Remove limit in prefix length in --auth-zone.

CHANGELOG

@@ -40,6 +40,13 @@ version 2.67
 	    Generalise --interface-name to cope with IPv6 addresses
 	    and multiple addresses per interface per address family.
 
+	    Fix option parsing for --dhcp-host, which was generating a
+	    spurious error when all seven possible items were
+	    included. Thanks to Zhiqiang Wang for the bug report.
+
+	    Remove restriction on prefix-length in --auth-zone. Thanks
+	    to Toke Hoiland-Jorgensen for suggesting this.
+
 		
 version 2.66
             Add the ability to act as an authoritative DNS

debian/changelog

@@ -2,7 +2,13 @@ dnsmasq (2.67-1) unstable; urgency=low
 
    * New upstream.
 
- -- Simon Kelley <simon@thekelleys.org.uk>  Mon, 20 May 2013 11:50:22 +0000
+ -- Simon Kelley <simon@thekelleys.org.uk>  Tue, 28 May 2013 14:50:22 +0000
+
+dnsmasq (2.66-3) unstable; urgency=low
+
+   * Update resolvconf script for dnscrypt-proxy integration. (closes: #709179)
+
+ -- Simon Kelley <simon@thekelleys.org.uk>  Tue, 28 May 2013 14:39:51 +0000
 
 dnsmasq (2.66-2) unstable; urgency=low
 

debian/resolvconf

@@ -1,16 +1,14 @@
-#!/bin/bash
+#!/bin/sh
 #
 # Script to update the resolver list for dnsmasq
 #
-# N.B. Resolvconf may run us even if dnsmasq is not running.
+# N.B. Resolvconf may run us even if dnsmasq is not (yet) running.
-# If dnsmasq is installed then we go ahead and update
+# If dnsmasq is installed then we go ahead and update the resolver list
-# the resolver list in case dnsmasq is started later.
+# in case dnsmasq is started later.
 #
-# Assumption: On entry, PWD contains the resolv.conf-type files
+# Assumption: On entry, PWD contains the resolv.conf-type files.
 #
-# Requires bash because it uses a non-POSIX printf extension.
+# This file is part of the dnsmasq package.
-#
-# Licensed under the GNU GPL.  See /usr/share/common-licenses/GPL.
 #
 
 set -e
@@ -18,6 +16,8 @@ set -e
 RUN_DIR="/var/run/dnsmasq"
 RSLVRLIST_FILE="${RUN_DIR}/resolv.conf"
 TMP_FILE="${RSLVRLIST_FILE}_new.$$"
+MY_RECORD_NAME="lo.dnsmasq"
+DNSCRYPT_RECORD_NAME="lo.dnscrypt"
 
 [ -x /usr/sbin/dnsmasq ] || exit 0
 [ -x /lib/resolvconf/list-records ] || exit 1
@@ -27,7 +27,7 @@ PATH=/bin:/sbin
 report_err() { echo "$0: Error: $*" >&2 ; }
 
 # Stores arguments (minus duplicates) in RSLT, separated by spaces
-# Doesn't work properly if an argument itself contain whitespace
+# Doesn't work properly if an argument itself contains whitespace
 uniquify()
 {
 	RSLT=""
@@ -45,7 +45,22 @@ if [ ! -d "$RUN_DIR" ] && ! mkdir --parents --mode=0755 "$RUN_DIR" ; then
 	exit 1
 fi
 
-RSLVCNFFILES="$(/lib/resolvconf/list-records | sed -e '/^lo.dnsmasq$/d')"
+RSLVCNFFILES=""
+for F in $(/lib/resolvconf/list-records) ; do
+	case "$F" in
+	  "$MY_RECORD_NAME")
+		# Omit
+		;;
+	  "$DNSCRYPT_RECORD_NAME")
+		# Dnscrypt, I only have eyes for you
+		RSLVCNFFILES="$DNSCRYPT_RECORD_NAME"
+		break
+		;;
+	  *)
+		RSLVCNFFILES="${RSLVCNFFILES:+$RSLVCNFFILES }$F"
+		;;
+	esac
+done
 
 NMSRVRS=""
 if [ "$RSLVCNFFILES" ] ; then
@@ -56,8 +71,8 @@ fi
 # Dnsmasq uses the mtime of $RSLVRLIST_FILE, with a resolution of one second,
 # to detect changes in the file. This means that if a resolvconf update occurs
 # within one second of the previous one then dnsmasq may fail to notice the
-# more recent change.  To work around this problem we sleep here to ensure
+# more recent change. To work around this problem we sleep one second here
-# that the new mtime is different.
+# if necessary in order to ensure that the new mtime is different.
 if [ -f "$RSLVRLIST_FILE" ] && [ "$(ls -go --time-style='+%s' "$RSLVRLIST_FILE" | { read p h s t n ; echo "$t" ; })" = "$(date +%s)" ] ; then
 	sleep 1
 fi

man/dnsmasq.8

@@ -572,13 +572,16 @@ If you use the first DNSSEC mode, validating resolvers in clients,
 this option is not required. Dnsmasq always returns all the data
 needed for a client to do validation itself. 
 .TP
-.B --auth-zone=<domain>[,<subnet>[,<subnet>.....]]
+.B --auth-zone=<domain>[,<subnet>[/<prefix length>][,<subnet>[/<prefix length>].....]]
 Define a DNS zone for which dnsmasq acts as authoritative server. Locally defined DNS records which are in the domain
 will be served, except that A and AAAA records must be in one of the
 specified subnets, or in a subnet corresponding to a constructed DHCP
 range. The subnet(s) are also used to define in-addr.arpa and
-ipv6.arpa domains which are served for reverse-DNS queries. For IPv4
+ipv6.arpa domains which are served for reverse-DNS queries. If not
-subnets, the prefix length is limited to the values 8, 16 or 24.
+specified, the prefix length defaults to 24 for IPv4 and 64 for IPv6.
+For IPv4 subnets, the prefix length should be have the value 8, 16 or 24
+unless you are familiar with RFC 2317 and have arranged the
+in-addr.arpa delegation accordingly. 
 .TP
 .B --auth-soa=<serial>[,<hostmaster>[,<refresh>[,<retry>[,<expiry>]]]]
 Specify fields in the SOA record associated with authoritative

src/auth.c

@@ -520,10 +520,10 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n
 	      in_addr_t a = ntohl(subnet->addr4.s_addr) >> 8;
 	      char *p = name;
 	      
-	      if (subnet->prefixlen == 24)
+	      if (subnet->prefixlen >= 24)
 		p += sprintf(p, "%d.", a & 0xff);
 	      a = a >> 8;
-	      if (subnet->prefixlen != 8)
+	      if (subnet->prefixlen >= 16 )
 		p += sprintf(p, "%d.", a & 0xff);
 	      a = a >> 8;
 	      p += sprintf(p, "%d.in-addr.arpa", a & 0xff);

src/dnsmasq.c

@@ -1362,6 +1362,19 @@ static void check_dns_listeners(fd_set *set, time_t now)
 	      continue;
 	    }
 	  
+	  /* Make sure that the interface list is up-to-date.
+	     
+	     We do this here as we may need the results below, and
+	     the DNS code needs them for --interface-name stuff.
+
+	     Multiple calls to enumerate_interfaces() per select loop are
+	     inhibited, so calls to it in the child process (which doesn't select())
+	     have no effect. This avoids two processes reading from the same
+	     netlink fd and screwing the pooch entirely.
+	  */
+ 
+	  enumerate_interfaces(0);
+	  
 	  if (option_bool(OPT_NOWILD))
 	    iface = listener->iface; /* May be NULL */
 	  else 
@@ -1369,11 +1382,6 @@ static void check_dns_listeners(fd_set *set, time_t now)
 	      int if_index;
 	      char intr_name[IF_NAMESIZE];
 	      
-	       /* In full wildcard mode, need to refresh interface list.
-		  This happens automagically in CLEVERBIND */
-	       if (!option_bool(OPT_CLEVERBIND))
-		 enumerate_interfaces(0);
-	       
 	      /* if we can find the arrival interface, check it's one that's allowed */
 	      if ((if_index = tcp_interface(confd, tcp_addr.sa.sa_family)) != 0 &&
 		  indextoname(listener->tcpfd, if_index, intr_name))

src/network.c

@@ -438,7 +438,9 @@ int enumerate_interfaces(int reset)
   struct addrlist *addr, *tmp;
   struct interface_name *intname;
   
-  /* DO this max once per select cycle */
+  /* Do this max once per select cycle  - also inhibits netlink socket use
+   in TCP child processes. */
+  
   if (reset)
     {
       done = 0;

src/option.c

@@ -1637,8 +1637,6 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
 	    
 	    if (inet_pton(AF_INET, arg, &subnet->addr4))
 	      {
-		if ((prefixlen & 0x07) != 0 || prefixlen > 24)
-		  ret_err(_("bad prefix"));
 		subnet->prefixlen = (prefixlen == 0) ? 24 : prefixlen;
 		subnet->is6 = 0;
 	      }
@@ -2510,7 +2508,7 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
     case 'G':  /* --dhcp-host */
       {
 	int j, k = 0;
-	char *a[6] = { NULL, NULL, NULL, NULL, NULL, NULL };
+	char *a[7] = { NULL, NULL, NULL, NULL, NULL, NULL, NULL };
 	struct dhcp_config *new;
 	struct in_addr in;
 	
@@ -2522,7 +2520,7 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
 	new->netid = NULL;
 
 	if ((a[0] = arg))
-	  for (k = 1; k < 6; k++)
+	  for (k = 1; k < 7; k++)
 	    if (!(a[k] = split(a[k-1])))
 	      break;