple servers are present and they each
 # commit a binding for all clients.
 #dhcp-rapid-commit
 # Run an executable when a DHCP lease is created or destroyed.
-# The arguments sent to the script are "add" or "del", 
+# The arguments sent to the script are "add" or "del",
 # then the MAC address, the IP address and finally the hostname
-# if there is one. 
+# if there is one.
 #dhcp-script=/bin/echo
 # Set the cachesize here.
@@ -297,7 +567,7 @@
 # If you want to disable negative caching, uncomment this.
 #no-negcache
-# Normally responses which come form /etc/hosts and the DHCP lease
+# Normally responses which come from /etc/hosts and the DHCP lease
 # file have Time-To-Live set as zero, which conventionally means
 # do not cache further. If you are happy to trade lower load on the
 # server for potentially stale date, you can set a time-to-live (in
@@ -317,7 +587,8 @@
 #alias=1.2.3.4,5.6.7.8
 # and this maps 1.2.3.x to 5.6.7.x
 #alias=1.2.3.0,5.6.7.0,255.255.255.0
-
+# and this maps 192.168.0.10->192.168.0.40 to 10.0.0.10->10.0.0.40
 #alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0
 # Change these lines if you want dnsmasq to serve MX records.
@@ -347,11 +618,11 @@
 # set for this to work.)
 # A SRV record sending LDAP for the example.com domain to
-# ldapserver.example.com port 289
+# ldapserver.example.com port 389
 #srv-host=_ldap._tcp.example.com,ldapserver.example.com,389
 # A SRV record sending LDAP for the example.com domain to
-# ldapserver.example.com port 289 (using domain=)
+# ldapserver.example.com port 389 (using domain=)
 #domain=example.com
 #srv-host=_ldap._tcp,ldapserver.example.com,389
@@ -363,6 +634,11 @@
 # example.com
 #srv-host=_ldap._tcp.example.com
 # The following line shows how to make dnsmasq serve an arbitrary PTR
 # record. This is useful for DNS-SD. (Note that the
 # domain-name expansion done for SRV records _does_not
 # occur for PTR records.)
 #ptr-record=_http._tcp.dns-sd-services,"New Employee Page._http._tcp.dns-sd-services"
 # Change the following lines to enable dnsmasq to serve TXT records.
 # These are used for things like SPF and zeroconf. (Note that the
@@ -370,16 +646,34 @@
 # occur for TXT records.)
 #Example SPF.
-#txt-record=example.com,v=spf1 a -all
+#txt-record=example.com,"v=spf1 a -all"
 #Example zeroconf
 #txt-record=_http._tcp.example.com,name=value,paper=A4
 # Provide an alias for a "local" DNS name. Note that this _only_ works
 # for targets which are names from DHCP or /etc/hosts. Give host
 # "bert" another name, bertrand
 #cname=bertand,bert
 # For debugging purposes, log each DNS query as it passes through
 # dnsmasq.
 #log-queries
-# Include a another lot of configuration options.
+# Log lots of extra information about DHCP transactions.
 #log-dhcp
 # Include another lot of configuration options.
 #conf-file=/etc/dnsmasq.more.conf
 #conf-dir=/etc/dnsmasq.d
 # Include all the files in a directory except those ending in .bak
 #conf-dir=/etc/dnsmasq.d,.bak
 # Include all files in a directory which end in .conf
 #conf-dir=/etc/dnsmasq.d/,*.conf
 # If a DHCP client claims that its name is "wpad", ignore that.
 # This fixes a security hole. see CERT Vulnerability VU#598349
 #dhcp-name-match=set:wpad-ignore,wpad
 #dhcp-ignore-names=tag:wpad-ignore
@@ -1,125 +1,101 @@
 <HTML>
 <HEAD>
-<TITLE> Dnsmasq - a DNS forwarder for NAT firewalls.</TITLE>
+<TITLE> Dnsmasq - network services for small networks.</TITLE>
 <link rel="icon" href="http://www.thekelleys.org.uk/dnsmasq/images/favicon.ico">
 </HEAD>
 <BODY BGCOLOR="WHITE"> 
-<H1 ALIGN=center>Dnsmasq</H1> 
+<table width="100%" border="0" cellpadding="0" cellspacing="0">
-Dnsmasq is a lightweight, easy to configure DNS forwarder and DHCP
+<tr>
- server. It is designed to provide DNS and, optionally, DHCP, to a 
+<td align="left" valign="middle"><img border="0" src="http://www.thekelleys.org.uk/dnsmasq/images/icon.png" /></td>
- small network. It can serve the names of local machines which are 
+<td align="middle" valign="middle"><h1>Dnsmasq</h1></td>
- not in the global DNS. The DHCP server integrates with the DNS 
+<td align="right" valign="middle"><img border="0" src="http://www.thekelleys.org.uk/dnsmasq/images/icon.png" /></td></tr>
- server and allows machines with DHCP-allocated addresses
+</table>
- to appear in the DNS with names configured either in each host or
+Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be 
- in a central configuration file. Dnsmasq supports static and dynamic 
+lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used 
- DHCP leases and BOOTP for network booting of diskless machines.
+for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.
 Supported platforms include Linux (with glibc and uclibc), Android, *BSD, and Mac OS X. Dnsmasq is included in most
 Linux distributions and the ports systems of FreeBSD, OpenBSD and NetBSD. Dnsmasq provides full IPv6 support.
 <P>
- Dnsmasq is targeted at home networks using NAT and 
+The DNS subsystem provides a local DNS server for the network, with forwarding of all query types to upstream recursive DNS servers and
-connected to the internet via a modem, cable-modem or ADSL
+caching of common record types (A, AAAA, CNAME and PTR, also DNSKEY and DS when DNSSEC is enabled). 
 connection but would be a good choice for any small network where low
 resource use and ease of configuration are important. 
 <P>
 Supported platforms include Linux (with glibc and uclibc), *BSD and
 Mac OS X.
 Dnsmasq is included in at least the following Linux distributions:
 Gentoo, Debian, Slackware, Suse, 
 Smoothwall, IP-Cop, floppyfw, Firebox, LEAF, Freesco, fli4l,
 CoyoteLinux, Endian Firewall and
 Clarkconnect. It is also available as a FreeBSD port and is used in
 Linksys wireless routers and the m0n0wall project.
 <P>
 Dnsmasq provides the following features:
 <DIR>
-
+<LI>Local DNS names can be defined by reading /etc/hosts, by importing names from the DHCP subsystem, or by configuration of a wide range of useful record types.</LI>
-<LI> 
+<LI>Upstream servers can be configured in a variety of convenient ways, including  dynamic configuration as these change on moving upstream network.
-The DNS configuration of machines behind the firewall is simple and
+<LI>Authoritative DNS mode allows local DNS names may be exported to zone in the global DNS. Dnsmasq acts as authoritative server for this zone, and also provides 
-doesn't depend on the details of the ISP's dns servers
+zone transfer to secondaries for the zone, if required.</LI>
-<LI>
+<LI>DNSSEC validation may be performed on DNS replies from upstream nameservers, providing security against spoofing and cache poisoning.</LI>
-Clients which try to do DNS lookups while  a modem link to the
+<LI>Specified sub-domains can be directed to their own upstream DNS servers, making VPN configuration easy.</LI>
-internet is down will time out immediately.
+<LI>Internationalised domain names are supported.
 </LI>
 <LI>
 Dnsmasq will serve names from the /etc/hosts file on the firewall
 machine: If the names of local machines are there, then they can all
 be addressed without having to maintain /etc/hosts on each machine.
 </LI>
 <LI>
 The integrated DHCP server supports static and dynamic DHCP leases and
 multiple networks and IP ranges. It works across BOOTP relays and
 supports DHCP options including RFC3397 DNS search lists.
 Machines which are configured by DHCP have their names automatically 
 included in the DNS and the names can specified by each machine or
 centrally by associating a name with a MAC address in the dnsmasq
 config file.
 </LI>
 <LI>
 Dnsmasq caches internet addresses (A records and AAAA records) and address-to-name
 mappings (PTR records), reducing the load on upstream servers and
 improving performance (especially on modem connections). 
 </LI>
 <LI>
 Dnsmasq can be configured to automatically pick up the addresses of
 it's upstream nameservers from ppp or dhcp configuration. It will
 automatically reload this information if it changes. This facility
 will be of particular interest to maintainers of Linux firewall
 distributions since it allows dns configuration to be made automatic.
 </LI>
 <LI>
 On IPv6-enabled boxes, dnsmasq can both talk to upstream servers via IPv6 
 and offer DNS service via IPv6. On dual-stack (IPv4 and IPv6) boxes it talks
 both protocols and can even act as IPv6-to-IPv4 or IPv4-to-IPv6 forwarder.
 </LI>
 <LI>
 Dnsmasq can be configured to send queries for certain domains to
 upstream servers handling only those domains. This makes integration
 with private DNS systems easy.
 </LI>
 <LI>
 Dnsmasq supports MX records and can be configured to return MX records
 for any or all local machines.
 </LI>
 </DIR>
-
+<P>
-<H2>Download.</H2>
+The DHCP subsystem supports DHCPv4, DHCPv6, BOOTP and PXE.
-
+<DIR>
-<A HREF="http://www.thekelleys.org.uk/dnsmasq/"> Download</A> dnsmasq here. 
+<LI> Both static and dynamic DHCP leases are supported, along with stateless mode in DHCPv6.</LI>
-The tarball includes this documentation, source, manpage and control files for building .rpms.
+<LI> The PXE system is a full PXE server, supporting netboot menus and multiple architecture support. It
-There are also pre-built i386 .rpms, and a 
+includes proxy-mode, where the PXE system co-operates with another DHCP server.</LI>
-<A HREF="CHANGELOG"> CHANGELOG</A>.
+<LI> There is a built in read-only TFTP server to support netboot.</LI>
-Dnsmasq is part of the Debian distribution, it can be downloaded from 
+<LI> Machines which are configured by DHCP have their names automatically 
-<A HREF="http://ftp.debian.org/debian/pool/main/d/dnsmasq/"> here</A> or installed using <TT>apt</TT>.
+included in the DNS and the names can specified by each machine or
 centrally by associating a name with a MAC address or UID in the dnsmasq
 configuration file.</LI>
 </DIR>
 <P>
 The Router Advertisement subsystem provides basic autoconfiguration for IPv6 hosts. It can be used stand-alone or in conjunction with DHCPv6.
 <DIR>
 <LI> The M and O bits are configurable, to control hosts' use of DHCPv6.</LI>
 <LI> Router advertisements can include the RDNSS option.</LI>
 <LI> There is a mode which uses name information from DHCPv4 configuration to provide DNS entries
 for autoconfigured IPv6 addresses which would otherwise be anonymous.</LI>
 </DIR>
 <P>
 For extra compactness, unused features may be omitted at compile time.
-<H2>Building rpms.</H2>
+<H2>Get code.</H2>
 Assuming you have the relevant tools installed, you can rebuild .rpms simply by running (as root)
-<PRE>
+<A HREF="http://www.thekelleys.org.uk/dnsmasq/">Download</A> dnsmasq here. 
-rpmbuild -ta dnsmasq-xxx.tar.gz
+The tarball includes this documentation, source, and manpage.
-</PRE>
+There is also a <A HREF="CHANGELOG"> CHANGELOG</A> and a <A HREF="FAQ">FAQ</A>.
-Note for Suse users: you will need to re-compress the tar file as
+Dnsmasq has a git repository which contains the complete release
-bzip2 before building using the commands
+history of version 2 and development history from 2.60. You can 
-<PRE>
+<A HREF="http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=summary">browse</A>
-gunzip dnsmasq-xxx.tar.gz
+the repo, or get a copy using git protocol with the command
-bzip2 dnsmasq-zzz.tar
+
-</PRE>
+<PRE><TT>git clone git://thekelleys.org.uk/dnsmasq.git </TT></PRE>
 or
 <PRE><TT>git clone http://thekelleys.org.uk/git/dnsmasq.git </TT></PRE>
 <H2>Links.</H2>
 There is an article in German on dnsmasq at <A
 HREF="http://www.linuxnetmag.com/de/issue7/m7dnsmasq1.html">http://www.linuxnetmag.com/de/issue7/m7dnsmasq1.html</A>
 and Damien Raude-Morvan has one in French at <A HREF="http://www.drazzib.com/docs-dnsmasq.html">http://www.drazzib.com/docs-dnsmasq.html</A>
 There is a good article about dnsmasq at <A
 HREF="http://www.enterprisenetworkingplanet.com/netos/article.php/3377351">http://www.enterprisenetworkingplanet.com/netos/article.php/3377351</A>
 and Ilya Evseev has an article in Russian about dnsmasq to be found at <A HREF="http://ilya-evseev.narod.ru/articles/dnsmasq"> http://ilya-evseev.narod.ru/articles/dnsmasq</A>
 <H2>License.</H2>
-Dnsmasq is distributed under the GPL. See the file COPYING in the distribution 
+Dnsmasq is distributed under the GPL, version 2 or version 3 at your discretion. See the files COPYING and COPYING-v3 in the distribution 
 for details.
 <H2>Contact.</H2>
 There is a dnsmasq mailing list at <A
 HREF="http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss">
 http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss</A> which should be the
-first location for queries, bugreports, suggestions etc.
+first location for queries, bugreports, suggestions etc. The list is mirrored, with a
-Dnsmasq was written by Simon Kelley. You can contact me at <A
+search facility, at <A HREF="https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/">
 https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/</A>.
 You can contact me at <A
 HREF="mailto:simon@thekelleys.org.uk">simon@thekelleys.org.uk</A>.
 <H2>Donations.</H2>
 Dnsmasq is mainly written and maintained by Simon Kelley. For most of its life, dnsmasq has been a spare-time project. 
 These days I'm working on it as my main activity. 
 I don't have an employer or anyone who pays me regularly to work on dnsmasq. If you'd like to make 
 a contribution towards my expenses, please use the donation button below.
 <form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_top">
 <input type="hidden" name="cmd" value="_s-xclick">
 <input type="hidden" name="hosted_button_id" value="V3X9GVW5GX6DA">
 <input type="image" src="https://www.paypalobjects.com/en_US/GB/i/btn/btn_donateCC_LG.gif" border="0" name="submit" alt="PayPal – The safer, easier way to pay online.">
 <img alt="" border="0" src="https://www.paypalobjects.com/en_GB/i/scr/pixel.gif" width="1" height="1">
 </form>
 </BODY>
@@ -0,0 +1,12 @@
 Dnsmasq logo, contributed by Justin Clift.
 The source format is Inkscape SVG vector format, which is scalable and
 easy to export to other formats. For convenience I've included a 56x31
 png export and a 16x16 ico suitable for use as a web favicon.
 Simon Kelley, 22/10/2010
@@ -0,0 +1,157 @@
 <?xml version="1.0" encoding="UTF-8" standalone="no"?>
 <svg
   xmlns:dc="http://purl.org/dc/elements/1.1/"
   xmlns:cc="http://creativecommons.org/ns#"
   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
   xmlns:svg="http://www.w3.org/2000/svg"
   xmlns="http://www.w3.org/2000/svg"
   xmlns:xlink="http://www.w3.org/1999/xlink"
   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
   version="1.1"
   x="0px"
   y="0px"
   width="56"
   height="31"
   viewBox="0 0 56 31"
   enable-background="new 0 0 72.833 46.667"
   xml:space="preserve"
   id="svg2"
   inkscape:version="0.47 r22583"
   sodipodi:docname="dnsmasq_icon.svg"
   inkscape:export-filename="/x/centos_home/jc/workspace/git_repos/libvirt-media/libvirt-media/png/dnsmasq_icon.png"
   inkscape:export-xdpi="90"
   inkscape:export-ydpi="90"><metadata
   id="metadata27"><rdf:RDF><cc:Work
       rdf:about=""><dc:format>image/svg+xml</dc:format><dc:type
         rdf:resource="http://purl.org/dc/dcmitype/StillImage" /><dc:title></dc:title></cc:Work></rdf:RDF></metadata><defs
   id="defs25"><inkscape:perspective
   sodipodi:type="inkscape:persp3d"
   inkscape:vp_x="0 : 23.3335 : 1"
   inkscape:vp_y="0 : 1000 : 0"
   inkscape:vp_z="72.833 : 23.3335 : 1"
   inkscape:persp3d-origin="36.4165 : 15.555667 : 1"
   id="perspective4857" />
 	<filter
   id="filter3802"
   inkscape:label="filter1"
   color-interpolation-filters="sRGB" /><linearGradient
   inkscape:collect="always"
   xlink:href="#SVGID_3_"
   id="linearGradient4929"
   gradientUnits="userSpaceOnUse"
   x1="30.564501"
   y1="-8.8144999"
   x2="32.937"
   y2="32.715599" />
 		<linearGradient
   inkscape:collect="always"
   xlink:href="#SVGID_3_"
   id="linearGradient5798"
   gradientUnits="userSpaceOnUse"
   x1="30.564501"
   y1="-8.8144999"
   x2="32.937"
   y2="32.715599" /><linearGradient
   inkscape:collect="always"
   xlink:href="#SVGID_3_"
   id="linearGradient5812"
   gradientUnits="userSpaceOnUse"
   x1="30.564501"
   y1="-8.8144999"
   x2="32.937"
   y2="32.715599" /><filter
   id="filter6262"
   inkscape:label="Drop shadow"
   width="1.5"
   height="1.5"
   x="-0.25"
   y="-0.25"
   color-interpolation-filters="sRGB"><feGaussianBlur
     id="feGaussianBlur6264"
     in="SourceAlpha"
     stdDeviation="2.500000"
     result="blur" /><feColorMatrix
     id="feColorMatrix6266"
     result="bluralpha"
     type="matrix"
     values="1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0.500000 0 " /><feOffset
     id="feOffset6268"
     in="bluralpha"
     dx="2.700000"
     dy="2.600000"
     result="offsetBlur" /><feMerge
     id="feMerge6270"><feMergeNode
       id="feMergeNode6272"
       in="offsetBlur" /><feMergeNode
       id="feMergeNode6274"
       in="SourceGraphic" /></feMerge></filter></defs><sodipodi:namedview
   pagecolor="#ffffff"
   bordercolor="#666666"
   borderopacity="1"
   objecttolerance="10"
   gridtolerance="10"
   guidetolerance="10"
   inkscape:pageopacity="0"
   inkscape:pageshadow="2"
   inkscape:window-width="1568"
   inkscape:window-height="1076"
   id="namedview23"
   showgrid="false"
   inkscape:zoom="8"
   inkscape:cx="31.966768"
   inkscape:cy="21.211869"
   inkscape:window-x="567"
   inkscape:window-y="328"
   inkscape:window-maximized="0"
   inkscape:current-layer="layer1"
   inkscape:showpageshadow="false"
   showborder="true" />
 <g
   inkscape:groupmode="layer"
   id="layer1"
   inkscape:label="dnsmasq"
   style="display:inline"
   transform="translate(5.2838057,-15.545371)"><g
     id="g3790"
     transform="matrix(0.8183832,0,0,0.8183832,65.304897,9.8747678)"
     style="filter:url(#filter6262)"
     inkscape:export-xdpi="90"
     inkscape:export-ydpi="90"><g
       transform="translate(-91.018462,1.0687099)"
       id="g9">
 			<path
   style="fill:#6700ad"
   inkscape:connector-curvature="0"
   id="path11"
   d="M 54.997,12.151 C 50.083,9.132 43.29,7.266 35.791,7.266 c -7.5,0 -14.29,1.866 -19.204,4.885 -4.915,3.016 -7.956,7.184 -7.956,11.789 0,4.604 3.041,8.772 7.956,11.788 4.914,3.02 11.704,-4.271 19.204,-4.271 7.499,0 14.292,7.291 19.206,4.271 4.914,-3.016 7.955,-7.185 7.955,-11.788 0,-4.606 -3.041,-8.773 -7.955,-11.789 z M 24.996,24.318 c -2.698,0 -4.885,-0.922 -4.885,-2.061 0,-1.14 2.187,-2.063 4.885,-2.063 2.697,0 4.885,0.924 4.885,2.063 0,1.139 -2.188,2.061 -4.885,2.061 z m 21.501,0.191 c -2.686,0 -4.861,-0.856 -4.861,-1.912 0,-1.054 2.176,-1.911 4.861,-1.911 2.685,0 4.863,0.857 4.863,1.911 0,1.056 -2.178,1.912 -4.863,1.912 z" />
 			<path
   style="fill:none;stroke:#ffb616;stroke-width:1.85353255"
   inkscape:connector-curvature="0"
   id="path13"
   d="M 54.997,12.151 C 50.083,9.132 43.29,7.266 35.791,7.266 c -7.5,0 -14.29,1.866 -19.204,4.885 -4.915,3.016 -7.956,7.184 -7.956,11.789 0,4.604 3.041,8.772 7.956,11.788 4.914,3.02 11.704,-4.271 19.204,-4.271 7.499,0 14.292,7.291 19.206,4.271 4.914,-3.016 7.955,-7.185 7.955,-11.788 0,-4.606 -3.041,-8.773 -7.955,-11.789 z M 24.996,24.318 c -2.698,0 -4.885,-0.922 -4.885,-2.061 0,-1.14 2.187,-2.063 4.885,-2.063 2.697,0 4.885,0.924 4.885,2.063 0,1.139 -2.188,2.061 -4.885,2.061 z m 21.501,0.191 c -2.686,0 -4.861,-0.856 -4.861,-1.912 0,-1.054 2.176,-1.911 4.861,-1.911 2.685,0 4.863,0.857 4.863,1.911 0,1.056 -2.178,1.912 -4.863,1.912 z" />
 		</g><g
       transform="translate(-91.018462,1.0687099)"
       id="Layer_2">
 	<linearGradient
   y2="32.715599"
   x2="32.937"
   y1="-8.8144999"
   x1="30.564501"
   gradientUnits="userSpaceOnUse"
   id="SVGID_3_">
 		<stop
   id="stop17"
   style="stop-color:#FFFFFF;stop-opacity:0.73"
   offset="0" />
 		<stop
   id="stop19"
   style="stop-color:#FFFFFF;stop-opacity:0"
   offset="1" />
 	</linearGradient>
 	<path
   inkscape:connector-curvature="0"
   style="fill:url(#linearGradient5812)"
   id="path21"
   d="m 54.1,15.361 c -0.924,1.078 -2.782,1.265 -3.857,1.06 C 38,14.083 22.75,12.75 16.027,23.031 14.858,24.819 11.992,25.39 10.293,23.887 8.631,22.417 13.105,15.804 17.646,13.033 22.194,10.252 28.474,8.53 35.41,8.53 c 6.936,0 13.215,1.722 17.756,4.502 0.731,0.442 1.627,1.52 0.934,2.329 z" />
 </g></g></g></svg>
		`@@ -0,0 +1 @@`
							`debian/dnsmasq.runscript name=dnsmasq,logscript,presubj`
		`@@ -0,0 +1,2 @@`
							`# This file indicates dnsmasq (and not just dnsmasq-base) is installed.`
							`# It is an implementation detail of the dnsmasq init script.`