Close debian bug.

Make --filter-rr=ANY filter the answer to ANY queries.
Thanks to Dominik Derigs for an earlier patch which inspired this.
2026-11-04 13:48:30 +00:00 · 2024-02-12 23:11:03 +00:00 · 2024-02-12 20:45:20 +00:00 · 2024-02-12 13:42:07 +00:00 · 2024-02-07 14:44:49 +00:00 · 2024-02-05 22:33:09 +00:00
174 changed files with 45973 additions and 23392 deletions
@@ -0,0 +1 @@
+VERSION export-subst
@@ -4,11 +4,18 @@ src/dnsmasq.pot
 src/dnsmasq
 src/dnsmasq_baseline
 src/.copts_*
-contrib/wrt/dhcp_lease_time
-contrib/wrt/dhcp_release
-debian/base/
-debian/daemon/
+contrib/lease-tools/dhcp_lease_time
+contrib/lease-tools/dhcp_release
+contrib/lease-tools/dhcp_release6
+debian/.debhelper
+debian/auto-build
+debian/debhelper-build-stamp
 debian/files
-debian/substvars
-debian/utils-substvars
-debian/utils/
+debian/*.substvars
+debian/*.debhelper
+debian/*.log
+debian/dnsmasq-base-lua/
+debian/dnsmasq-base/
+debian/dnsmasq-utils/
+debian/dnsmasq/
+debian/tmp
@@ -56,7 +56,7 @@ release 0.95  Major rewrite: remove calls to gethostbyname() and talk
              any more memory after start-up. The NAT-like forwarding was
              inspired by a suggestion from Eli Chen <eli@routefree.com>

-release 0.96  Fixed embarrasing thinko in cache linked-list code.
+release 0.96  Fixed embarrassing thinko in cache linked-list code.
                             
 release 0.98  Some enhancements and bug-fixes. 
              Thanks to "Denis Carre" <denis.carre@laposte.net> and Martin 
@@ -78,7 +78,7 @@ release 0.98  Some enhancements and bug-fixes.
                  ids, to thwart DNS spoofers.
              (7) Dnsmasq no longer forwards queries when the 
 	          "recursion desired" bit is not set in the header.
-	      (8) Fixed getopt code to work on compliers with unsigned char.
+	      (8) Fixed getopt code to work on compilers with unsigned char.
              
 release 0.991 Added -b flag: when set causes dnsmasq to always answer
 	      reverse queries on the RFC 1918 private IP space itself and
@@ -88,7 +88,7 @@ release 0.991 Added -b flag: when set causes dnsmasq to always answer
              Fixed a bug which stopped dnsmasq working on a box with
              two or more interfaces with the same IP address. 

-              Fixed cacheing of CNAMEs. Previously, a CNAME which pointed
+              Fixed caching of CNAMEs. Previously, a CNAME which pointed
              to  a name with many A records would not have all the addresses
              returned when being answered from the cache.

@@ -191,7 +191,7 @@ release 1.1   Added --user argument to allow user to change to

 release 1.2   Added IPv6 DNS record support. AAAA records are cached
              and read from /etc/hosts. Reverse-lookups in the
-	      ip6.int and ip6.arpa domains are suppored. Dnsmasq can
+	      ip6.int and ip6.arpa domains are supported. Dnsmasq can
              talk to upstream servers via IPv6 if it finds IP6 addresses
              in /etc/resolv.conf and it offers DNS service automatically
              if IPv6 support is present in the kernel.
@@ -214,7 +214,7 @@ release 1.3   Some versions of the Linux kernel return EINVAL rather
              starting, rather than after the first query - principle 
              of least surprise applies here.     

-release 1.4   Fix a bug with DHPC lease parsing which broke in
+release 1.4   Fix a bug with DHCP lease parsing which broke in
              non-UTC timezones. Thanks to Mark Wormgoor for
              spotting and diagnosing this. Fixed versions in
              the .spec files this time. Fixed bug in Suse startup
@@ -258,7 +258,7 @@ release 1.7   Fix a problem with cache not clearing properly
              on receipt of SIGHUP. Bug spotted by Sat Deshpande.

              In group-id changing code:
-	      1) Drop supplimentary groups.
+	      1) Drop supplementary groups.
              2) Change gid before dropping root (patch from Soewono Effendi.)
              3) Change group to "dip" if it exists, to allow access
                 to /etc/ppp/resolv.conf (suggestion from Jorg Sommer.)
@@ -297,7 +297,7 @@ release 1.9   Fixes to rpm .spec files.
              required. The difference is not really visible with
              bloated libcs like glibc, but should dramatically reduce
              memory requirements when linked against ulibc for use on
-              embeded routers, and that's the point really. Thanks to
+              embedded routers, and that's the point really. Thanks to
              Matthew Natalier for prompting this.   

 	      Changed debug mode (-d) so that all logging appears on
@@ -319,12 +319,12 @@ release 1.9   Fixes to rpm .spec files.
              uClinux. Thanks to Matthew Natalier for uClinux stuff. 

 release 1.10  Log warnings if resolv.conf or dhcp.leases are not
-              accessable for any reason, as suggested by Hinrich Eilts.
+              accessible for any reason, as suggested by Hinrich Eilts.

 	      Fixed wrong address printing in error message about
 	      no interface with address.

-	      Updated docs and split installation instuctions into setup.html.
+	      Updated docs and split installation instructions into setup.html.

 	      Fix bug in CNAME chasing code: One CNAME pointing
 	      to many A records would lose A records after the 
@@ -346,7 +346,7 @@ release 1.10  Log warnings if resolv.conf or dhcp.leases are not

 	      Added -S option to directly specify upstream servers and
              added ability to direct queries for specific domains to
-              specfic servers. Suggested by Jens Vonderheide.
+              specific servers. Suggested by Jens Vonderheide.

 	      Upgraded random ID generation - patch from Rob Funk.	      

@@ -386,13 +386,13 @@ release 1.11  Actually implement the -R flag promised in the 1.10 man page.
              names in /etc/hosts -suggestion from Phil Harman.

 	      Always return a zero time-to-live for names derived from 
-	      DHCP which stops anthing else caching these
+	      DHCP which stops anything else caching these
              names. Previously the TTL was derived from the lease
              time but that is incorrect since a lease can be given
              up early: dnsmasq would know this but anything with the
              name cached with long TTL would not be updated.

-	      Extended HAVE_IPV6 config flag to allow compliation on
+	      Extended HAVE_IPV6 config flag to allow compilation on
 	      old systems which don't have modern library routines
 	      like inet_ntop(). Thanks to Phil Harman for the patch.

@@ -471,7 +471,7 @@ release 1.14  Fixed man page description of -b option which confused
 	      /etc/resolv.conf.
 	      (Thanks to Klaas Teschauer)
 	      
-	      Check that recieved queries have only rfc1035-legal characters
+	      Check that received queries have only rfc1035-legal characters
 	      in them. This check is mainly to avoid bad strings being
 	      sent to syslog.

@@ -549,7 +549,7 @@ release 1.16  Allow "/" characters in domain names - this fixes

 release 1.17  Fixed crash with DHCP hostnames > 40 characters.

-              Fixed name-comparision routines to not depend on Locale,
+              Fixed name-comparison routines to not depend on Locale,
              in theory this versions since 1.15 could lock up or give
              wrong results when run with locale != 'C'.

@@ -574,7 +574,7 @@ release 1.18  Added round-robin DNS for names which have more than one
 	      forwarded because -D is in effect, return NXDOMAIN not
 	      an empty reply.

-	      Add code to return the software version in repsonse to the
+	      Add code to return the software version in response to the
 	      correct magic query in the same way as BIND. Use  
 	      "dig version.bind chaos txt" to make the query.

@@ -635,7 +635,7 @@ release 2.0
             dynamic allocation.

 	     Allow dhcp-host options for the same host with different
-	     IP adresses where the correct one will be selected for
+	     IP addresses where the correct one will be selected for
 	     the network the host appears on.

 	     Fix parsing of --dhcp-option to allow more than one
@@ -674,7 +674,7 @@ release 2.1
             
             Fix unaligned access warnings on BSD/Alpha.

-	     Allow empty DHCP options, like so: dhpc-option=44
+	     Allow empty DHCP options, like so: dhcp-option=44
 
             Allow single-byte DHCP options like so: dhcp-option=20,1

@@ -745,7 +745,7 @@ release 2.3
 	     around a bug in the DHCP client in HP Jetdirect printers.
 	     Thanks to Marko Stolle for finding this problem.

-	     Return DHCP T1 and T2 times, with "fuzz" to desychronise lease
+	     Return DHCP T1 and T2 times, with "fuzz" to desynchronise lease
 	     renewals, as specified in the RFC.
 	     
 	     Ensure that the END option is always present in DHCP
@@ -838,7 +838,7 @@ release 2.4
 	     by Chad Skeeters.

 	     Fixed bug in /etc/ethers parsing code triggered by tab
-	     characters. Qudos to Dag Wieers for hepling to nail that
+	     characters. Kudos to Dag Wieers for helping to nail that
 	     one.
 	     
 	     Added "bind-interfaces" option correctly.	     
@@ -975,7 +975,7 @@ release 2.8
 	     configuration. Specifically: (1) options are matched on
 	     the netids from dhcp-range, dhcp-host, vendor class and
 	     user class(es). Multiple net-ids are allowed and options
-	     are searched on them all. (2) matches agains vendor class
+	     are searched on them all. (2) matches against vendor class
 	     and user class are now on a substring, if the given
 	     string is a substring of the vendor/user class, then a
 	     match occurs. Thanks again to Richard Musil for prompting
@@ -997,7 +997,7 @@ release 2.8

 	     Add checks against DHCP clients which return zero-length
 	     hostnames. This avoids the potential lease-loss problems
-	     reffered to above. Also, if a client sends a hostname when
+	     referred to above. Also, if a client sends a hostname when
 	     it creates a lease but subsequently sends no or a
 	     zero-length hostname whilst renewing, continue to use the
 	     existing hostname, don't wipe it out. 
@@ -1010,7 +1010,7 @@ release 2.9
 	     but to the address of another interface were ignored
 	     unless the loopback interface was explicitly configured.
 	     2) on OpenBSD failure to configure one interface now
-	     causes a fatal error on startup rather than an huge
+	     causes a fatal error on startup rather than a huge
 	     stream of log messages. Thanks to Erik Jan Tromp for 
 	     finding that bug.

@@ -1019,7 +1019,7 @@ release 2.9
 	     broken. The new algorithm is to pick as before for the
 	     first try, but if a query is retried, to send to all
 	     available servers in parallel. The first one to reply
-	     then becomes prefered for the next query. This should 
+	     then becomes preferred for the next query. This should 
 	     improve reliability without generating significant extra
 	     upstream load.

@@ -1027,7 +1027,7 @@ release 2.9
 	     unqualified domains introduced in version 2.8 
 	      
 	     Allow fallback to "bind-interfaces" at runtime: Some
-	     verions of *BSD seem to have enough stuff in the header
+	     versions of *BSD seem to have enough stuff in the header
 	     files to build but no kernel support. Also now log if
 	     "bind-interfaces" is forced on.

@@ -1049,7 +1049,7 @@ release 2.9
 	     first name found is now returned for reverse lookups,
 	     rather than all of them.

-	     Add back fatal errors when nonexistant 
+	     Add back fatal errors when nonexistent 
 	     interfaces or interface addresses are given but only in
 	     "bind-interfaces" mode. Principle of least surprise applies.
 	     
@@ -1193,7 +1193,7 @@ version 2.14

 version 2.15
            Fixed NXDOMAIN/NODATA confusion for locally known
-            names. We now return a NODATA reponse for names which are
+            names. We now return a NODATA response for names which are
            locally known. Now a query for (eg AAAA or MX) for a name
 	    with an IPv4 address in /etc/hosts which fails upstream
            will generate a NODATA response. Note that the query 
@@ -1229,7 +1229,7 @@ version 2.16

            Set NONBLOCK on all listening sockets to workaround non-POSIX
            compliance in Linux 2.4 and 2.6. This fixes rare hangs which
-            occured when corrupted packets were received. Thanks to
+            occurred when corrupted packets were received. Thanks to
 	    Joris van Rantwijk for chasing that down.
 
 	    Updated config.h for NetBSD. Thanks to Martin Lambers.
@@ -1297,7 +1297,7 @@ version 2.18
 	    interfaces with more than one IPv6 address. Thanks to
            Martin Pels for help with that.

-	    Fix problems which occured when more than one dhcp-range
+	    Fix problems which occurred when more than one dhcp-range
 	    was specified in the same subnet: sometimes parameters
 	    (lease time, network-id tag) from the wrong one would be
 	    used. Thanks to Rory Campbell-Lange for the bug report.
@@ -1314,7 +1314,7 @@ version 2.19
 	    Thanks to Richard Atterer for the bug report.

 	    Check for under-length option fields in DHCP packets, a
-	    zero length client-id, in particluar, could seriously
+	    zero length client-id, in particular, could seriously
 	    confuse dnsmasq 'till now. Thanks to Will Murname for help
 	    with that.

@@ -1389,7 +1389,7 @@ version 2.21
 	    recursive queries.

 	    Fix DHCP address allocation problem when netid tags are in
-	    use. Thanks to Will Murnane for the bug report and
+	    use. Thanks to Will Murname for the bug report and
 	    subsequent testing.

 	    Add an additional data section to the reply for MX and SRV
@@ -1505,7 +1505,7 @@ version 2.23
            from dnsmasq --version. Thanks to Dirk Schenkewitz for 
            the suggestion. 

-	    Fix pathalogical behaviour when a broken client keeps sending
+	    Fix pathological behaviour when a broken client keeps sending
            DHCPDISCOVER messages repeatedly and fast. Because dealing with
            each of these takes a few seconds, (because of the ping) then a 
 	    queue of DHCP packets could build up. Now, the results of a ping 
@@ -1593,7 +1593,7 @@ version 2.24
 	    than one dhcp-range is available. Thanks to Sorin Panca
 	    for help chasing this down.

-	    Added more explict error mesages to the hosts file and
+	    Added more explicit error messages to the hosts file and
 	    ethers file reading code. Markus Kaiserswerth suffered to
 	    make this happen.

@@ -1617,7 +1617,7 @@ version 2.25

            Fixed Suse spec file - thanks to Steven Springl.

-	    Fixed DHCP bug when two distict subnets are on the same
+	    Fixed DHCP bug when two distinct subnets are on the same
 	    physical interface. Thanks to Pawel Zawora for finding
 	    this and suggesting the fix.

@@ -1740,7 +1740,7 @@ version 2.28
 	    Fixed regression in netlink code under 2.2.x kernels which 
 	    occurred in 2.27. Erik Jan Tromp is the vintage kernel fan 
 	    who found this. P.S. It looks like this "netlink bind:
-	    permission denied" problem occured in kernels at least as
+	    permission denied" problem occurred in kernels at least as
 	    late a 2.4.18. Good information from Alain Richoux.

 	    Added a warning when it's impossible to give a host its
@@ -1761,7 +1761,7 @@ version 2.28
 	    Eric House and Eric Spakman for help in chasing this down.

 	    Tolerate configuration screwups which lead to the DHCP
-	    server attemping to allocate its own address to a
+	    server attempting to allocate its own address to a
 	    client; eg setting the whole subnet range as a DHCP
 	    range. Addresses in use by the server are now excluded
 	    from use by clients.
@@ -2067,7 +2067,7 @@ version 2.36
 	    kernel. Thanks to Philip Wall for the bug report.

 	    Added --dhcp-bridge option, but only to the FreeBSD
-	    build. This fixes an oddity with a a particular bridged
+	    build. This fixes an oddity with a particular bridged
 	    network configuration on FreeBSD. Thanks to Luigi Rizzo
 	    for the patch.

@@ -2273,7 +2273,7 @@ version 2.40
 	    this.

 	    Use client-id as hash-seed for DHCP address allocation
-	    with Firewire and Infiniband, as these don't supply an MAC
+	    with Firewire and InfiniBand, as these don't supply a MAC
 	    address. 

 	    Tweaked TFTP file-open code to make it behave sensibly
@@ -2307,7 +2307,7 @@ version 2.40
 	    Continue to use unqualified hostnames provided by DHCP
 	    clients, even if the domain part is illegal. (The domain
 	    is	ignored, and an error logged.) Previously in this
-	    situation, the whole name whould have been
+	    situation, the whole name would have been
 	    rejected. Thanks to Jima for the patch.
 	    
 	    Handle EINTR returns from wait() correctly and reap
@@ -2319,7 +2319,7 @@ version 2.40
 	    leases file and passed to the lease-change
 	    script. Suggestion from Ben Voigt.

-	    Re-run the lease chamge script with an "old" event for
+	    Re-run the lease change script with an "old" event for
 	    each lease when dnsmasq receives a SIGHUP.

 	    Added more useful exit codes, including passing on a
@@ -2417,7 +2417,7 @@ version 2.41
 	    Changed behavior of DHCP server to always return total length of
 	    a new lease in DHCPOFFER, even if an existing lease
 	    exists. (It used to return the time remaining on the lease
-	    whne one existed.) This fixes problems with the Sony Ericsson
+	    when one existed.) This fixes problems with the Sony Ericsson
 	    K610i phone. Thanks to Hakon Stordahl for finding and
 	    fixing this.

@@ -2433,7 +2433,7 @@ version 2.41

 	    Add --dhcp-match flag, to check for arbitrary options in
 	    DHCP messages from clients. This enables use of dnsmasq
-	    with gPXE. Thanks to Rance Hall for the suggestion.
+	    with iPXE. Thanks to Rance Hall for the suggestion.

 	    Added --dhcp-broadcast, to force broadcast replies to DHCP
 	    clients which need them but are too dumb or too old to
@@ -2476,7 +2476,7 @@ version 2.42

 	    Fix OS detection logic to cope with GNU/FreeBSD.

-	    Fix unitialised variable in DBus code - thanks to Roy
+	    Fix uninitialised variable in DBus code - thanks to Roy
 	    Marples.

 	    Fix network enumeration code to work on later NetBSD -
@@ -1,12 +1,12 @@
-		    GNU GENERAL PUBLIC LICENSE
-		       Version 2, June 1991
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991

- Copyright (C) 1989, 1991 Free Software Foundation, Inc.
-                       59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

-			    Preamble
+                            Preamble

  The licenses for most software are designed to take away your
 freedom to share and change it.  By contrast, the GNU General Public
@@ -15,7 +15,7 @@ software--to make sure the software is free for all its users.  This
 General Public License applies to most of the Free Software
 Foundation's software and to any other program whose authors commit to
 using it.  (Some other Free Software Foundation software is covered by
-the GNU Library General Public License instead.)  You can apply it to
+the GNU Lesser General Public License instead.)  You can apply it to
 your programs, too.

  When we speak of free software, we are referring to freedom, not
@@ -55,8 +55,8 @@ patent must be licensed for everyone's free use or not licensed at all.

  The precise terms and conditions for copying, distribution and
 modification follow.
-
-		    GNU GENERAL PUBLIC LICENSE
+
+                    GNU GENERAL PUBLIC LICENSE
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

  0. This License applies to any program or other work which contains
@@ -110,7 +110,7 @@ above, provided that you also meet all of these conditions:
    License.  (Exception: if the Program itself is interactive but
    does not normally print such an announcement, your work based on
    the Program is not required to print an announcement.)
-
+
 These requirements apply to the modified work as a whole.  If
 identifiable sections of that work are not derived from the Program,
 and can be reasonably considered independent and separate works in
@@ -168,7 +168,7 @@ access to copy from a designated place, then offering equivalent
 access to copy the source code from the same place counts as
 distribution of the source code, even though third parties are not
 compelled to copy the source along with the object code.
-
+
  4. You may not copy, modify, sublicense, or distribute the Program
 except as expressly provided under this License.  Any attempt
 otherwise to copy, modify, sublicense or distribute the Program is
@@ -225,7 +225,7 @@ impose that choice.

 This section is intended to make thoroughly clear what is believed to
 be a consequence of the rest of this License.
-
+
  8. If the distribution and/or use of the Program is restricted in
 certain countries either by patents or by copyrighted interfaces, the
 original copyright holder who places the Program under this License
@@ -255,7 +255,7 @@ make exceptions for this.  Our decision will be guided by the two goals
 of preserving the free status of all derivatives of our free software and
 of promoting the sharing and reuse of software generally.

-			    NO WARRANTY
+                            NO WARRANTY

  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
 FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
@@ -277,9 +277,9 @@ YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
 PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGES.

-		     END OF TERMS AND CONDITIONS
-
-	    How to Apply These Terms to Your New Programs
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs

  If you develop a new program, and you want it to be of the greatest
 possible use to the public, the best way to achieve this is to make it
@@ -291,7 +291,7 @@ convey the exclusion of warranty; and each file should have at least
 the "copyright" line and a pointer to where the full notice is found.

    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) 19yy  <name of author>
+    Copyright (C) <year>  <name of author>

    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -303,17 +303,16 @@ the "copyright" line and a pointer to where the full notice is found.
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

 Also add information on how to contact you by electronic and paper mail.

 If the program is interactive, make it output a short notice like this
 when it starts in an interactive mode:

-    Gnomovision version 69, Copyright (C) 19yy name of author
+    Gnomovision version 69, Copyright (C) year name of author
    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
    This is free software, and you are welcome to redistribute it
    under certain conditions; type `show c' for details.
@@ -336,5 +335,5 @@ necessary.  Here is a sample; alter the names:
 This General Public License does not permit incorporating your program into
 proprietary programs.  If your program is a subroutine library, you may
 consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Library General
+library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.
@@ -9,7 +9,7 @@ A: The high ports that dnsmasq opens are for replies from the upstream
   from port 53 the replies would be _to_ port 53 and get blocked.

   This is not a security hole since dnsmasq will only accept replies to that
-   port: queries are  dropped. The replies must be to oustanding queries
+   port: queries are dropped. The replies must be to outstanding queries
   which dnsmasq has forwarded, otherwise they are dropped too.
 
   Addendum: dnsmasq now has the option "query-port" (-Q), which allows
@@ -59,7 +59,7 @@ A: Yes, there is explicit support for *BSD and MacOS X and Solaris.
 
 Q: My company's nameserver knows about some names which aren't in the
   public DNS. Even though I put it first in /etc/resolv.conf, it
-   dosen't work: dnsmasq seems not to use the nameservers in the order
+   doesn't work: dnsmasq seems not to use the nameservers in the order
   given. What am I doing wrong?

 A: By default, dnsmasq treats all the nameservers it knows about as
@@ -144,19 +144,19 @@ Q: Who are Verisign, what do they have to do with the bogus-nxdomain
   option in dnsmasq and why should I wory about it?

 A: [note: this was written in September 2003, things may well change.]
-   Versign run the .com and .net top-level-domains. They have just
+   Verisign run the .com and .net top-level-domains. They have just
   changed the configuration of their servers so that unknown .com and
   .net domains, instead of returning an error code NXDOMAIN, (no such
-   domain) return the address of a host at Versign which runs a web
+   domain) return the address of a host at Verisign which runs a web
   server showing a search page. Most right-thinking people regard
   this new behaviour as broken :-).  You can test to see if you are
-   suffering Versign brokeness by run a command like 
+   suffering Verisign brokenness by run a command like 
   
   host jlsdajkdalld.com

   If you get "jlsdajkdalld.com" does not exist, then all is fine, if
   host returns an IP address, then the DNS is broken. (Try a few
-   different unlikely domains, just in case you picked a wierd one
+   different unlikely domains, just in case you picked a weird one
   which really _is_ registered.)

   Assuming that your DNS is broken, and you want to fix it, simply
@@ -180,7 +180,7 @@ A: There are a couple of configuration gotchas which have been
   whilst the ISC one works.

   The first thing to check is the broadcast address set for the
-   ethernet interface. This is normally the adddress on the connected
+   ethernet interface. This is normally the address on the connected
   network with all ones in the host part. For instance if the 
   address of the ethernet interface is 192.168.55.7 and the netmask
   is 255.255.255.0 then the broadcast address should be
@@ -205,7 +205,7 @@ A: By default, none of the DHCP clients send the host-name when asking
   send with the "hostname" keyword in /etc/network/interfaces. (See
   "man interfaces" for details.) That doesn't work for dhclient, were
   you have to add something like "send host-name daisy" to
-   /etc/dhclient.conf [Update: the lastest dhcpcd packages _do_ send
+   /etc/dhclient.conf [Update: the latest dhcpcd packages _do_ send
   the hostname by default.

 Q: I'm network booting my machines, and trying to give them static
@@ -236,11 +236,11 @@ Q: What network types are supported by the DHCP server?
 A: Ethernet (and 802.11 wireless) are supported on all platforms. On
   Linux all network types (including FireWire) are supported.

-Q: What are these strange "bind-interface" and "bind-dynamic" options?
+Q: What are these strange "bind-interfaces" and "bind-dynamic" options?

 A: Dnsmasq from v2.63 can operate in one of three different "networking
   modes". This is unfortunate as it requires users configuring dnsmasq
-   to take into account some rather bizzare contraints and select the
+   to take into account some rather bizarre constraints and select the
   mode which best fits the requirements of a particular installation.
   The origin of these are deficiencies in the Unix networking
   model and APIs and each mode has different advantages and
@@ -252,10 +252,10 @@ A: Dnsmasq from v2.63 can operate in one of three different "networking
   The three modes are "wildcard", "bind-interfaces" and "bind-dynamic".

   In "wildcard" mode, dnsmasq binds the wildcard IP address (0.0.0.0 or
-   ::). This allows it to recieve all the packets sent to the server on
+   ::). This allows it to receive all the packets sent to the server on
   the relevant port. Access control (--interface, --except-interface,
   --listen-address, etc) is implemented by dnsmasq: it queries the
-   kernel to determine the interface on which a packet was recieved and
+   kernel to determine the interface on which a packet was received and
   the address to which it was sent, and applies the configured
   rules. Wildcard mode is the default if neither of the other modes are
   specified. 
@@ -276,7 +276,7 @@ A: Dnsmasq from v2.63 can operate in one of three different "networking
   The mode chosen has four different effects: co-existence with other
   servers, semantics of --interface access control, effect of new
   interfaces, and legality of --interface specifications for
-   non-existent inferfaces. We will deal with these in order.
+   non-existent interfaces. We will deal with these in order.

   A dnsmasq instance running in wildcard mode precludes a machine from
   running a second instance of dnsmasq or any other DNS, TFTP or DHCP
@@ -297,7 +297,7 @@ A: Dnsmasq from v2.63 can operate in one of three different "networking
   by dnsmasq when in --bind-interfaces mode. In wildcard or bind-dynamic
   mode, such interfaces are handled normally.

-   A --interface specification for a non-existent interface is a fatal
+   An --interface specification for a non-existent interface is a fatal
   error at start-up when in --bind-interfaces mode, by just generates a
   warning in wildcard or bind-dynamic mode.

@@ -313,15 +313,25 @@ Q: Can I get email notification when a new version of dnsmasq is
   released?

 A: Yes, new releases of dnsmasq are always announced through
-   freshmeat.net, and they allow you to subcribe to email alerts when
+   freshmeat.net, and they allow you to subscribe to email alerts when
   new versions of particular projects are released. New releases are
   also announced in the dnsmasq-discuss mailing list, subscribe at 
   http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss

 Q: What does the dhcp-authoritative option do? 

-A: See http://www.isc.org/files/auth.html - that's
-   for the ISC daemon, but the same applies to dnsmasq.
+A: The DHCP spec says that when a DHCP server receives a renewal request
+   from a client it has no knowledge of, it should just ignore it.
+   This is because it's supported to have more than one DHCP server
+   on a network, and another DHCP server may be dealing with the client.
+   This has the unfortunate effect that when _no_ DHCP replies to 
+   the client, it takes some time for the client to time-out and start 
+   to get a new lease. Setting this option makes dnsmasq violate the
+   standard to the extent that it will send a NAK reply to the client, 
+   causing it to immediately start to get a new lease. This improves 
+   behaviour when machines move networks, and in the case that the DHCP
+   lease database is lost. As long as there are not more tha one DHCP
+   server on the network, it's safe to enable the option.

 Q: Why does my Gentoo box pause for a minute before getting a new
   lease?
@@ -349,18 +359,64 @@ A: By default, the identity of a machine is determined by using the
   method for setting the client-id varies with DHCP client software,
   dhcpcd uses the "-I" flag. Windows uses a registry setting,
   see http://www.jsiinc.com/SUBF/TIP2800/rh2845.htm
+
 Addendum:
   From version 2.46, dnsmasq has a solution to this which doesn't
   involve setting client-IDs. It's possible to put more than one MAC
   address in a --dhcp-host configuration. This tells dnsmasq that it
   should use the specified IP for any of the specified MAC addresses,
-   and furthermore it gives dnsmasq permission to sumarily abandon a
+   and furthermore it gives dnsmasq permission to summarily abandon a
   lease to one of the MAC addresses if another one comes along. Note
   that this will work fine only as longer as only one interface is
   up at any time. There is no way for dnsmasq to enforce this
   constraint: if you configure multiple MAC addresses and violate 
   this rule, bad things will happen.

+Addendum-II: The link above is dead, the former contents of the link are:
+
+------------------------------------------------------------------------------
+How can I keep the same DHCP client reservation, if the MAC address changes?
+
+When you reserve an IP address for a DHCP client, you provide the
+MAC address of the client's NIC.
+
+It is possible to use a custom identifier, which is sent as 
+option 61 in the client's DHCP Discover and Request packet.
+
+The DhcpClientIdentifier is a REG_DWORD value that is located at:
+
+Windows NT 4.0 SP2+
+
+HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<Adapter Name>'X'\Parameters\Tcpip
+
+where <Adapter Name> is the NIC driver name and 'X' is the number of the NIC.
+
+Windows 2000
+
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TcpIp\Parameters\Interfaces\<NIC GUID>
+
+where <NIC GUID> is the GUID of the NIC.
+
+The valid range of data is 0x0 - 0xFFFFFFFF. The custom identifier is send as 4 bytes, 
+8 hexadecimal character, in groups of 2 hexadecimal characters, with the groups being 
+sent in reverse order. If the custom identifier is less than 8 hexadeciaml characters, 
+it is zero padded at the end. Examples:
+
+Custom Client                 Client Reservation
+Identifier                    on DHCP Server
+12345678                      78563412
+123456                        56341200
+1234                          34120000
+1234567                       67452301
+12345                         45230100
+123                           23010000
+A18F42                        428FA100
+CF432                         32F40C00
+C32D1BE                       BED1320C
+
+-------------------------------------------------------------------------------------------------------
+
+
 Q: Can dnsmasq do DHCP on IP-alias interfaces?

 A: Yes, from version-2.21. The support is only available running under
@@ -488,7 +544,7 @@ Q: DHCP doesn't work with windows 7 but everything else is fine.

 A: There seems to be a problem if Windows 7 doesn't get a value for
   DHCP option 252 in DHCP packets it gets from the server. The
-   symtoms have beeen variously reported as continual DHCPINFORM
+   symptoms have been variously reported as continual DHCPINFORM
   requests in an attempt to get an option-252, or even ignoring DHCP
   offers completely (and failing to get an IP address) if there is no
   option-252 supplied. DHCP option 252 is for WPAD, WWW Proxy 
@@ -1,4 +1,4 @@
-# dnsmasq is Copyright (c) 2000-2015 Simon Kelley
+# dnsmasq is Copyright (c) 2000-2024 Simon Kelley
 #
 #  This program is free software; you can redistribute it and/or modify
 #  it under the terms of the GNU General Public License as published by
@@ -29,6 +29,7 @@ LDFLAGS       =
 COPTS         = 
 RPM_OPT_FLAGS = 
 LIBS          = 
+LUA           = lua

 #################################################################

@@ -53,17 +54,26 @@ top?=$(CURDIR)

 dbus_cflags =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DBUS $(PKG_CONFIG) --cflags dbus-1` 
 dbus_libs =     `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DBUS $(PKG_CONFIG) --libs dbus-1` 
+ubus_libs =     `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_UBUS "" --copy '-lubox -lubus'`
 idn_cflags =    `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_IDN $(PKG_CONFIG) --cflags libidn` 
 idn_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_IDN $(PKG_CONFIG) --libs libidn` 
+idn2_cflags =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LIBIDN2 $(PKG_CONFIG) --cflags libidn2`
+idn2_libs =     `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LIBIDN2 $(PKG_CONFIG) --libs libidn2`
 ct_cflags =     `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_CONNTRACK $(PKG_CONFIG) --cflags libnetfilter_conntrack`
 ct_libs =       `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_CONNTRACK $(PKG_CONFIG) --libs libnetfilter_conntrack`
-lua_cflags =    `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LUASCRIPT $(PKG_CONFIG) --cflags lua5.1` 
-lua_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LUASCRIPT $(PKG_CONFIG) --libs lua5.1` 
-nettle_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC $(PKG_CONFIG) --cflags nettle hogweed`
-nettle_libs =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC $(PKG_CONFIG) --libs nettle hogweed`
+lua_cflags =    `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LUASCRIPT $(PKG_CONFIG) --cflags $(LUA)` 
+lua_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LUASCRIPT $(PKG_CONFIG) --libs $(LUA)` 
+nettle_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC     $(PKG_CONFIG) --cflags 'nettle hogweed' \
+                                                        HAVE_CRYPTOHASH $(PKG_CONFIG) --cflags nettle \
+                                                        HAVE_NETTLEHASH $(PKG_CONFIG) --cflags nettle`
+nettle_libs =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC     $(PKG_CONFIG) --libs 'nettle hogweed' \
+                                                        HAVE_CRYPTOHASH $(PKG_CONFIG) --libs nettle \
+                                                        HAVE_NETTLEHASH $(PKG_CONFIG) --libs nettle`
 gmp_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC NO_GMP --copy -lgmp`
 sunos_libs =    `if uname | grep SunOS >/dev/null 2>&1; then echo -lsocket -lnsl -lposix4; fi`
-version =     -DVERSION='\"`$(top)/bld/get-version $(top)`\"'
+nft_cflags =    `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_NFTSET $(PKG_CONFIG) --cflags libnftables` 
+nft_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_NFTSET $(PKG_CONFIG) --libs libnftables`
+version =       -DVERSION='\"`$(top)/bld/get-version $(top)`\"'

 sum?=$(shell $(CC) -DDNSMASQ_COMPILE_OPTS $(COPTS) -E $(top)/$(SRC)/dnsmasq.h | ( md5sum 2>/dev/null || md5 ) | cut -f 1 -d ' ')
 sum!=$(CC) -DDNSMASQ_COMPILE_OPTS $(COPTS) -E $(top)/$(SRC)/dnsmasq.h | ( md5sum 2>/dev/null || md5 ) | cut -f 1 -d ' '
@@ -72,17 +82,19 @@ copts_conf = .copts_$(sum)
 objs = cache.o rfc1035.o util.o option.o forward.o network.o \
       dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o \
       helper.o tftp.o log.o conntrack.o dhcp6.o rfc3315.o \
-       dhcp-common.o outpacket.o radv.o slaac.o auth.o ipset.o \
-       domain.o dnssec.o blockdata.o tables.o loop.o inotify.o
+       dhcp-common.o outpacket.o radv.o slaac.o auth.o ipset.o pattern.o \
+       domain.o dnssec.o blockdata.o tables.o loop.o inotify.o \
+       poll.o rrfilter.o edns0.o arp.o crypto.o dump.o ubus.o \
+       metrics.o hash-questions.o domain-match.o nftset.o

 hdrs = dnsmasq.h config.h dhcp-protocol.h dhcp6-protocol.h \
-       dns-protocol.h radv-protocol.h ip6addr.h
+       dns-protocol.h radv-protocol.h ip6addr.h metrics.h

 all : $(BUILDDIR)
 	@cd $(BUILDDIR) && $(MAKE) \
 top="$(top)" \
- build_cflags="$(version) $(dbus_cflags) $(idn_cflags) $(ct_cflags) $(lua_cflags) $(nettle_cflags)" \
- build_libs="$(dbus_libs) $(idn_libs) $(ct_libs) $(lua_libs) $(sunos_libs) $(nettle_libs) $(gmp_libs)" \
+ build_cflags="$(version) $(dbus_cflags) $(idn2_cflags) $(idn_cflags) $(ct_cflags) $(lua_cflags) $(nettle_cflags) $(nft_cflags)" \
+ build_libs="$(dbus_libs) $(idn2_libs) $(idn_libs) $(ct_libs) $(lua_libs) $(sunos_libs) $(nettle_libs) $(gmp_libs) $(ubus_libs) $(nft_libs)" \
 -f $(top)/Makefile dnsmasq 

 mostly_clean :
@@ -97,7 +109,8 @@ clean : mostly_clean
 install : all install-common

 install-common :
-	$(INSTALL) -d $(DESTDIR)$(BINDIR) -d $(DESTDIR)$(MANDIR)/man8
+	$(INSTALL) -d $(DESTDIR)$(BINDIR)
+	$(INSTALL) -d $(DESTDIR)$(MANDIR)/man8
 	$(INSTALL) -m 644 $(MAN)/dnsmasq.8 $(DESTDIR)$(MANDIR)/man8 
 	$(INSTALL) -m 755 $(BUILDDIR)/dnsmasq $(DESTDIR)$(BINDIR)

@@ -105,8 +118,8 @@ all-i18n : $(BUILDDIR)
 	@cd $(BUILDDIR) && $(MAKE) \
 top="$(top)" \
 i18n=-DLOCALEDIR=\'\"$(LOCALEDIR)\"\' \
- build_cflags="$(version) $(dbus_cflags) $(ct_cflags) $(lua_cflags) $(nettle_cflags) `$(PKG_CONFIG) --cflags libidn`" \
- build_libs="$(dbus_libs) $(ct_libs) $(lua_libs) $(sunos_libs) $(nettle_libs) $(gmp_libs) `$(PKG_CONFIG) --libs libidn`"  \
+ build_cflags="$(version) $(dbus_cflags) $(idn2_cflags) $(idn_cflags) $(ct_cflags) $(lua_cflags) $(nettle_cflags) $(nft_cflags)" \
+ build_libs="$(dbus_libs) $(idn2_libs) $(idn_libs) $(ct_libs) $(lua_libs) $(sunos_libs) $(nettle_libs) $(gmp_libs) $(ubus_libs) $(nft_libs)"  \
 -f $(top)/Makefile dnsmasq
 	for f in `cd $(PO); echo *.po`; do \
 		cd $(top) && cd $(BUILDDIR) && $(MAKE) top="$(top)" -f $(top)/Makefile $${f%.po}.mo; \
@@ -117,12 +130,12 @@ install-i18n : all-i18n install-common
 	cd $(MAN); ../bld/install-man $(DESTDIR)$(MANDIR) $(INSTALL)

 merge : 
-	@cd $(BUILDDIR) && $(MAKE) -f $(top)/Makefile dnsmasq.pot
+	@cd $(BUILDDIR) && $(MAKE) top="$(top)" -f $(top)/Makefile dnsmasq.pot
 	for f in `cd $(PO); echo *.po`; do \
 		echo -n msgmerge $(PO)/$$f && $(MSGMERGE) --no-wrap -U $(PO)/$$f $(BUILDDIR)/dnsmasq.pot; \
 	done

-# Cannonicalise .po file.
+# Canonicalise .po file.
 %.po : 
 	@cd $(BUILDDIR) && $(MAKE) -f $(top)/Makefile dnsmasq.pot
 	mv $(PO)/$*.po $(PO)/$*.po.orig && $(MSGMERGE) --no-wrap $(PO)/$*.po.orig $(BUILDDIR)/dnsmasq.pot >$(PO)/$*.po; 
@@ -141,7 +154,7 @@ bloatcheck : $(BUILDDIR)/dnsmasq_baseline mostly_clean all
           $(top)/bld/bloat-o-meter dnsmasq_baseline dnsmasq; \
           size dnsmasq_baseline dnsmasq

-# rules below are targets in recusive makes with cwd=$(BUILDDIR)
+# rules below are targets in recursive makes with cwd=$(BUILDDIR)

 $(copts_conf): $(hdrs)
 	@rm -f *.o .copts_*
@@ -10,7 +10,9 @@ LOCAL_SRC_FILES :=  bpf.c cache.c dbus.c dhcp.c dnsmasq.c \
 		    dhcp6.c rfc3315.c dhcp-common.c outpacket.c \
 		    radv.c slaac.c auth.c ipset.c domain.c \
 	            dnssec.c dnssec-openssl.c blockdata.c tables.c \
-		    loop.c inotify.c
+		    loop.c inotify.c poll.c rrfilter.c edns0.c arp.c \
+		    crypto.c dump.c ubus.c metrics.c hash-questions.c \
+                    domain-match.c

 LOCAL_MODULE := dnsmasq

@@ -9,19 +9,29 @@
 # If we can find one which matches $v[0-9].* then we assume it's
 # a version-number tag, else we just use the whole string.
 # If there is more than one v[0-9].* tag, sort them and use the
-# first. This favours, eg v2.63 over 2.63rc6.
+# first. The insane arguments to the sort command are to ensure
+# that, eg v2.64 comes before v2.63, but v2.63 comes before v2.63rc1
+# and v2.63rc1 comes before v2.63test1
+
+
+# Change directory to the toplevel source directory.
+if test -z "$1" || ! test -d "$1" || ! cd "$1"; then
+    echo "$0: First argument $1 must be toplevel dir." >&2
+    exit 1
+fi

 if which git >/dev/null 2>&1 && \
-    ([ -d $1/.git ] || grep '^gitdir:' $1/.git >/dev/null 2>&1); then 
-    cd $1; git describe | sed 's/^v//'
+    ([ -d .git ] || grep '^gitdir:' .git >/dev/null 2>&1) && \
+    git describe >/dev/null 2>&1; then 
+    git describe | sed 's/^v//'
 elif grep '\$Format:%d\$' $1/VERSION >/dev/null 2>&1; then
-# unsubstituted VERSION, but no git available.
+    # unsubstituted VERSION, but no git available.
    echo UNKNOWN
 else
     vers=`cat $1/VERSION | sed 's/[(), ]/,/ g' | tr ',' '\n' | grep ^v[0-9]`

     if [ $? -eq 0 ]; then
-         echo "${vers}" | sort -r | head -n 1 | sed 's/^v//'
+         echo "${vers}" | sort -k1.2,1.5Vr -k1.6,1.6 -k1.8,1.9Vr -k1.10,1.11Vr | head -n 1 | sed 's/^v//'
     else
         cat $1/VERSION
     fi
@@ -1,33 +1,37 @@
 #!/bin/sh

-search=$1
-shift
-pkg=$1
-shift
-op=$1
-shift
-
 in=`cat`

-if grep "^\#[[:space:]]*define[[:space:]]*$search" config.h >/dev/null 2>&1 || \
-    echo $in | grep $search >/dev/null 2>&1; then
-# Nasty, nasty, in --copy, arg 2 is another config to search for, use with NO_GMP
+search()
+{
+    grep "^\#[[:space:]]*define[[:space:]]*$1" config.h >/dev/null 2>&1 || \
+    echo $in | grep $1 >/dev/null 2>&1
+}
+
+while [ "$#" -gt 0 ]; do
+    search=$1
+    pkg=$2
+    op=$3
+    lib=$4
+    shift 4
+if search "$search"; then
+
+# Nasty, nasty, in --copy, arg 2 (if non-empty) is another config to search for, used with NO_GMP
    if [ $op = "--copy" ]; then
-	if grep "^\#[[:space:]]*define[[:space:]]*$pkg" config.h >/dev/null 2>&1 || \
-            echo $in | grep $pkg >/dev/null 2>&1; then
+	if [ -z "$pkg" ]; then
+	    pkg="$lib"
+	elif search "$pkg"; then
 	    pkg=""
 	else 
-	    pkg="$*"
+	    pkg="$lib"
 	fi
-    elif grep "^\#[[:space:]]*define[[:space:]]*${search}_STATIC" config.h >/dev/null 2>&1 || \
-	      echo $in | grep ${search}_STATIC >/dev/null 2>&1; then
-	pkg=`$pkg  --static $op $*`
+    elif search "${search}_STATIC"; then
+	pkg=`$pkg  --static $op $lib`
    else
-	pkg=`$pkg $op $*`
+	pkg=`$pkg $op $lib`
    fi
-
-    if grep "^\#[[:space:]]*define[[:space:]]*${search}_STATIC" config.h >/dev/null 2>&1 || \
-	echo $in | grep ${search}_STATIC >/dev/null 2>&1; then
+    
+    if search "${search}_STATIC"; then
 	if [ $op = "--libs" ] || [ $op = "--copy" ]; then
 	    echo "-Wl,-Bstatic $pkg -Wl,-Bdynamic"
 	else
@@ -38,3 +42,4 @@ if grep "^\#[[:space:]]*define[[:space:]]*$search" config.h >/dev/null 2>&1 || \
    fi
 fi

+done
@@ -22,7 +22,7 @@ sudo chmod 644 /Library/LaunchDaemons/uk.org.thekelleys.dnsmasq.plist

 Optionally, edit your dnsmasq configuration file to your liking.

-To start the launchd job, which starts dnsmaq, reboot or use the command:
+To start the launchd job, which starts dnsmasq, reboot or use the command:
 sudo launchctl load /Library/LaunchDaemons/uk.org.thekelleys.dnsmasq.plist

 To stop the launchd job, which stops dnsmasq, use the command:
@@ -1,6 +0,0 @@
-This packaging is now unmaintained in the dnsmasq source: dnsmasq is
-included in Suse proper, and up-to-date packages are now available
-from 
-
-ftp://ftp.suse.com/pub/people/ug/
-
@@ -1,27 +0,0 @@
-This is a patch against SuSEfirewall2-3.1-206 (SuSE 9.x and older)
-It fixes the depancy from the dns daemon name 'named'
-After appending the patch, the SuSEfirewall is again able to autodetect 
-the dnsmasq named service.
-This is a very old bug in the SuSEfirewall script.
-The SuSE people think the name of the dns server will allways 'named'
-
-
--- /sbin/SuSEfirewall2.orig	2004-01-23 13:30:09.000000000 +0100
-+++ /sbin/SuSEfirewall2	2004-01-23 13:31:56.000000000 +0100
-@@ -764,7 +764,7 @@
-     echo 'FW_ALLOW_INCOMING_HIGHPORTS_UDP should be set to yes, if you are running a DNS server!'
- 
- test "$FW_SERVICE_AUTODETECT" = yes -o "$FW_SERVICE_AUTODETECT" = dmz -o "$FW_SERVICE_AUTODETECT" = ext && {
-    test "$FW_SERVICE_DNS" = no -a '!' "$START_NAMED" = no && check_srv named && {
-+    test "$FW_SERVICE_DNS" = no -a '!' "$START_NAMED" = no && check_srv dnsmasq && {
- 	echo -e 'Warning: detected activated named, enabling FW_SERVICE_DNS!
- You still have to allow tcp/udp port 53 on internal, dmz and/or external.'
- 	FW_SERVICE_DNS=$FW_SERVICE_AUTODETECT
-@@ -878,7 +878,7 @@
- test -e /etc/resolv.conf || echo "Warning: /etc/resolv.conf not found"
- # Get ports/IP bindings of NAMED/SQUID
- test "$FW_SERVICE_DNS" = yes -o "$FW_SERVICE_DNS" = dmz -o "$FW_SERVICE_DNS" = ext -o "$START_NAMED" = yes && DNS_PORT=`$LSOF -i -n -P | \
-    $AWK -F: '/^named .* UDP / {print $2}'| $GREP -vw 53 | $SORT -un`
-+    $AWK -F: '/^dnsmasq .* UDP / {print $2}'| $GREP -vw 53 | $SORT -un`
- test "$FW_SERVICE_SQUID" = yes -o "$FW_SERVICE_SQUID" = dmz -o "$FW_SERVICE_SQUID" = ext -o "$START_SQUID" = yes && SQUID_PORT=`$LSOF -i -n -P | \
-     $AWK -F: '/^squid .* UDP/ {print $2}'| $SORT -un`
@@ -1,23 +0,0 @@
--- man/dnsmasq.8	2004-08-08 20:57:56.000000000 +0200
-+++ man/dnsmasq.8	2004-08-12 00:40:01.000000000 +0200
-@@ -69,7 +69,7 @@
- .TP
- .B \-g, --group=<groupname> 
- Specify the group which dnsmasq will run
-as. The defaults to "dip", if available, to facilitate access to
-+as. The defaults to "dialout", if available, to facilitate access to
- /etc/ppp/resolv.conf which is not normally world readable.
- .TP
- .B \-v, --version
--- src/config.h	2004-08-11 11:39:18.000000000 +0200
-+++ src/config.h	2004-08-12 00:40:01.000000000 +0200
-@@ -44,7 +44,7 @@
- #endif
- #define DEFLEASE 3600 /* default lease time, 1 hour */
- #define CHUSER "nobody"
-#define CHGRP "dip"
-+#define CHGRP "dialout"
- #define DHCP_SERVER_PORT 67
- #define DHCP_CLIENT_PORT 68
- 
-
@@ -1,111 +0,0 @@
-###############################################################################
-#
-# General
-#
-###############################################################################
-
-Name: dnsmasq
-Version: 2.33
-Release: 1
-Copyright: GPL
-Group: Productivity/Networking/DNS/Servers
-Vendor: Simon Kelley
-Packager: Simon Kelley
-URL: http://www.thekelleys.org.uk/dnsmasq
-Provides: dns_daemon
-Conflicts: bind bind8 bind9
-PreReq: %fillup_prereq %insserv_prereq
-Autoreqprov: on
-Source0: %{name}-%{version}.tar.bz2
-BuildRoot: /var/tmp/%{name}-%{version}
-Summary: A lightweight caching nameserver
-
-%description
-Dnsmasq is lightweight, easy to configure DNS forwarder and DHCP server. It 
-is designed to provide DNS and, optionally, DHCP, to a small network. It can
-serve the names of local machines which are not in the global DNS. The DHCP 
-server integrates with the DNS server and allows machines with DHCP-allocated
-addresses to appear in the DNS with names configured either in each host or 
-in a central configuration file. Dnsmasq supports static and dynamic DHCP 
-leases and BOOTP for network booting of diskless machines.
-
-
-
-###############################################################################
-#
-# Build
-#
-###############################################################################
-
-%prep
-%setup -q
-patch -p0 <rpm/%{name}-SuSE.patch
-
-%build
-%{?suse_update_config:%{suse_update_config -f}}
-make all-i18n DESTDIR=$RPM_BUILD_ROOT PREFIX=/usr
-
-###############################################################################
-#
-# Install
-#
-###############################################################################
-
-%install
-rm -rf $RPM_BUILD_ROOT
-mkdir -p ${RPM_BUILD_ROOT}/etc/init.d
-make install-i18n DESTDIR=$RPM_BUILD_ROOT PREFIX=/usr
-install -o root -g root -m 755 rpm/rc.dnsmasq-suse $RPM_BUILD_ROOT/etc/init.d/dnsmasq
-install -o root -g root -m 644 dnsmasq.conf.example $RPM_BUILD_ROOT/etc/dnsmasq.conf
-strip $RPM_BUILD_ROOT/usr/sbin/dnsmasq
-ln -sf ../../etc/init.d/dnsmasq $RPM_BUILD_ROOT/usr/sbin/rcdnsmasq
-
-###############################################################################
-#
-# Clean up
-#
-###############################################################################
-
-%clean
-rm -rf $RPM_BUILD_ROOT
-
-###############################################################################
-#
-# Post-install scriptlet
-#
-###############################################################################
-
-%post
-%{fillup_and_insserv dnsmasq}
-
-###############################################################################
-#
-# Post-uninstall scriptlet
-#
-# The %postun script executes after the package has been removed. It is the
-# last chance for a package to clean up after itself.
-#
-###############################################################################
-
-%postun
-%{insserv_cleanup}
-
-###############################################################################
-#
-# File list
-#
-###############################################################################
-
-%files
-%defattr(-,root,root)
-%doc CHANGELOG COPYING FAQ doc.html setup.html UPGRADING_to_2.0 rpm/README.susefirewall
-%doc contrib
-%config /etc/init.d/dnsmasq
-%config /etc/dnsmasq.conf
-/usr/sbin/rcdnsmasq
-/usr/sbin/dnsmasq
-/usr/share/locale/*/LC_MESSAGES/*
-%doc %{_mandir}/man8/dnsmasq.8.gz
-%doc %{_mandir}/*/man8/dnsmasq.8.gz
-
-
@@ -1,79 +0,0 @@
-#! /bin/sh
-#
-# init.d/dnsmasq
-#
-### BEGIN INIT INFO
-# Provides:       dnsmasq
-# Required-Start: $network $remote_fs $syslog
-# Required-Stop:
-# Default-Start:  3 5
-# Default-Stop:
-# Description:    Starts internet name service masq caching server (DNS)
-### END INIT INFO
-
-NAMED_BIN=/usr/sbin/dnsmasq
-NAMED_PID=/var/run/dnsmasq.pid
-NAMED_CONF=/etc/dnsmasq.conf
-
-if [ ! -x $NAMED_BIN ] ; then
-	echo -n "dnsmasq not installed ! "
-	exit 5
-fi
-
-. /etc/rc.status
-rc_reset
-
-case "$1" in
-    start)
-	echo -n "Starting name service masq caching server "
-        checkproc -p $NAMED_PID $NAMED_BIN
-        if [ $? -eq 0 ] ; then
-           echo -n "- Warning: dnsmasq already running ! "
-        else
-           [ -e $NAMED_PID ] && echo -n "- Warning: $NAMED_PID exists ! "
-	fi
-	startproc -p $NAMED_PID $NAMED_BIN -u nobody
-	rc_status -v
-	;;
-    stop)
-	echo -n "Shutting name service masq caching server "
-	checkproc -p $NAMED_PID $NAMED_BIN
-	[ $? -ne 0 ] && echo -n "- Warning: dnsmasq not running ! "
-	killproc -p $NAMED_PID -TERM $NAMED_BIN
-	rc_status -v
-	;;
-    try-restart)
-	$0 stop  &&  $0 start
-	rc_status
-	;;
-    restart)
-	$0 stop
-	$0 start
-	rc_status
-	;;
-    force-reload)
-	$0 reload
-	rc_status
-	;;
-    reload)
-	echo -n "Reloading name service masq caching server "
-	checkproc -p $NAMED_PID $NAMED_BIN
-	[ $? -ne 0 ] && echo -n "- Warning: dnsmasq not running ! "
-	killproc -p $NAMED_PID -HUP $NAMED_BIN
-	rc_status -v
-	;;
-    status)
-	echo -n "Checking for name service masq caching server "
-	checkproc -p $NAMED_PID $NAMED_BIN
-	rc_status -v
-	;;
-    probe)
-	test $NAMED_CONF -nt $NAMED_PID && echo reload
-	;;
-    *)
-	echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}"
-	exit 1
-	;;
-esac
-rc_exit
-
@@ -13,10 +13,10 @@ connection comes out of the other side.  However, sometimes, we want to
 maintain that relationship through the proxy and continue the connection
 mark on packets upstream of our proxy

-DNSMasq includes such a feature enabled by the --conntrack
+Dnsmasq includes such a feature enabled by the --conntrack
 option. This allows, for example, using iptables to mark traffic from
 a particular IP, and that mark to be persisted to requests made *by*
-DNSMasq. Such a feature could be useful for bandwidth accounting,
+Dnsmasq. Such a feature could be useful for bandwidth accounting,
 captive portals and the like. Note a similar feature has been 
 implemented in Squid 2.2

@@ -40,7 +40,7 @@ on IP address. 3) Saves the firewall mark back to the connection mark
 (which will persist it across related packets)

 4) is applied to the OUTPUT table, which is where we first see packets
-generated locally. DNSMasq will have already copied the firewall mark
+generated locally. Dnsmasq will have already copied the firewall mark
 from the request, across to the new packet, and so all that remains is
 for iptables to copy it to the connection mark so it's persisted across
 packets.
@@ -55,7 +55,7 @@ Index: src/dnsmasq.c
 	    }     
 
@@ -434,7 +433,7 @@
- 	  /* lose the setuid and setgid capbilities */
+ 	  /* lose the setuid and setgid capabilities */
 	  if (capset(hdr, data) == -1)
 	    {
 -	      send_event(err_pipe[1], EVENT_CAP_ERR, errno);
@@ -0,0 +1,6 @@
+CFLAGS?= -O2 -Wall -W
+
+all: dhcp_release dhcp_release6 dhcp_lease_time
+
+clean:
+	rm -f *~ *.o core dhcp_release dhcp_release6 dhcp_lease_time
@@ -83,7 +83,7 @@ static unsigned char *option_find1(unsigned char *p, unsigned char *end, int opt
          if (p >= end - 2)
            return NULL; /* malformed packet */
          opt_len = option_len(p);
-          if (p >= end - (2 + opt_len))
+          if (end - p < (2 + opt_len))
            return NULL; /* malformed packet */
          if (*p == opt && opt_len >= minsize)
            return p;
@@ -153,7 +153,11 @@ int main(int argc, char **argv)
      exit(1);
    }
 
-  lease.s_addr = inet_addr(argv[1]);
+  if (inet_pton(AF_INET, argv[1], &lease) < 1)
+    {
+      fprintf(stderr, "invalid address: %s\n", argv[1]);
+      exit(1);
+    }
   
  memset(&packet, 0, sizeof(packet));
 
@@ -168,7 +172,7 @@ int main(int argc, char **argv)
  *(p++) = 1;
  *(p++) = DHCPINFORM;

-  /* Explicity request the lease time, it won't be sent otherwise:
+  /* Explicitly request the lease time, it won't be sent otherwise:
     this is a dnsmasq extension, not standard. */
  *(p++) = OPTION_REQUESTED_OPTIONS;
  *(p++) = 1;
@@ -176,8 +180,8 @@ int main(int argc, char **argv)
  
  *(p++) = OPTION_END;
 
-  dest.sin_family = AF_INET; 
-  dest.sin_addr.s_addr = inet_addr("127.0.0.1");
+  dest.sin_family = AF_INET;
+  (void)inet_pton(AF_INET, "127.0.0.1", &dest.sin_addr);
  dest.sin_port = ntohs(DHCP_SERVER_PORT);
  
  if (sendto(fd, &packet, sizeof(packet), 0, 
@@ -206,13 +210,13 @@ int main(int argc, char **argv)
 	{
 	  unsigned int x;
 	  if ((x = t/86400))
-	    printf("%dd", x);
+	    printf("%ud", x);
 	  if ((x = (t/3600)%24))
-	    printf("%dh", x);
+	    printf("%uh", x);
 	  if ((x = (t/60)%60))
-	    printf("%dm", x);
+	    printf("%um", x);
 	  if ((x = t%60))
-	    printf("%ds", x);
+	    printf("%us", x);
 	}
      return 0;
    }
@@ -117,7 +117,7 @@ static ssize_t netlink_recv(int fd)
      msg.msg_flags = 0;
      while ((rc = recvmsg(fd, &msg, MSG_PEEK)) == -1 && errno == EINTR);
      
-      /* 2.2.x doesn't suport MSG_PEEK at all, returning EOPNOTSUPP, so we just grab a 
+      /* 2.2.x doesn't support MSG_PEEK at all, returning EOPNOTSUPP, so we just grab a 
         big buffer and pray in that case. */
      if (rc == -1 && errno == EOPNOTSUPP)
        {
@@ -178,7 +178,7 @@ static int is_same_net(struct in_addr a, struct in_addr b, struct in_addr mask)
  return (a.s_addr & mask.s_addr) == (b.s_addr & mask.s_addr);
 }

-static struct in_addr find_interface(struct in_addr client, int fd, unsigned int index)
+static struct in_addr find_interface(struct in_addr client, int fd, unsigned int index, int ifrfd, struct ifreq *ifr)
 {
  struct sockaddr_nl addr;
  struct nlmsghdr *h;
@@ -218,7 +218,17 @@ static struct in_addr find_interface(struct in_addr client, int fd, unsigned int

      for (h = (struct nlmsghdr *)iov.iov_base; NLMSG_OK(h, (size_t)len); h = NLMSG_NEXT(h, len))
 	if (h->nlmsg_type == NLMSG_DONE)
-	  exit(0);
+          {
+	    /* No match found, return first address as src/dhcp.c code does */
+	    ifr->ifr_addr.sa_family = AF_INET;
+	    if (ioctl(ifrfd, SIOCGIFADDR, ifr) != -1)
+	      return ((struct sockaddr_in *)&ifr->ifr_addr)->sin_addr;
+	    else
+	      {
+		fprintf(stderr, "error: local IPv4 address not found\n");
+		exit(1);
+	      }
+          }
 	else if (h->nlmsg_type == RTM_NEWADDR)
          {
            struct ifaddrmsg *ifa = NLMSG_DATA(h);  
@@ -270,21 +280,22 @@ int main(int argc, char **argv)
  
  /* This voodoo fakes up a packet coming from the correct interface, which really matters for 
     a DHCP server */
-  strcpy(ifr.ifr_name, argv[1]);
+  memset(&ifr, 0, sizeof(ifr));
+  strncpy(ifr.ifr_name, argv[1], sizeof(ifr.ifr_name)-1);
+  ifr.ifr_name[sizeof(ifr.ifr_name)-1] = '\0';
  if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, &ifr, sizeof(ifr)) == -1)
    {
      perror("cannot setup interface");
      exit(1);
    }
  
-  if (inet_addr(argv[2]) == INADDR_NONE)
+  if (inet_pton(AF_INET, argv[2], &lease.s_addr) < 1)
    {
      perror("invalid ip address");
      exit(1);
    }
  
-  lease.s_addr = inet_addr(argv[2]);
-  server = find_interface(lease, nl, if_nametoindex(argv[1]));
+  server = find_interface(lease, nl, if_nametoindex(argv[1]), fd, &ifr);
  
  memset(&packet, 0, sizeof(packet));
 
@@ -0,0 +1,38 @@
+.TH DHCP_RELEASE 1
+.SH NAME
+dhcp_release6 \- Release a DHCPv6 lease on a the local dnsmasq DHCP server.
+.SH SYNOPSIS
+.B dhcp_release6 --iface <interface> --client-id <client-id> --server-id
+server-id --iaid <iaid>  --ip <IP>  [--dry-run] [--help]
+.SH "DESCRIPTION"
+A utility which forces the DHCP server running on this machine to release a 
+DHCPv6 lease.
+.SS OPTIONS
+.IP "-a, --ip"
+IPv6 address to release.
+.IP "-c, --client-id"
+Colon-separated hex string representing DHCPv6 client id. Normally
+it can be found in leases file both on client and server.
+.IP "-d, --dry-run"
+Print hexadecimal representation of generated DHCPv6 release packet to standard
+output and exit.
+.IP "-h, --help"
+print usage information to standard output and exit.
+.IP "-i, --iaid"
+Decimal representation of DHCPv6 IAID. Normally it can be found in leases file
+both on client and server.
+.IP "-n, --iface"
+Network interface to send a DHCPv6 release packet from.
+.IP "-s, --server-id"
+Colon-separated hex string representing DHCPv6 server id. Normally
+it can be found in leases file both on client and server.
+.SH NOTES
+MUST be run as root - will fail otherwise.
+.SH LIMITATIONS
+Only usable on IPv6 DHCP leases.
+.SH SEE ALSO
+.BR dnsmasq (8)
+.SH AUTHOR
+This manual page was written by Simon Kelley <simon@thekelleys.org.uk>.
+
+
@@ -0,0 +1,508 @@
+/*
+ dhcp_release6 --iface <interface> --client-id <client-id> --server-id
+ server-id --iaid <iaid>  --ip <IP>  [--dry-run] [--help]
+ MUST be run as root - will fail otherwise
+ */
+
+/* Send a DHCPRELEASE message  to IPv6 multicast address  via the specified interface
+ to tell the local DHCP server to delete a particular lease.
+ 
+ The interface argument is the interface in which a DHCP
+ request _would_ be received if it was coming from the client,
+ rather than being faked up here.
+ 
+ The client-id argument is colon-separated hex string and mandatory. Normally
+ it can be found in leases file both on client and server
+
+ The server-id argument is colon-separated hex string and mandatory. Normally
+ it can be found in leases file both on client and server.
+ 
+ The iaid argument is numeric string and mandatory. Normally
+ it can be found in leases file both on client and server.
+ 
+ IP is an IPv6 address to release
+ 
+ If --dry-run is specified, dhcp_release6 just prints hexadecimal representation of
+ packet to send to stdout and exits.
+ 
+ If --help is specified, dhcp_release6 print usage information to stdout and exits
+ 
+ 
+ 
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+#include <getopt.h>
+#include <errno.h>
+#include <unistd.h>
+
+#define NOT_REPLY_CODE 115
+typedef unsigned char u8;
+typedef unsigned short u16;
+typedef unsigned int u32;
+
+enum DHCP6_TYPES
+  {
+    SOLICIT = 1,
+    ADVERTISE = 2,
+    REQUEST = 3,
+    CONFIRM = 4,
+    RENEW = 5,
+    REBIND = 6,
+    REPLY = 7,
+    RELEASE = 8,
+    DECLINE = 9,
+    RECONFIGURE = 10,
+    INFORMATION_REQUEST = 11,
+    RELAY_FORW = 12,
+    RELAY_REPL = 13
+    
+  };
+
+enum DHCP6_OPTIONS
+  {
+    CLIENTID = 1,
+    SERVERID = 2,
+    IA_NA = 3,
+    IA_TA = 4,
+    IAADDR = 5,
+    ORO = 6,
+    PREFERENCE = 7,
+    ELAPSED_TIME = 8,
+    RELAY_MSG = 9,
+    AUTH = 11,
+    UNICAST = 12,
+    STATUS_CODE = 13,
+    RAPID_COMMIT = 14,
+    USER_CLASS = 15,
+    VENDOR_CLASS = 16,
+    VENDOR_OPTS = 17,
+    INTERFACE_ID = 18,
+    RECONF_MSG = 19,
+    RECONF_ACCEPT = 20,
+  };
+
+enum DHCP6_STATUSES
+  {
+    SUCCESS = 0,
+    UNSPEC_FAIL = 1,
+    NOADDR_AVAIL=2,
+    NO_BINDING  = 3,
+    NOT_ON_LINK = 4,
+    USE_MULTICAST =5
+  };
+
+static struct option longopts[] = {
+  {"ip", required_argument, 0, 'a' },
+  {"server-id", required_argument, 0, 's' },
+  {"client-id", required_argument, 0, 'c' },
+  {"iface", required_argument, 0, 'n' },
+  {"iaid", required_argument, 0, 'i' },
+  {"dry-run", no_argument, 0, 'd' },
+  {"help", no_argument, 0, 'h' },
+  {0,     0,           0,   0 }
+};
+
+const short DHCP6_CLIENT_PORT = 546;
+const short DHCP6_SERVER_PORT = 547;
+
+const char*  DHCP6_MULTICAST_ADDRESS = "ff02::1:2";
+
+struct dhcp6_option {
+  uint16_t type;
+  uint16_t len;
+  char  value[1024];
+};
+
+struct dhcp6_iaaddr_option {
+  uint16_t type;
+  uint16_t len;
+  struct in6_addr ip;
+  uint32_t preferred_lifetime;
+  uint32_t valid_lifetime;
+};
+
+struct dhcp6_iana_option {
+  uint16_t type;
+  uint16_t len;
+  uint32_t iaid;
+  uint32_t t1;
+  uint32_t t2;
+  char options[1024];
+};
+
+
+struct dhcp6_packet {
+  size_t len;
+  char buf[2048];  
+};
+
+size_t pack_duid(const char* str, char* dst)
+{
+  char* tmp = strdup(str);
+  char* tmp_to_free = tmp;
+  char *ptr;
+  uint8_t write_pos = 0;
+  while ((ptr = strtok (tmp, ":")))
+    {
+      dst[write_pos] = (uint8_t) strtol(ptr, NULL, 16);
+      write_pos += 1;
+      tmp = NULL;
+    }
+  
+  free(tmp_to_free);
+  return write_pos;
+}
+
+struct dhcp6_option create_client_id_option(const char* duid)
+{
+  struct dhcp6_option option;
+  option.type = htons(CLIENTID);
+  bzero(option.value, sizeof(option.value));
+  option.len  = htons(pack_duid(duid, option.value));
+  return option;
+}
+
+struct dhcp6_option create_server_id_option(const char* duid)
+{
+  struct dhcp6_option   option;
+  option.type = htons(SERVERID);
+  bzero(option.value, sizeof(option.value));
+  option.len  = htons(pack_duid(duid, option.value));
+  return option;
+}
+
+struct dhcp6_iaaddr_option create_iaadr_option(const char* ip)
+{
+  struct dhcp6_iaaddr_option result;
+  result.type =htons(IAADDR);
+  /* no suboptions needed here, so length is 24  */
+  result.len = htons(24);
+  result.preferred_lifetime = 0;
+  result.valid_lifetime = 0;
+  int s = inet_pton(AF_INET6, ip, &(result.ip));
+  if (s <= 0) {
+    if (s == 0)
+      fprintf(stderr, "Not in presentation format");
+    else
+      perror("inet_pton");
+    exit(EXIT_FAILURE);
+  }
+
+  return result;
+}
+
+struct dhcp6_iana_option  create_iana_option(const char * iaid, struct dhcp6_iaaddr_option  ia_addr)
+{
+  struct dhcp6_iana_option  result;
+  result.type = htons(IA_NA);
+  result.iaid = htonl(atoi(iaid));
+  result.t1 = 0;
+  result.t2 = 0;
+  result.len = htons(12 + ntohs(ia_addr.len) + 2 * sizeof(uint16_t));
+  memcpy(result.options, &ia_addr, ntohs(ia_addr.len) + 2 * sizeof(uint16_t));
+  return result;
+}
+
+struct dhcp6_packet create_release_packet(const char* iaid, const char* ip, const char* client_id, const char* server_id)
+{
+  struct dhcp6_packet result;
+  bzero(result.buf, sizeof(result.buf));
+  /* message_type */
+  result.buf[0] = RELEASE;
+  /* tx_id */
+  bzero(result.buf+1, 3);
+  
+  struct dhcp6_option client_option = create_client_id_option(client_id);
+  struct dhcp6_option server_option = create_server_id_option(server_id);
+  struct dhcp6_iaaddr_option iaaddr_option = create_iaadr_option(ip);
+  struct dhcp6_iana_option iana_option = create_iana_option(iaid, iaaddr_option);
+  int offset = 4;
+  memcpy(result.buf + offset, &client_option, ntohs(client_option.len) + 2*sizeof(uint16_t));
+  offset += (ntohs(client_option.len)+ 2 *sizeof(uint16_t) );
+  memcpy(result.buf + offset, &server_option, ntohs(server_option.len) + 2*sizeof(uint16_t) );
+  offset += (ntohs(server_option.len)+ 2* sizeof(uint16_t));
+  memcpy(result.buf + offset, &iana_option, ntohs(iana_option.len) + 2*sizeof(uint16_t) );
+  offset += (ntohs(iana_option.len)+ 2* sizeof(uint16_t));
+  result.len = offset;
+  return result;
+}
+
+uint16_t parse_iana_suboption(char* buf, size_t len)
+{
+  size_t current_pos = 0;
+  char option_value[1024];
+  while (current_pos < len)
+    {
+      uint16_t option_type, option_len;
+      memcpy(&option_type,buf + current_pos, sizeof(uint16_t));
+      memcpy(&option_len,buf + current_pos + sizeof(uint16_t), sizeof(uint16_t));
+      option_type = ntohs(option_type);
+      option_len = ntohs(option_len);
+      current_pos += 2 * sizeof(uint16_t);
+      if (option_type == STATUS_CODE)
+	{
+	  uint16_t status;
+	  memcpy(&status, buf + current_pos, sizeof(uint16_t));
+	  status = ntohs(status);
+	  if (status != SUCCESS)
+	    {
+	      memcpy(option_value, buf + current_pos + sizeof(uint16_t) , option_len - sizeof(uint16_t));
+	      option_value[option_len-sizeof(uint16_t)] ='\0';
+	      fprintf(stderr, "Error: %s\n", option_value);
+            }
+	  return status;
+        }
+    }
+
+  return -2;
+}
+
+int16_t parse_packet(char* buf, size_t len)
+{
+  int16_t ret = -1;
+  uint8_t type = buf[0];
+  /*skipping tx id. you need it, uncomment following line
+    uint16_t tx_id = ntohs((buf[1] <<16) + (buf[2] <<8) + buf[3]);
+  */
+  size_t current_pos = 4;
+  if (type != REPLY )
+    return NOT_REPLY_CODE;
+  
+  char option_value[1024];
+  while (current_pos < len)
+    {
+      uint16_t option_type, option_len;
+      memcpy(&option_type,buf + current_pos, sizeof(uint16_t));
+      memcpy(&option_len,buf + current_pos + sizeof(uint16_t), sizeof(uint16_t));
+      option_type = ntohs(option_type);
+      option_len = ntohs(option_len);
+      current_pos += 2 * sizeof(uint16_t);
+      if (option_type == STATUS_CODE)
+	{
+	  uint16_t status;
+	  memcpy(&status, buf + current_pos, sizeof(uint16_t));
+	  status = ntohs(status);
+	  if (status != SUCCESS)
+	    {
+	      memcpy(option_value, buf + current_pos +sizeof(uint16_t) , option_len -sizeof(uint16_t));
+	      fprintf(stderr, "Error: %d %s\n", status, option_value);
+	      return status;
+	    }
+
+	  /* Got success status, return that if there's no specific error in an IA_NA. */
+	  ret = SUCCESS;   
+        }
+
+      if (option_type == IA_NA )
+	{
+	  uint16_t result = parse_iana_suboption(buf + current_pos +24, option_len -24);
+	  if (result)
+	    return result;
+	}
+      
+      current_pos += option_len;
+    }
+
+  return ret;
+}
+
+void usage(const char* arg, FILE* stream)
+{
+  const char* usage_string ="--ip IPv6 --iface IFACE --server-id SERVER_ID --client-id CLIENT_ID --iaid IAID [--dry-run] | --help";
+  fprintf (stream, "Usage: %s %s\n", arg, usage_string);   
+}
+
+static void fail_fatal(const char *errstr, int exitcode)
+{
+  perror(errstr);
+  exit(exitcode);
+}
+
+int send_release_packet(const char* iface, struct dhcp6_packet* packet)
+{
+  struct sockaddr_in6 server_addr, client_addr;
+  char response[1400];
+  int sock = socket(PF_INET6, SOCK_DGRAM, 0);
+  int i = 0;
+  if (sock < 0)
+    {
+      perror("creating socket");
+      return -1;
+    }
+  
+    if (setsockopt(sock, SOL_SOCKET, 25, iface, strlen(iface)) == -1)
+      {
+        perror("SO_BINDTODEVICE");
+        close(sock);
+        return -1;
+      }
+    
+    memset(&server_addr, 0, sizeof(server_addr));
+    server_addr.sin6_family = AF_INET6;
+    client_addr.sin6_family = AF_INET6;
+    client_addr.sin6_port = htons(DHCP6_CLIENT_PORT);
+    client_addr.sin6_flowinfo = 0;
+    client_addr.sin6_scope_id =0;
+    if (inet_pton(AF_INET6, "::", &client_addr.sin6_addr) <= 0)
+      fail_fatal("inet_pton", 5);
+    if (bind(sock, (struct sockaddr*)&client_addr, sizeof(struct sockaddr_in6)) != 0)
+      perror("bind"); /* continue on bind error */
+    if (inet_pton(AF_INET6, DHCP6_MULTICAST_ADDRESS, &server_addr.sin6_addr) <= 0)
+      fail_fatal("inet_pton", 5);
+    server_addr.sin6_port = htons(DHCP6_SERVER_PORT);
+    ssize_t recv_size = 0;
+    int result;
+    for (i = 0; i < 5; i++)
+      {
+        if (sendto(sock, packet->buf, packet->len, 0, (struct sockaddr *)&server_addr, sizeof(server_addr)) < 0)
+	  fail_fatal("sendto failed", 4);
+	
+        recv_size = recvfrom(sock, response, sizeof(response), MSG_DONTWAIT, NULL, 0);
+        if (recv_size == -1)
+	  {
+            if (errno == EAGAIN)
+	      {
+		sleep(1);
+		continue;
+	      }
+	    else
+	      {
+                perror("recvfrom");
+		result = UNSPEC_FAIL;
+	      }
+	  }
+	else
+	  {
+	    result = parse_packet(response, recv_size);
+	    if (result == NOT_REPLY_CODE)
+	      {
+		sleep(1);
+		continue;
+	      }
+	  }
+        close(sock);
+        return result;
+      }
+
+    close(sock);
+    fprintf(stderr, "Response timed out\n");
+    return -1;   
+}
+
+
+int main(int argc, char *  const argv[])
+{
+  const char* UNINITIALIZED = "";
+  const char* iface = UNINITIALIZED;
+  const char* ip = UNINITIALIZED;
+  const char* client_id = UNINITIALIZED;
+  const char* server_id = UNINITIALIZED;
+  const char* iaid = UNINITIALIZED;
+  int dry_run = 0;
+  while (1)
+    {
+      int option_index = 0;
+      int c = getopt_long(argc, argv, "a:s:c:n:i:hd", longopts, &option_index);
+      if (c == -1)
+	break;
+        
+      switch(c)
+	{
+	case 0:
+	  if (longopts[option_index].flag !=0)
+	    break;
+	  
+	  printf ("option %s", longopts[option_index].name);
+	  if (optarg)
+	    printf (" with arg %s", optarg);
+	  printf ("\n");
+	  break;
+
+	case 'i':
+	  iaid = optarg;
+	  break;
+	case 'n':
+	  iface = optarg;
+	  break;
+	case 'a':
+	  ip = optarg;
+	  break;
+	case 'c':
+	  client_id = optarg;
+	  break;
+	case 'd':
+	  dry_run = 1;
+	  break;
+	case 's':
+	  server_id = optarg;
+	  break;
+	case 'h':
+	  usage(argv[0], stdout);
+	  return 0;
+	case '?':
+	  usage(argv[0], stderr);
+	  return -1;
+	default:
+	  abort();
+	  
+        }
+    }
+  
+  if (iaid == UNINITIALIZED)
+    {
+      fprintf(stderr, "Missing required iaid parameter\n");
+      usage(argv[0], stderr);
+      return -1;
+    }
+  
+    if (server_id == UNINITIALIZED)
+      {
+        fprintf(stderr, "Missing required server-id parameter\n");
+        usage(argv[0], stderr);
+        return -1;
+      }
+    
+    if (client_id == UNINITIALIZED)
+      {
+        fprintf(stderr, "Missing required client-id parameter\n");
+        usage(argv[0], stderr);
+        return -1;
+      }
+    
+    if (ip == UNINITIALIZED)
+      {
+        fprintf(stderr, "Missing required ip parameter\n");
+        usage(argv[0], stderr);
+        return -1;
+      }
+    
+    if (iface == UNINITIALIZED)
+      {
+	fprintf(stderr, "Missing required iface parameter\n");
+        usage(argv[0], stderr);
+        return -1;
+      }
+
+    
+    
+    struct dhcp6_packet packet = create_release_packet(iaid, ip, client_id, server_id);
+
+    if (dry_run)
+      {
+        uint16_t i;
+
+        for(i=0; i<packet.len; i++)
+	  printf("%hhx", packet.buf[i]);
+        
+        printf("\n");
+        return 0;
+      }
+
+    return send_release_packet(iface, &packet);
+}
@@ -3,7 +3,7 @@
 STATUS_FILE="/tmp/dnsmasq-ip-mac.status"

 # Script for dnsmasq lease-change hook.
-# Maintains the above file with a IP address/MAC address pairs,
+# Maintains the above file with an IP address/MAC address pairs,
 # one lease per line. Works with IPv4 and IPv6 leases, file is
 # atomically updated, so no races for users of the data.

@@ -3,7 +3,7 @@
 # first column of this file, then a DNAT port-forward will be set up 
 # to the address which has just been allocated by DHCP . The second field 
 # is port number(s). If there is only one, then the port-forward goes to 
-# the same port on the DHCP-client, if there are two seperated with a 
+# the same port on the DHCP-client, if there are two separated with a 
 # colon, then the second number is the port to which the connection 
 # is forwarded on the DHCP-client. By default, forwarding is set up 
 # for TCP, but it can done for UDP instead by prefixing the port to "u". 
@@ -1,6 +1,6 @@
 The script reads stdin and replaces all IP addresses with names before
 outputting it again. IPs from private networks are reverse looked  up
-via dns. Other IP adresses are searched for in the dnsmasq query log.
+via dns. Other IP addresses are searched for in the dnsmasq query log.
 This gives names (CNAMEs if I understand DNS correctly) that are closer
 to the name the client originally asked for then the names obtained by
 reverse lookup. Just run
@@ -14,5 +14,5 @@ log-facility=/var/log/dnsmasq.log

 in the dnsmasq configuration.

-The script runs on debian (with ash installed) and on busybox.
+The script runs on debian (with dash installed) and on busybox.

@@ -1,14 +1,14 @@
-#!/bin/ash
+#!/bin/dash
 # $Id: reverse_replace.sh 18 2015-03-01 16:12:35Z jo $
 #
 # Usage e.g.: netstat -n -4 | reverse_replace.sh 
 # Parses stdin for IP4 addresses and replaces them 
 # with names retrieved by parsing the dnsmasq log.
 # This currently only gives CNAMEs. But these 
-# usually tell ou more than the mones from reverse 
+# usually tell you more than the ones from reverse 
 # lookups. 
 #
-# This has been tested on debian and asuswrt. Plese
+# This has been tested on debian and asuswrt. Please
 # report successful tests on other platforms.
 #
 # Author: Joachim Zobel <jz-2014@heute-morgen.de>
@@ -1,5 +1,8 @@
 [Unit]
 Description=dnsmasq - A lightweight DHCP and caching DNS server
+After=network.target
+Before=network-online.target nss-lookup.target
+Wants=nss-lookup.target

 [Service]
 Type=dbus
@@ -2,7 +2,7 @@ A remake of patch Bob Carroll had posted to dnsmasq,
 now compatible with version 2.47. Hopefully he doesn't 
 mind (sending a copy of this mail to him too).

-Maybe the patch in question is not acceptible
+Maybe the patch in question is not acceptable
 as it doesn't add new switch, rather it binds itself to "strict-order".

 What it does is: if you have strict-order in the 
@@ -0,0 +1,10 @@
+Hi,
+I updated the try-all-ns patch to work with the latest version of git. Ended up implementing it on top of master, 2.78test2-7-g63437ff. As that specific if-clause has been changed in the last few commits, it's not compatible for 2.77, sadly.
+
+Find the patch attached.
+
+Regards,
+
+Rasmus Ahlberg
+Software Developer, R&D
+Electrolux Small Appliances
@@ -0,0 +1,20 @@
+diff --git a/src/forward.c b/src/forward.c
+index e3fa94b..ecf3b98 100644
+--- a/src/forward.c
+++ b/src/forward.c
+@@ -789,9 +789,12 @@ void reply_query(int fd, int family, time_t now)
+ 
+   /* Note: if we send extra options in the EDNS0 header, we can't recreate
+      the query from the reply. */
+-  if (RCODE(header) == REFUSED &&
+-      forward->forwardall == 0 &&
+-      !(forward->flags & FREC_HAS_EXTRADATA))
+  if ((RCODE(header) == REFUSED &&
+        forward->forwardall == 0 &&
+       !(forward->flags & FREC_HAS_EXTRADATA)) ||
+      /* If strict-order is set, try next server on NXDOMAIN reply */
+      (RCODE(header) == NXDOMAIN && option_bool(OPT_ORDER) &&
+       server->next != NULL))
+     /* for broken servers, attempt to send to another one. */
+     {
+       unsigned char *pheader;
@@ -1,5 +1,5 @@

-This is the README for the DNSmasq webmin module.
+This is the README for the Dnsmasq webmin module.

 Problems:

@@ -48,7 +48,7 @@ wade through the config file and man pages again.

 If you modify it, or add a language file, and you have a spare moment,
 please e-mail me - I won't be upset at all if you fix my poor coding!
-(rather the opposite - I'd be pleased someone found it usefull)
+(rather the opposite - I'd be pleased someone found it useful)

 Cheers,
 	Neil Fisher <neil@magnecor.com.au>
@@ -1,6 +0,0 @@
-CFLAGS?= -O2 -Wall -W
-
-all: dhcp_release dhcp_lease_time
-
-clean:
-	rm -f *~ *.o core dhcp_release dhcp_lease_time
@@ -4,7 +4,7 @@ reboot, then it will eventually be restored as hosts renew their
 leases. Until a host renews (which may take hours/days) it will
 not exist in the DNS if dnsmasq's DDNS function is in use.

-*WRT systems remount all non-volatile fileystems read-only after boot,
+*WRT systems remount all non-volatile filesystems read-only after boot,
 so the normal leasefile will not work. They do, however have NV
 storage, accessed with the nvram command:

@@ -62,7 +62,7 @@ about 100 bytes, so restricting the number of leases to 50 will limit
 use to half that. (The default limit in the distributed source is 150)

 Any UI script which reads the dnsmasq leasefile will have to be
-ammended, probably by changing it to read the output of 
+amended, probably by changing it to read the output of 
 `lease_update init` instead.
 

@@ -44,10 +44,22 @@ SetFilterWin2KOption
 --------------------
 Takes boolean, sets or resets the --filterwin2k option.

+SetFilterA
+------------------------
+Takes boolean, sets or resets the --filter-A option.
+
+SetFilterAAAA
+------------------------
+Takes boolean, sets or resets the --filter-AAAA option.
+
 SetBogusPrivOption
 ------------------
 Takes boolean, sets or resets the --bogus-priv option.

+SetLocaliseQueriesOption
+------------------------
+Takes boolean, sets or resets the --localise-queries option.
+
 SetServers
 ----------
 Returns nothing. Takes a set of arguments representing the new
@@ -169,7 +181,94 @@ Return an array of strings, each string is the IP address of an upstream
 server which has been found to loop queries back to this dnsmasq instance, and 
 it therefore not being used.

+AddDhcpLease
+------------

+Returns nothing. Adds or updates a DHCP or DHCPv6 lease to the internal lease
+database, as if a client requested and obtained a lease.
+
+If a lease for the IPv4 or IPv6 address already exist, it is overwritten.
+
+Note that this function will trigger the DhcpLeaseAdded or DhcpLeaseUpdated
+D-Bus signal and will run the configured DHCP lease script accordingly.
+
+This function takes many arguments which are the lease parameters:
+- A string with the textual representation of the IPv4 or IPv6 address of the
+  client.
+
+  Examples:
+  "192.168.1.115"
+  "1003:1234:abcd::1%eth0"
+  "2001:db8:abcd::1"
+
+- A string representing the hardware address of the client, using the same
+  format as the one used in the lease database.
+
+  Examples:
+
+  "00:23:45:67:89:ab"
+  "06-00:20:e0:3b:13:af" (token ring)
+
+- The hostname of the client, as an array of bytes (so there is no problem
+  with non-ASCII character encoding). May be empty.
+
+  Example (for "hostname.or.fqdn"):
+  [104, 111, 115, 116, 110, 97, 109, 101, 46, 111, 114, 46, 102, 113, 100, 110]
+
+- The client identifier (IPv4) or DUID (IPv6) as an array of bytes. May be
+  empty.
+
+  Examples:
+
+  DHCPv6 DUID:
+  [0, 3, 0, 1, 0, 35, 69, 103, 137, 171]
+  DHCPv4 client identifier:
+  [255, 12, 34, 56, 78, 0, 1, 0, 1, 29, 9, 99, 190, 35, 69, 103, 137, 171]
+
+- The duration of the lease, in seconds. If the lease is updated, then
+  the duration replaces the previous duration.
+
+  Example:
+
+  7200
+
+- The IAID (Identity association identifier) of the DHCPv6 lease, as a network
+  byte-order unsigned integer. For DHCPv4 leases, this must be set to 0.
+
+  Example (for IPv6):
+
+  203569230
+
+- A boolean which, if true, indicates that the DHCPv6 lease is for a temporary
+  address (IA_TA). If false, the DHCPv6 lease is for a non-temporary address
+  (IA_NA). For DHCPv4 leases, this must be set to false.
+
+RemoveDhcpLease
+---------------
+
+Returns nothing. Removes a DHCP or DHCPv6 lease to the internal lease
+database, as if a client sent a release message to abandon a lease.
+
+This function takes only one parameter: the text representation of the
+IPv4 or IPv6 address of the lease to remove.
+
+Note that this function will trigger the DhcpLeaseRemoved signal and the
+configured DHCP lease script will be run with the "del" action.
+
+GetMetrics
+----------
+
+Returns an array with various metrics for DNS and DHCP.
+
+GetServerMetrics
+----------------
+
+Returns per-DNS-server metrics.
+
+ClearMetrics
+------------
+
+Clear call metric counters, global and per-server.

 2. SIGNALS
 ----------
@@ -1,5 +0,0 @@
-/etc/init.d/dnsmasq
-/etc/default/dnsmasq
-/etc/dnsmasq.conf
-/etc/resolvconf/update.d/dnsmasq
-/etc/insserv.conf.d/dnsmasq
@@ -1,42 +1,66 @@
 Source: dnsmasq
 Section: net
 Priority: optional
-Build-depends: gettext, libnetfilter-conntrack-dev [linux-any],
-               libidn11-dev, libdbus-1-dev (>=0.61), libgmp-dev, 
-               nettle-dev (>=2.4-3), libbsd-dev [!linux-any]
+Build-Depends: dh-exec, gettext, libnetfilter-conntrack-dev [linux-any],
+               libidn2-dev, libdbus-1-dev (>=0.61), libgmp-dev,
+               nettle-dev (>=2.4-3), libbsd-dev [kfreebsd-any],
+	       liblua5.4-dev, dh-runit, debhelper-compat (= 13),
+               pkg-config, libnftables-dev
 Maintainer: Simon Kelley <simon@thekelleys.org.uk>
-Standards-Version: 3.9.5
+Homepage: https://www.thekelleys.org.uk/dnsmasq/doc.html
+Vcs-Git: https://thekelleys.org.uk/git/dnsmasq.git
+Vcs-Browser: https://thekelleys.org.uk/gitweb/?p=dnsmasq.git
+Standards-Version: 4.6.2
+Rules-Requires-Root: no

 Package: dnsmasq
 Architecture: all
-Depends: netbase, dnsmasq-base(>= ${binary:Version}),
-         init-system-helpers (>= 1.18~)
+Pre-Depends: ${misc:Pre-Depends}
+Depends: netbase, dnsmasq-base,
+         ${misc:Depends}
 Suggests: resolvconf
-Conflicts: resolvconf (<<1.15)
-Description: Small caching DNS proxy and DHCP/TFTP server
+Breaks: ${runit:Breaks}
+Conflicts: resolvconf (<<1.15), ${runit:Conflicts}
+Description: Small caching DNS proxy and DHCP/TFTP server - system daemon
 Dnsmasq is a lightweight, easy to configure, DNS forwarder and DHCP
- server. It is designed to provide DNS and optionally, DHCP, to a 
- small network. It can serve the names of local machines which are 
- not in the global DNS. The DHCP server integrates with the DNS 
+ server. It is designed to provide DNS and optionally, DHCP, to a
+ small network. It can serve the names of local machines which are
+ not in the global DNS. The DHCP server integrates with the DNS
 server and allows machines with DHCP-allocated addresses
 to appear in the DNS with names configured either in each host or
- in a central configuration file. Dnsmasq supports static and dynamic 
+ in a central configuration file. Dnsmasq supports static and dynamic
 DHCP leases and BOOTP/TFTP for network booting of diskless machines.

 Package: dnsmasq-base
 Architecture: any
-Depends: adduser, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends}
 Breaks: dnsmasq (<< 2.63-1~)
-Replaces: dnsmasq (<< 2.63-1~)
+Replaces: dnsmasq (<< 2.63-1~), dnsmasq-base
 Recommends: dns-root-data
-Description: Small caching DNS proxy and DHCP/TFTP server
+Provides: dnsmasq-base
+Conflicts: dnsmasq-base-lua
+Description: Small caching DNS proxy and DHCP/TFTP server - executable
 This package contains the dnsmasq executable and documentation, but
 not the infrastructure required to run it as a system daemon. For
 that, install the dnsmasq package.

+Package: dnsmasq-base-lua
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Breaks: dnsmasq (<< 2.63-1~)
+Replaces: dnsmasq (<< 2.63-1~), dnsmasq-base
+Recommends: dns-root-data
+Provides: dnsmasq-base
+Conflicts: dnsmasq-base
+Description: Small caching DNS proxy and DHCP/TFTP server - executable, Lua-enabled
+ This package contains the dnsmasq executable and documentation, but
+ not the infrastructure required to run it as a system daemon. For
+ that, install the dnsmasq package. This package is an alternative
+ to dnsmasq-base which includes the Lua interpreter.
+
 Package: dnsmasq-utils
 Architecture: linux-any
-Depends: ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends}
 Conflicts: dnsmasq (<<2.40)
 Description: Utilities for manipulating DHCP leases
 Small utilities to query a DHCP server's lease database and
@@ -1,21 +1,58 @@
-dnsmasq is Copyright (c) 2000-2015 Simon Kelley
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: dnsmasq
+Upstream-Contact: Simon Kelley <simon@thekelleys.org.uk>
+Source: https://thekelleys.org.uk/dnsmasq/

-It was downloaded from: http://www.thekelleys.org.uk/dnsmasq/
+Files: *
+Copyright: 2000-2024 Simon Kelley <simon@thekelleys.org.uk>
+License: GPL-2 or GPL-3

-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; version 2 dated June, 1991, or
-   (at your option) version 3 dated 29 June, 2007.
- 
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
+Files: src/dnssec.c
+Copyright: 2012-2024 Simon Kelley <simon@thekelleys.org.uk>
+           2012      Giovanni Bajo <rasky@develer.com>

-On Debian GNU/Linux systems, the text of the GNU general public license is 
-available in the file /usr/share/common-licenses/GPL-2 or 
-/usr/share/common-licenses/GPL-3
+Files: debian/*
+Copyright: 2004-2024 Simon Kelley <simon@thekelleys.org.uk>
+           2012      Lars Bahner <bahner@debian.org>
+           2024      Sven Geuer <debmaint@g-e-u-e-r.de>
+License: GPL-2 or GPL-3

-The Debian package of dnsmasq was created by Simon Kelley with assistance 
-from Lars Bahner.
+License: GPL-2
+ This program is free software; you can redistribute it
+ and/or modify it under the terms of the GNU General Public
+ License as published by the Free Software Foundation;
+ version 2 dated June, 1991.
+ .
+ This program is distributed in the hope that it will be
+ useful, but WITHOUT ANY WARRANTY; without even the implied
+ warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ PURPOSE.  See the GNU General Public License for more
+ details.
+ .
+ You should have received a copy of the GNU General Public
+ License along with this program.  If not, see
+ <https://www.gnu.org/licenses/gpl-2.0>.
+ .
+ On Debian systems, the full text of the GNU General Public
+ License can be found in the file
+ `/usr/share/common-licenses/GPL-2'.

+License: GPL-3
+ This program is free software; you can redistribute it
+ and/or modify it under the terms of the GNU General Public
+ License as published by the Free Software Foundation;
+ version 3 dated 29 June, 2007.
+ .
+ This program is distributed in the hope that it will be
+ useful, but WITHOUT ANY WARRANTY; without even the implied
+ warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ PURPOSE.  See the GNU General Public License for more
+ details.
+ .
+ You should have received a copy of the GNU General Public
+ License along with this program.  If not, see
+ <https://www.gnu.org/licenses/gpl-3.0>.
+ .
+ On Debian systems, the full text of the GNU General Public
+ License can be found in the file
+ `/usr/share/common-licenses/GPL-3'.
@@ -0,0 +1 @@
+dnsmasq-base.dirs
@@ -0,0 +1 @@
+dnsmasq-base.docs
@@ -0,0 +1,3 @@
+#!/usr/bin/dh-exec
+debian/dbus.conf => /usr/share/dbus-1/system.d/dnsmasq.conf
+trust-anchors.conf /usr/share/dnsmasq-base-lua
@@ -0,0 +1,2 @@
+usr/share/dnsmasq-base-lua usr/share/dnsmasq-base
+usr/share/doc/dnsmasq-base-lua usr/share/doc/dnsmasq-base
@@ -0,0 +1,9 @@
+# With the use of debhelper /usr/share/doc/dnsmasq-base-lua has become a
+# directory as required in
+# https://www.debian.org/doc/debian-policy/ch-docs.html#additional-documentation
+# thus /usr/share/doc/dnsmasq-base will be a link from now onwards.
+symlink_to_dir /usr/share/doc/dnsmasq-base-lua /usr/share/doc/dnsmasq-base 2.89-1.1~ dnsmasq-base-lua
+dir_to_symlink /usr/share/doc/dnsmasq-base /usr/share/doc/dnsmasq-base-lua 2.89-1.1~ dnsmasq-base-lua
+# Due to lintian warning dbus-policy-in-etc this file has been moved to
+# /usr/share/dbus-1/system.d/dnsmasq.conf and thus is not a conffile any more.
+rm_conffile /etc/dbus-1/system.d/dnsmasq.conf 2.89-1.1~ dnsmasq-base-lua
@@ -0,0 +1 @@
+dnsmasq-base.postinst
@@ -0,0 +1 @@
+dnsmasq-base.postrm
@@ -1 +0,0 @@
-/etc/dbus-1/system.d/dnsmasq.conf
@@ -0,0 +1 @@
+/var/lib/misc
@@ -0,0 +1,8 @@
+doc.html
+setup.html
+dnsmasq.conf.example
+FAQ
+CHANGELOG.archive
+dbus/DBus-interface
+debian/systemd_howto
+debian/readme
@@ -0,0 +1,3 @@
+#!/usr/bin/dh-exec
+debian/dbus.conf => /usr/share/dbus-1/system.d/dnsmasq.conf
+trust-anchors.conf /usr/share/dnsmasq-base
@@ -0,0 +1,3 @@
+# Due to lintian warning dbus-policy-in-etc this file has been moved to
+# /usr/share/dbus-1/system.d/dnsmasq.conf and thus is not a conffile any more.
+rm_conffile /etc/dbus-1/system.d/dnsmasq.conf 2.89-1.1~ dnsmasq-base
@@ -2,13 +2,16 @@
 set -e

 # Create the dnsmasq user in dnsmasq-base, so that Dbus doesn't complain.
-      
-# create a user to run as (code stolen from dovecot-common)
+
 if [ "$1" = "configure" ]; then
+  # Create the user to run as.
  if [ -z "`id -u dnsmasq 2> /dev/null`" ]; then
-    adduser --system  --home /var/lib/misc --gecos "dnsmasq" \
-            --no-create-home --disabled-password \
-            --quiet dnsmasq || true
+    useradd --system \
+            --gid nogroup \
+            --comment dnsmasq \
+            --home-dir /var/lib/misc --no-create-home \
+            --shell /usr/sbin/nologin \
+            dnsmasq
  fi

  # Make the directory where we keep the pid file - this
@@ -16,9 +19,12 @@ if [ "$1" = "configure" ]; then
  # This is only actually used by the dnsmasq binary package, not
  # dnsmasq-base, but it's much easier to create it here so that
  # we don't have synchronisation issues with the creation of the
-  # dnsmasq user. 
-  if [ ! -d /var/run/dnsmasq ]; then
-    mkdir /var/run/dnsmasq
-    chown dnsmasq:nogroup /var/run/dnsmasq
+  # dnsmasq user.
+  if [ ! -d /run/dnsmasq ]; then
+    mkdir /run/dnsmasq
+    chown dnsmasq:nogroup /run/dnsmasq
  fi
 fi
+
+#DEBHELPER#
+
@@ -2,10 +2,9 @@
 set -e

 if [ purge = "$1" ]; then
-   if [ -x "$(command -v deluser)" ]; then
-     deluser --quiet --system dnsmasq > /dev/null || true
-  else
-     echo >&2 "not removing dnsmasq system account because deluser command was not found"
-  fi
-  rm -rf /var/run/dnsmasq
+  userdel dnsmasq
+  rm -rf /run/dnsmasq
 fi
+
+#DEBHELPER#
+
@@ -0,0 +1,3 @@
+dhcp_lease_time	/usr/bin
+dhcp_release	/usr/bin
+dhcp_release6	/usr/bin
@@ -0,0 +1,3 @@
+dhcp_lease_time.1
+dhcp_release.1
+dhcp_release6.1
@@ -1,21 +1,25 @@
-# This file has five functions: 
-# 1) to completely disable starting dnsmasq, 
-# 2) to set DOMAIN_SUFFIX by running `dnsdomainname` 
+# This file has six functions:
+# 1) to completely disable starting this dnsmasq instance
+# 2) to set DOMAIN_SUFFIX by running `dnsdomainname`
 # 3) to select an alternative config file
 #    by setting DNSMASQ_OPTS to --conf-file=<file>
 # 4) to tell dnsmasq to read the files in /etc/dnsmasq.d for
 #    more configuration variables.
 # 5) to stop the resolvconf package from controlling dnsmasq's
 #    idea of which upstream nameservers to use.
-# For upgraders from very old versions, all the shell variables set 
+# 6) to avoid using this dnsmasq instance as the system's default resolver
+#    by setting DNSMASQ_EXCEPT="lo"
+# For upgraders from very old versions, all the shell variables set
 # here in previous versions are still honored by the init script
 # so if you just keep your old version of this file nothing will break.

 #DOMAIN_SUFFIX=`dnsdomainname`
 #DNSMASQ_OPTS="--conf-file=/etc/dnsmasq.alt"

-# Whether or not to run the dnsmasq daemon; set to 0 to disable.
-ENABLED=1
+# The dnsmasq daemon is run by default conforming to the Debian Policy.
+# To disable the service,
+# for SYSV init, use "update-rc.d dnsmasq disable",
+# for systemd, use "systemctl disable dnsmasq".

 # By default search this drop directory for configuration options.
 # Libvirt leaves a file here to make the system dnsmasq play nice.
@@ -24,10 +28,15 @@ ENABLED=1
 # in backups made by dpkg.
 CONFIG_DIR=/etc/dnsmasq.d,.dpkg-dist,.dpkg-old,.dpkg-new

-# If the resolvconf package is installed, dnsmasq will use its output 
-# rather than the contents of /etc/resolv.conf to find upstream 
+# If the resolvconf package is installed, dnsmasq will use its output
+# rather than the contents of /etc/resolv.conf to find upstream
 # nameservers. Uncommenting this line inhibits this behaviour.
-# Note that including a "resolv-file=<filename>" line in 
+# Note that including a "resolv-file=<filename>" line in
 # /etc/dnsmasq.conf is not enough to override resolvconf if it is
 # installed: the line below must be uncommented.
 #IGNORE_RESOLVCONF=yes
+
+# If the resolvconf package is installed, dnsmasq will tell resolvconf
+# to use dnsmasq under 127.0.0.1 as the system's default resolver.
+# Uncommenting this line inhibits this behaviour.
+#DNSMASQ_EXCEPT="lo"
@@ -0,0 +1,170 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:       dnsmasq
+# Required-Start: $network $remote_fs $syslog
+# Required-Stop:  $network $remote_fs $syslog
+# Default-Start:  2 3 4 5
+# Default-Stop:   0 1 6
+# Description:    DHCP and DNS server
+### END INIT INFO
+
+# Don't exit on error status
+set +e
+
+# The following test ensures the dnsmasq service is not started, when the
+# package 'dnsmasq' is removed but not purged, even if the dnsmasq-base
+# package is still in place.
+if [ -r /usr/share/dnsmasq/init-system-common ]; then
+    # 'dnsmasq' is installed: source initial code used also with systemd.
+    . /usr/share/dnsmasq/init-system-common
+else
+    # 'dnsmasq' is removed but not purged, or damaged: do nothing.
+    exit 0
+fi
+
+# Double-check 'dnsmasq-base' or 'dnsmasq-base-lua' is installed.
+test -x ${DAEMON} || exit 0
+
+# Source the SysV init-functions which should always be available.
+. /lib/lsb/init-functions || exit 0
+
+start()
+{
+    # Return
+    #   0 if daemon has been started
+    #   1 if daemon was already running
+    #   2 if daemon could not be started
+
+    # /run may be volatile, so we need to ensure that
+    # /run/dnsmasq exists here as well as in postinst
+    if [ ! -d /run/dnsmasq ]; then
+        mkdir /run/dnsmasq || { [ -d /run/dnsmasq ] || return 2 ; }
+        chown dnsmasq:nogroup /run/dnsmasq || return 2
+    fi
+    [ -x /sbin/restorecon ] && /sbin/restorecon /run/dnsmasq
+
+    start-stop-daemon --start --quiet --pidfile /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid --exec ${DAEMON} --test > /dev/null || return 1
+    start-stop-daemon --start --quiet --pidfile /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid --exec ${DAEMON} -- \
+        -x /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid \
+        ${MAILHOSTNAME:+ -m ${MAILHOSTNAME}} \
+        ${MAILTARGET:+ -t ${MAILTARGET}} \
+        ${DNSMASQ_USER:+ -u ${DNSMASQ_USER}} \
+        ${DNSMASQ_INTERFACES:+ ${DNSMASQ_INTERFACES}} \
+        ${DHCP_LEASE:+ -l ${DHCP_LEASE}} \
+        ${DOMAIN_SUFFIX:+ -s ${DOMAIN_SUFFIX}} \
+        ${RESOLV_CONF:+ -r ${RESOLV_CONF}} \
+        ${CACHESIZE:+ -c ${CACHESIZE}} \
+        ${CONFIG_DIR:+ -7 ${CONFIG_DIR}} \
+        ${DNSMASQ_OPTS:+ ${DNSMASQ_OPTS}} \
+        || return 2
+}
+
+stop()
+{
+    # Return
+    #   0 if daemon has been stopped
+    #   1 if daemon was already stopped
+    #   2 if daemon could not be stopped
+    #   other if a failure occurred
+    start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid --name ${NAME}
+}
+
+status()
+{
+    # Return
+    #   0 if daemon is running
+    #   1 if daemon is dead and pid file exists
+    #   3 if daemon is not running
+    #   4 if daemon status is unknown
+    start-stop-daemon --start --quiet --pidfile /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid --exec ${DAEMON} --test > /dev/null
+    case "${?}" in
+      0) [ -e "/run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid" ] && return 1 ; return 3 ;;
+      1) return 0 ;;
+      *) return 4 ;;
+    esac
+}
+
+case "${1}" in
+  start)
+    log_daemon_msg "Starting ${DESC}" "${NAME}${INSTANCE:+.${INSTANCE}}"
+    start
+    case "${?}" in
+      0)
+        log_end_msg 0
+        start_resolvconf
+        exit 0
+        ;;
+      1)
+        log_success_msg "(already running)"
+        exit 0
+        ;;
+      *)
+        log_end_msg 1
+        exit 1
+        ;;
+    esac
+    ;;
+  stop)
+    stop_resolvconf
+    log_daemon_msg "Stopping ${DESC}" "${NAME}${INSTANCE:+.${INSTANCE}}"
+    stop
+    RETVAL="${?}"
+    case "${RETVAL}" in
+      0) log_end_msg 0 ; exit 0 ;;
+      1) log_warning_msg "(not running)" ; exit 0 ;;
+      *) log_end_msg 1; exit 1 ;;
+    esac
+    ;;
+  restart|force-reload)
+    checkconfig
+    if [ ${?} -ne 0 ]; then
+        NAME="configuration syntax check"
+        RETVAL="2"
+    else
+        stop_resolvconf
+        stop
+        RETVAL="${?}"
+    fi
+    log_daemon_msg "Restarting ${DESC}" "${NAME}${INSTANCE:+.${INSTANCE}}"
+    case "${RETVAL}" in
+      0|1)
+        sleep 2
+        start
+        case "${?}" in
+          0)
+            log_end_msg 0
+            start_resolvconf
+            exit 0
+            ;;
+          *)
+            log_end_msg 1
+            exit 1
+            ;;
+        esac
+        ;;
+      *)
+        log_end_msg 1
+        exit 1
+        ;;
+    esac
+    ;;
+  status)
+    log_daemon_msg "Checking ${DESC}" "${NAME}${INSTANCE:+.${INSTANCE}}"
+    status
+    case "${?}" in
+      0) log_success_msg "(running)" ; exit 0 ;;
+      1) log_success_msg "(dead, pid file exists)" ; exit 1 ;;
+      3) log_success_msg "(not running)" ; exit 3 ;;
+      *) log_success_msg "(unknown)" ; exit 4 ;;
+    esac
+    ;;
+  dump-stats)
+    kill -s USR1 `cat /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid`
+    ;;
+  *)
+    echo "Usage: /etc/init.d/${NAME} {start|stop|restart|force-reload|dump-stats|status}" >&2
+    exit 3
+    ;;
+esac
+
+exit 0
@@ -0,0 +1,8 @@
+#!/usr/bin/dh-exec
+debian/resolvconf => /etc/resolvconf/update.d/dnsmasq
+debian/resolvconf-package => /usr/lib/resolvconf/dpkg-event.d/dnsmasq
+debian/init-system-common => /usr/share/dnsmasq/init-system-common
+debian/systemd-helper => /usr/share/dnsmasq/systemd-helper
+dnsmasq.conf.example => /etc/dnsmasq.conf
+debian/readme.dnsmasq.d => /etc/dnsmasq.d/README
+debian/insserv => /etc/insserv.conf.d/dnsmasq
@@ -0,0 +1 @@
+usr/share/dnsmasq-base/trust-anchors.conf usr/share/dnsmasq/trust-anchors.conf
@@ -0,0 +1,2 @@
+# /usr/share/doc/dnsmasq was a symlink in versions < 2.81-1 (see #985282)
+symlink_to_dir /usr/share/doc/dnsmasq dnsmasq-base 2.84-1.2~ dnsmasq
@@ -0,0 +1 @@
+debian/dnsmasq.runscript name=dnsmasq,logscript,presubj
@@ -0,0 +1,5 @@
+#!/bin/sh -eu
+if [ -x /sbin/resolvconf ] ; then
+	/sbin/resolvconf -d lo.dnsmasq
+fi
+
@@ -0,0 +1,43 @@
+#!/lib/runit/invoke-run
+
+readonly name=dnsmasq
+readonly daemon=/usr/sbin/dnsmasq
+readonly marker=/usr/share/dnsmasq/installed-marker
+
+test -e "${marker}" || exec sv down "${name}"
+test -x "${daemon}" || exec sv down "${name}"
+
+if [ ! "${RESOLV_CONF:-}" ] &&
+   [ "${IGNORE_RESOLVCONF:-}" != "yes" ] &&
+   [ -x /sbin/resolvconf ]
+then
+	RESOLV_CONF=/run/dnsmasq/resolv.conf
+fi
+
+# This tells dnsmasq to ignore DNS requests that don't come from a local network.
+# It's automatically ignored if  --interface --except-interface, --listen-address
+# or --auth-server exist in the configuration, so for most installations, it will
+# have no effect, but for otherwise-unconfigured installations, it stops dnsmasq
+# from being vulnerable to DNS-reflection attacks.
+
+DNSMASQ_OPTS="${DNSMASQ_OPTS:-} --local-service"
+
+# If the dns-root-data package is installed, then the trust anchors will be
+# available in $ROOT_DS, in BIND zone-file format. Reformat as dnsmasq
+# --trust-anchor options.
+
+ROOT_DS="/usr/share/dns/root.ds"
+
+if [ -f $ROOT_DS ]; then
+    DNSMASQ_OPTS="$DNSMASQ_OPTS `env LC_ALL=C sed -rne "s/^([.a-zA-Z0-9]+)([[:space:]]+[0-9]+)*([[:space:]]+IN)*[[:space:]]+DS[[:space:]]+/--trust-anchor=\1,/;s/[[:space:]]+/,/gp" $ROOT_DS | tr '\n' ' '`"
+fi
+
+mkdir -p /run/dnsmasq
+chown dnsmasq:nogroup /run/dnsmasq
+[ -x /sbin/restorecon ] && /sbin/restorecon /run/dnsmasq
+exec "${daemon}" \
+	--keep-in-foreground \
+	--log-facility=/dev/stdout \
+	${RESOLV_CONF:+ -r $RESOLV_CONF} \
+	${DNSMASQ_OPTS} \
+	-u dnsmasq
@@ -0,0 +1,31 @@
+[Unit]
+Description=dnsmasq - A lightweight DHCP and caching DNS server
+Requires=network.target
+Wants=nss-lookup.target
+Before=nss-lookup.target
+After=network.target
+
+[Service]
+Type=forking
+PIDFile=/run/dnsmasq/dnsmasq.pid
+
+# Test the config file and refuse starting if it is not valid.
+ExecStartPre=/usr/share/dnsmasq/systemd-helper checkconfig
+
+# We run dnsmasq via the /usr/share/dnsmasq/systemd-helper script which acts
+# as a wrapper picking up extra configuration files and then execs dnsmasq
+# itself, when called with the "exec" function.
+ExecStart=/usr/share/dnsmasq/systemd-helper exec
+
+# The *-resolvconf functions configure (and deconfigure)
+# resolvconf to work with the dnsmasq DNS server. They're called like
+# this to get correct error handling (ie don't start-resolvconf if the
+# dnsmasq daemon fails to start).
+ExecStartPost=/usr/share/dnsmasq/systemd-helper start-resolvconf
+ExecStop=/usr/share/dnsmasq/systemd-helper stop-resolvconf
+
+
+ExecReload=/bin/kill -HUP $MAINPID
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1 @@
+d /run/dnsmasq 755 dnsmasq nogroup
@@ -0,0 +1,31 @@
+[Unit]
+Description=dnsmasq (%i) - A lightweight DHCP and caching DNS server
+Requires=network.target
+Wants=nss-lookup.target
+Before=nss-lookup.target
+After=network.target
+
+[Service]
+Type=forking
+PIDFile=/run/dnsmasq/dnsmasq.%i.pid
+
+# Test the config file and refuse starting if it is not valid.
+ExecStartPre=/usr/share/dnsmasq/systemd-helper checkconfig "%i"
+
+# We run dnsmasq via the /usr/share/dnsmasq/systemd-helper script which acts
+# as a wrapper picking up extra configuration files and then execs dnsmasq
+# itself, when called with the "exec" function.
+ExecStart=/usr/share/dnsmasq/systemd-helper exec "%i"
+
+# The *-resolvconf functions configure (and deconfigure)
+# resolvconf to work with the dnsmasq DNS server. They're called like
+# this to get correct error handling (ie don't start-resolvconf if the
+# dnsmasq daemon fails to start).
+ExecStartPost=/usr/share/dnsmasq/systemd-helper start-resolvconf "%i"
+ExecStop=/usr/share/dnsmasq/systemd-helper stop-resolvconf "%i"
+
+
+ExecReload=/bin/kill -HUP $MAINPID
+
+[Install]
+WantedBy=multi-user.target
@@ -1,315 +0,0 @@
-#!/bin/sh
-### BEGIN INIT INFO
-# Provides:       dnsmasq
-# Required-Start: $network $remote_fs $syslog
-# Required-Stop:  $network $remote_fs $syslog
-# Default-Start:  2 3 4 5
-# Default-Stop:   0 1 6
-# Description:    DHCP and DNS server
-### END INIT INFO
-
-set +e   # Don't exit on error status
-
-PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
-DAEMON=/usr/sbin/dnsmasq
-NAME=dnsmasq
-DESC="DNS forwarder and DHCP server"
-
-# Most configuration options in /etc/default/dnsmasq are deprecated
-# but still honoured.
-ENABLED=1
-if [ -r /etc/default/$NAME ]; then
-	. /etc/default/$NAME
-fi
-
-# Get the system locale, so that messages are in the correct language, and the 
-# charset for IDN is correct
-if [ -r /etc/default/locale ]; then
-        . /etc/default/locale
-        export LANG
-fi
-
-# /etc/dnsmasq.d/README is a non-conffile installed by the dnsmasq package.
-# Should the dnsmasq package be removed, the following test ensures that
-# the daemon is no longer started, even if the dnsmasq-base package is
-# still in place.
-test -e /etc/dnsmasq.d/README || exit 0
-
-test -x $DAEMON || exit 0
-
-# Provide skeleton LSB log functions for backports which don't have LSB functions.
-if [ -f /lib/lsb/init-functions ]; then
-         . /lib/lsb/init-functions
-else
-         log_warning_msg () {
-            echo "${@}."
-         }
-
-         log_success_msg () {
-            echo "${@}."
-         }
-
-         log_daemon_msg () {
-            echo -n "${1}: $2"
-         }
-
-	 log_end_msg () {
-            if [ $1 -eq 0 ]; then
-              echo "."
-            elif [ $1 -eq 255 ]; then
-              /bin/echo -e " (warning)."
-            else
-              /bin/echo -e " failed!"
-            fi
-         }
-fi
-
-# RESOLV_CONF:
-# If the resolvconf package is installed then use the resolv conf file
-# that it provides as the default.  Otherwise use /etc/resolv.conf as
-# the default.
-#
-# If IGNORE_RESOLVCONF is set in /etc/default/dnsmasq or an explicit
-# filename is set there then this inhibits the use of the resolvconf-provided
-# information.
-#
-# Note that if the resolvconf package is installed it is not possible to 
-# override it just by configuration in /etc/dnsmasq.conf, it is necessary
-# to set IGNORE_RESOLVCONF=yes in /etc/default/dnsmasq.
-
-if [ ! "$RESOLV_CONF" ] &&
-   [ "$IGNORE_RESOLVCONF" != "yes" ] &&
-   [ -x /sbin/resolvconf ]
-then
-	RESOLV_CONF=/var/run/dnsmasq/resolv.conf
-fi
-
-for INTERFACE in $DNSMASQ_INTERFACE; do
-	DNSMASQ_INTERFACES="$DNSMASQ_INTERFACES -i $INTERFACE"
-done
-
-for INTERFACE in $DNSMASQ_EXCEPT; do
-	DNSMASQ_INTERFACES="$DNSMASQ_INTERFACES -I $INTERFACE"
-done
-
-if [ ! "$DNSMASQ_USER" ]; then
-   DNSMASQ_USER="dnsmasq"
-fi
-
-# This tells dnsmasq to ignore DNS requests that don't come from a local network.
-# It's automatically ignored if  --interface --except-interface, --listen-address 
-# or --auth-server exist in the configuration, so for most installations, it will
-# have no effect, but for otherwise-unconfigured installations, it stops dnsmasq
-# from being vulnerable to DNS-reflection attacks.
-
-DNSMASQ_OPTS="$DNSMASQ_OPTS --local-service"
-
-# If the dns-root-data package is installed, then the trust anchors will be 
-# available in $ROOT_DS, in BIND zone-file format. Reformat as dnsmasq
-# --trust-anchor options.
-
-ROOT_DS="/usr/share/dns/root.ds"
-
-if [ -f $ROOT_DS ]; then
-   DNSMASQ_OPTS="$DNSMASQ_OPTS `sed -e s/". IN DS "/--trust-anchor=.,/ -e s/" "/,/g $ROOT_DS | tr '\n' ' '`" 
-fi
-
-start()
-{
-        # Return
-	#   0 if daemon has been started
-	#   1 if daemon was already running
-	#   2 if daemon could not be started
-
-        # /var/run may be volatile, so we need to ensure that
-        # /var/run/dnsmasq exists here as well as in postinst
-        if [ ! -d /var/run/dnsmasq ]; then
-           mkdir /var/run/dnsmasq || return 2
-           chown dnsmasq:nogroup /var/run/dnsmasq || return 2
-        fi
-
-	start-stop-daemon --start --quiet --pidfile /var/run/dnsmasq/$NAME.pid --exec $DAEMON --test > /dev/null || return 1
-	start-stop-daemon --start --quiet --pidfile /var/run/dnsmasq/$NAME.pid --exec $DAEMON -- \
-		-x /var/run/dnsmasq/$NAME.pid \
-	        ${MAILHOSTNAME:+ -m $MAILHOSTNAME} \
-		${MAILTARGET:+ -t $MAILTARGET} \
-		${DNSMASQ_USER:+ -u $DNSMASQ_USER} \
-		${DNSMASQ_INTERFACES:+ $DNSMASQ_INTERFACES} \
-		${DHCP_LEASE:+ -l $DHCP_LEASE} \
-		${DOMAIN_SUFFIX:+ -s $DOMAIN_SUFFIX} \
-		${RESOLV_CONF:+ -r $RESOLV_CONF} \
-		${CACHESIZE:+ -c $CACHESIZE} \
-	        ${CONFIG_DIR:+ -7 $CONFIG_DIR} \
-		${DNSMASQ_OPTS:+ $DNSMASQ_OPTS} \
-		|| return 2
-}
-
-start_resolvconf()
-{
-# If interface "lo" is explicitly disabled in /etc/default/dnsmasq
-# Then dnsmasq won't be providing local DNS, so don't add it to
-# the resolvconf server set.
-	for interface in $DNSMASQ_EXCEPT
-	do
-		[ $interface = lo ] && return
-	done
-
-        if [ -x /sbin/resolvconf ] ; then
-		echo "nameserver 127.0.0.1" | /sbin/resolvconf -a lo.$NAME
-	fi
-	return 0
-}
-
-stop()
-{
-	# Return
-	#   0 if daemon has been stopped
-	#   1 if daemon was already stopped
-	#   2 if daemon could not be stopped
-	#   other if a failure occurred
-	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile /var/run/dnsmasq/$NAME.pid --name $NAME
-}
-
-stop_resolvconf()
-{
-	if [ -x /sbin/resolvconf ] ; then
-		/sbin/resolvconf -d lo.$NAME
-	fi
-	return 0
-}
-
-status()
-{
-	# Return
-	#   0 if daemon is running
-	#   1 if daemon is dead and pid file exists
-	#   3 if daemon is not running
-	#   4 if daemon status is unknown
-	start-stop-daemon --start --quiet --pidfile /var/run/dnsmasq/$NAME.pid --exec $DAEMON --test > /dev/null
-	case "$?" in
-		0) [ -e "/var/run/dnsmasq/$NAME.pid" ] && return 1 ; return 3 ;;
-		1) return 0 ;;
-		*) return 4 ;;
-	esac
-}
-
-case "$1" in
-  start)
-	test "$ENABLED" != "0" || exit 0
-	log_daemon_msg "Starting $DESC" "$NAME"
-	start
-	case "$?" in
-		0)
-			log_end_msg 0
-			start_resolvconf
-			exit 0
-			;;
-		1)
-			log_success_msg "(already running)"
-			exit 0
-			;;
-		*)
-			log_end_msg 1
-			exit 1
-			;;
-	esac
-	;;
-  stop)
-	stop_resolvconf
-	if [ "$ENABLED" != "0" ]; then
-             log_daemon_msg "Stopping $DESC" "$NAME"
-	fi
-	stop
-        RETVAL="$?"
-	if [ "$ENABLED" = "0" ]; then
-	    case "$RETVAL" in
-	       0) log_daemon_msg "Stopping $DESC" "$NAME"; log_end_msg 0 ;;
-            esac 
-	    exit 0
-	fi
-	case "$RETVAL" in
-		0) log_end_msg 0 ; exit 0 ;;
-		1) log_warning_msg "(not running)" ; exit 0 ;;
-		*) log_end_msg 1; exit 1 ;;
-	esac
-	;;
-  restart|force-reload)
-	test "$ENABLED" != "0" || exit 1
-	$DAEMON --test ${CONFIG_DIR:+ -7 $CONFIG_DIR} ${DNSMASQ_OPTS:+ $DNSMASQ_OPTS} >/dev/null 2>&1
-	if [ $? -ne 0 ]; then
-	    NAME="configuration syntax check"
-	    RETVAL="2"
-	else   
-	    stop_resolvconf
-	    stop
-	    RETVAL="$?"
-        fi
-	log_daemon_msg "Restarting $DESC" "$NAME"
-	case "$RETVAL" in
-		0|1)
-		        sleep 2
-			start
-			case "$?" in
-				0)
-					log_end_msg 0
-					start_resolvconf
-					exit 0
-					;;
-			        *)
-					log_end_msg 1
-					exit 1
-					;;
-			esac
-			;;
-		*)
-			log_end_msg 1
-			exit 1
-			;;
-	esac
-	;;
-  status)
-	log_daemon_msg "Checking $DESC" "$NAME"
-	status
-	case "$?" in
-		0) log_success_msg "(running)" ; exit 0 ;;
-		1) log_success_msg "(dead, pid file exists)" ; exit 1 ;;
-		3) log_success_msg "(not running)" ; exit 3 ;;
-		*) log_success_msg "(unknown)" ; exit 4 ;;
-	esac
-	;;
-  dump-stats)
-        kill -s USR1 `cat /var/run/dnsmasq/$NAME.pid`
-	;;
-  systemd-start-resolvconf)
-	start_resolvconf
-	;;
-  systemd-stop-resolvconf)
-	stop_resolvconf
-	;;
-  systemd-exec)
-# /var/run may be volatile, so we need to ensure that
-        # /var/run/dnsmasq exists here as well as in postinst
-        if [ ! -d /var/run/dnsmasq ]; then
-           mkdir /var/run/dnsmasq || return 2
-           chown dnsmasq:nogroup /var/run/dnsmasq || return 2
-        fi
-	exec $DAEMON -x /var/run/dnsmasq/$NAME.pid \
-	    ${MAILHOSTNAME:+ -m $MAILHOSTNAME} \
-	    ${MAILTARGET:+ -t $MAILTARGET} \
-	    ${DNSMASQ_USER:+ -u $DNSMASQ_USER} \
-	    ${DNSMASQ_INTERFACES:+ $DNSMASQ_INTERFACES} \
-	    ${DHCP_LEASE:+ -l $DHCP_LEASE} \
-	    ${DOMAIN_SUFFIX:+ -s $DOMAIN_SUFFIX} \
-	    ${RESOLV_CONF:+ -r $RESOLV_CONF} \
-	    ${CACHESIZE:+ -c $CACHESIZE} \
-	    ${CONFIG_DIR:+ -7 $CONFIG_DIR} \
-	    ${DNSMASQ_OPTS:+ $DNSMASQ_OPTS} 
-	;;
-  *)
-	echo "Usage: /etc/init.d/$NAME {start|stop|restart|force-reload|dump-stats|status}" >&2
-	exit 3
-	;;
-esac
-
-exit 0
-
@@ -0,0 +1,102 @@
+# -*- shell-script -*-
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+DAEMON=/usr/sbin/dnsmasq
+NAME=dnsmasq
+DESC="DNS forwarder and DHCP server"
+INSTANCE="${2}"
+
+# Most configuration options in /etc/default/dnsmasq are deprecated
+# but still honoured.
+if [ -r /etc/default/${NAME}${INSTANCE:+.${INSTANCE}} ]; then
+    . /etc/default/${NAME}${INSTANCE:+.${INSTANCE}}
+fi
+
+# Get the system locale, so that messages are in the correct language, and the
+# charset for IDN is correct
+if [ -r /etc/default/locale ]; then
+    . /etc/default/locale
+    export LANG
+fi
+
+# RESOLV_CONF:
+# If the resolvconf package is installed then use the resolv conf file
+# that it provides as the default.  Otherwise use /etc/resolv.conf as
+# the default.
+#
+# If IGNORE_RESOLVCONF is set in /etc/default/dnsmasq or an explicit
+# filename is set there then this inhibits the use of the resolvconf-provided
+# information.
+#
+# Note that if the resolvconf package is installed it is not possible to
+# override it just by configuration in /etc/dnsmasq.conf, it is necessary
+# to set IGNORE_RESOLVCONF=yes in /etc/default/dnsmasq.
+
+if [ ! "${RESOLV_CONF}" ] &&
+   [ "${IGNORE_RESOLVCONF}" != "yes" ] &&
+   [ -x /sbin/resolvconf ]
+then
+    RESOLV_CONF=/run/dnsmasq/resolv.conf
+fi
+
+for INTERFACE in ${DNSMASQ_INTERFACE}; do
+    DNSMASQ_INTERFACES="${DNSMASQ_INTERFACES} -i ${INTERFACE}"
+done
+
+for INTERFACE in ${DNSMASQ_EXCEPT}; do
+    DNSMASQ_INTERFACES="${DNSMASQ_INTERFACES} -I ${INTERFACE}"
+done
+
+if [ ! "${DNSMASQ_USER}" ]; then
+    DNSMASQ_USER="dnsmasq"
+fi
+
+# This tells dnsmasq to ignore DNS requests that don't come from a local network.
+# It's automatically ignored if --interface --except-interface, --listen-address
+# or --auth-server exist in the configuration, so for most installations, it will
+# have no effect, but for otherwise-unconfigured installations, it stops dnsmasq
+# from being vulnerable to DNS-reflection attacks.
+
+DNSMASQ_OPTS="${DNSMASQ_OPTS} --local-service"
+
+# If the dns-root-data package is installed, then the trust anchors will be
+# available in ROOT_DS, in BIND zone-file format. Reformat as dnsmasq
+# --trust-anchor options.
+
+ROOT_DS="/usr/share/dns/root.ds"
+
+if [ -f ${ROOT_DS} ]; then
+    DNSMASQ_OPTS="$DNSMASQ_OPTS `env LC_ALL=C sed -rne "s/^([.a-zA-Z0-9]+)([[:space:]]+[0-9]+)*([[:space:]]+IN)*[[:space:]]+DS[[:space:]]+/--trust-anchor=\1,/;s/[[:space:]]+/,/gp" $ROOT_DS | tr '\n' ' '`"
+fi
+
+checkconfig()
+{
+    ${DAEMON} --test ${CONFIG_DIR:+ -7 ${CONFIG_DIR}} ${DNSMASQ_OPTS:+ ${DNSMASQ_OPTS}} >/dev/null 2>&1
+}
+
+start_resolvconf()
+{
+# If interface "lo" is explicitly disabled in /etc/default/dnsmasq
+# Then dnsmasq won't be providing local DNS, so don't add it to
+# the resolvconf server set.
+    for interface in ${DNSMASQ_EXCEPT}; do
+        [ ${interface} = lo ] && return
+    done
+
+    # Also skip this if DNS functionality is disabled in /etc/dnsmasq.conf
+    if grep -qs '^port=0' /etc/dnsmasq.conf; then
+        return
+    fi
+
+    if [ -x /sbin/resolvconf ] ; then
+        echo "nameserver 127.0.0.1" | /sbin/resolvconf -a lo.${NAME}${INSTANCE:+.${INSTANCE}}
+    fi
+    return 0
+}
+
+stop_resolvconf()
+{
+    if [ -x /sbin/resolvconf ] ; then
+        /sbin/resolvconf -d lo.${NAME}${INSTANCE:+.${INSTANCE}}
+    fi
+    return 0
+}
@@ -0,0 +1,40 @@
+Description: Remove or replace privacy breaching logos and forms
+ Lintian complains about these by issuing the tags privacy-breach-logo and
+ privacy-breach-donation.
+Forwarded: not-needed
+Author: Sven Geuer <debmaint@g-e-u-e-r.de>
+Last-Update: 2023-11-18
+
+--- a/doc.html
+++ b/doc.html
+@@ -1,14 +1,11 @@
+ <HTML>
+ <HEAD>
+ <TITLE> Dnsmasq - network services for small networks.</TITLE>
+-<link rel="icon" href="http://www.thekelleys.org.uk/dnsmasq/images/favicon.ico">
+ </HEAD>
+ <BODY BGCOLOR="WHITE"> 
+ <table width="100%" border="0" cellpadding="0" cellspacing="0">
+ <tr>
+-<td align="left" valign="middle"><img border="0" src="http://www.thekelleys.org.uk/dnsmasq/images/icon.png" /></td>
+ <td align="middle" valign="middle"><h1>Dnsmasq</h1></td>
+-<td align="right" valign="middle"><img border="0" src="http://www.thekelleys.org.uk/dnsmasq/images/icon.png" /></td></tr>
+ </table>
+ Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be 
+ lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used 
+@@ -88,14 +85,6 @@
+ Dnsmasq is mainly written and maintained by Simon Kelley. For most of its life, dnsmasq has been a spare-time project. 
+ These days I'm working on it as my main activity. 
+ I don't have an employer or anyone who pays me regularly to work on dnsmasq. If you'd like to make 
+-a contribution towards my expenses, please use the donation button below.
+-<form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_top">
+-<input type="hidden" name="cmd" value="_s-xclick">
+-<input type="hidden" name="hosted_button_id" value="V3X9GVW5GX6DA">
+-<input type="image" src="https://www.paypalobjects.com/en_US/GB/i/btn/btn_donateCC_LG.gif" border="0" name="submit" alt="PayPal – The safer, easier way to pay online.">
+-<img alt="" border="0" src="https://www.paypalobjects.com/en_GB/i/scr/pixel.gif" width="1" height="1">
+-</form>
+-
+-
+a contribution towards my expenses, please use the donation button at <A HREF="https://www.thekelleys.org.uk/dnsmasq/doc.html">the project's home page</A>.
+ </BODY>
+ 
@@ -0,0 +1 @@
+eliminate-privacy-breaches.patch
@@ -1,38 +0,0 @@
-#!/bin/sh
-set -e
-
-# Code copied from dh_systemd_enable ----------------------
-# This will only remove masks created by d-s-h on package removal.
-deb-systemd-helper unmask dnsmasq.service >/dev/null || true
-
-# was-enabled defaults to true, so new installations run enable.
-if deb-systemd-helper --quiet was-enabled dnsmasq.service; then
-	# Enables the unit on first installation, creates new
-	# symlinks on upgrades if the unit file has changed.
-	deb-systemd-helper enable dnsmasq.service >/dev/null || true
-else
-	# Update the statefile to add new symlinks (if any), which need to be
-	# cleaned up on purge. Also remove old symlinks.
-	deb-systemd-helper update-state dnsmasq.service >/dev/null || true
-fi
-# End code copied from dh_systemd_enable ------------------
-
-if [ -x /etc/init.d/dnsmasq ]; then
-   update-rc.d dnsmasq defaults 15 85 >/dev/null
-
-   if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ]; then
-      if [ -e /var/run/dnsmasq/dnsmasq.pid ]; then
-          ACTION=restart
-      else
-          ACTION=start
-      fi
-
-      if [ -x /usr/sbin/invoke-rc.d ] ; then
-         invoke-rc.d dnsmasq $ACTION || true
-      else
-         /etc/init.d/dnsmasq $ACTION || true
-      fi
-   fi
-fi
-
-
@@ -1,22 +0,0 @@
-#!/bin/sh
-set -e
-
-if [ purge = "$1" ]; then
-   update-rc.d dnsmasq remove >/dev/null
-fi
-
-# Code copied from dh_systemd_enable ----------------------
-if [ "$1" = "remove" ]; then
-	if [ -x "/usr/bin/deb-systemd-helper" ]; then
-		deb-systemd-helper mask dnsmasq.service >/dev/null
-	fi
-fi
-
-if [ "$1" = "purge" ]; then
-	if [ -x "/usr/bin/deb-systemd-helper" ]; then
-		deb-systemd-helper purge dnsmasq.service >/dev/null
-		deb-systemd-helper unmask dnsmasq.service >/dev/null
-	fi
-fi
-# End code copied from dh_systemd_enable ------------------
-
@@ -1,14 +0,0 @@
-#!/bin/sh
-set -e
-
-if [ "$1" = "remove" ]; then
-  if [ -x /usr/sbin/invoke-rc.d ] ; then
-      invoke-rc.d dnsmasq stop || true
-  else
-      /etc/init.d/dnsmasq stop || true
-  fi
-fi
-
-exit 0
-
-
@@ -4,13 +4,13 @@ Notes on configuring dnsmasq as packaged for Debian.
    commented; see also the dnsmasq.8 man page for explanation of
    the options. The file /etc/default/dnsmasq also exists but it
    shouldn't need to be touched in most cases. To set up DHCP
-    options you might need to refer to a copy of RFC 2132. This is 
+    options you might need to refer to a copy of RFC 2132. This is
    available on Debian systems in the package doc-rfc-std as the file
    /usr/share/doc/RFC/draft-standard/rfc2132.txt.gz .

 (2) Installing the dnsmasq package also creates the directory
    /etc/dnsmasq.d which is searched by dnsmasq for configuration file
-    fragments. This behaviour can be disabled by editing 
+    fragments. This behaviour can be disabled by editing
    /etc/default/dnsmasq.

 (3) If the Debian resolvconf package is installed then, regardless
@@ -30,43 +30,44 @@ Notes on configuring dnsmasq as packaged for Debian.
    generated file /etc/ppp/resolv.conf.  You should list 127.0.0.1
    as the first nameserver address in /etc/resolv.conf.

-(6) In the absence of resolvconf, dns-nameservers lines in 
-    /etc/network/interfaces are ignored. If you do do not use
+(6) In the absence of resolvconf, dns-nameservers lines in
+    /etc/network/interfaces are ignored. If you do not use
    resolvconf, list 127.0.0.1 as the first nameserver address
    in /etc/resolv.conf and configure your nameservers using
    "server=<IP-address>" lines in /etc/dnsmasq.conf.

 (7) If you run multiple DNS servers on a single machine, each
-    listening on a different interface, then it is necessary to use 
-    the bind-interfaces option by uncommenting "bind-interfaces" in 
-    /etc/dnsmasq.conf. This option stops dnsmasq from binding the 
+    listening on a different interface, then it is necessary to use
+    the bind-interfaces option by uncommenting "bind-interfaces" in
+    /etc/dnsmasq.conf. This option stops dnsmasq from binding the
    wildcard address and allows servers listening on port 53 on
-    interfaces not in use by dnsmasq to work. The Debian 
+    interfaces not in use by dnsmasq to work. The Debian
    libvirt package will add a configuration file in /etc/dnsmasq.d
    which does this so that the "system" dnsmasq and "private" dnsmasq
    instances started by libvirt do not clash.

 (8) The following options are supported in DEB_BUILD_OPTIONS
      noopt       : compile without optimisation.
-      nostrip     : don't remove symbols from binary. 
+      nostrip     : don't remove symbols from binary.
      nodocs      : omit documentation.
      notftp      : omit TFTP support.
      nodhcp      : omit DHCP support.
      nodhcp6     : omit DHCPv6 support.
      noscript    : omit lease-change script support.
-      use_lua     : provide support for lease-change scripts written
+      uselua      : provide support for lease-change scripts written
                    in Lua.
      noipv6      : omit IPv6 support.
      nodbus      : omit DBus support.
-      noconntrack : omit connection tracking support. 
+      noconntrack : omit connection tracking support.
      noipset     : omit IPset support.
+      nonftset    : omit nftset support.
      nortc       : compile alternate mode suitable for systems without an RTC.
      noi18n      : omit translations and internationalisation support.
      noidn       : omit international domain name support, must be
                    combined with noi18n to be effective.
      gitversion  : set the version of the produced packages from the
                    git-derived versioning information on the source,
-                    rather the the debian changelog. 
+                    rather than the debian changelog.

 (9) Dnsmasq comes as three packages - dnsmasq-utils, dnsmasq-base and
    dnsmasq. Dnsmasq-base provides the dnsmasq executable and
@@ -75,5 +76,5 @@ Notes on configuring dnsmasq as packaged for Debian.
    infrastructure. This file assumes that both are installed. It is
    possible to install only dnsmasq-base and use dnsmasq as a
    non-"system" daemon. Libvirt, for instance, does this.
-    Dnsmasq-utils provides the utilities dhcp_release and 
+    Dnsmasq-utils provides the utilities dhcp_release and
    dhcp_lease_time.
@@ -13,7 +13,7 @@

 set -e

-RUN_DIR="/var/run/dnsmasq"
+RUN_DIR="/run/dnsmasq"
 RSLVRLIST_FILE="${RUN_DIR}/resolv.conf"
 TMP_FILE="${RSLVRLIST_FILE}_new.$$"
 MY_NAME_FOR_RESOLVCONF="dnsmasq"
@@ -48,7 +48,7 @@ RSLVCNFFILES=""
 for F in $(/lib/resolvconf/list-records --after "lo.$MY_NAME_FOR_RESOLVCONF") ; do
 	case "$F" in
 	    "lo.$MY_NAME_FOR_RESOLVCONF")
-		# Omit own record	 
+		# Omit own record
 		;;
 	    lo.*)
 		# Include no more records after one for a local nameserver
@@ -1,224 +1,127 @@
 #!/usr/bin/make -f
-# debian/rules file - for dnsmasq.
-# Copyright 2001-2011 by Simon Kelley
-# Based on the sample in the debian hello package which carries the following:
-# Copyright 1994,1995 by Ian Jackson.
-# I hereby give you perpetual unlimited permission to copy,
-# modify and relicense this file, provided that you do not remove
-# my name from the file itself.  (I assert my moral right of
-# paternity under the Copyright, Designs and Patents Act 1988.)
-# This file may have to be extensively modified
+# -*- makefile -*-

-package=dnsmasq-base
+# Uncomment this to turn on verbose mode.
+export DH_VERBOSE=1

-dpkg_buildflags := DEB_BUILD_MAINT_OPTIONS="hardening=+all" dpkg-buildflags
+# Make sure lintian does not complain about missing hardenings.
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all

-CFLAGS = $(shell $(dpkg_buildflags) --get CFLAGS)
-CFLAGS += $(shell $(dpkg_buildflags) --get CPPFLAGS)
-CFLAGS += -Wall -W
+include /usr/share/dpkg/architecture.mk

-LDFLAGS = $(shell $(dpkg_buildflags) --get LDFLAGS)
-
-DEB_COPTS = $(COPTS)
-
-TARGET = install-i18n
-
-DEB_HOST_ARCH_OS := $(shell dpkg-architecture -qDEB_HOST_ARCH_OS)
-
-# Force package version based on git tags.
-ifneq (,$(filter gitversion,$(DEB_BUILD_OPTIONS)))
-     PACKAGE_VERSION = $(shell bld/get-version `pwd` |  sed 's/test/~&/; s/[a-z]/~&/;  s/-/./g; s/$$/-1/; s/^/-v/';)
-endif
+PREFIX = /usr
+# Upstream does not handle CPPFLAGS, so we add it to CFLAGS here.
+CFLAGS += $(CPPFLAGS)
+COPTS =

 ifeq (,$(filter nodbus,$(DEB_BUILD_OPTIONS)))
-     DEB_COPTS += -DHAVE_DBUS
+	COPTS += -DHAVE_DBUS
+endif
+
+ifeq (,$(filter noidn, $(DEB_BUILD_OPTIONS)))
+	COPTS += -DHAVE_LIBIDN2
+endif
+
+ifeq (,$(filter nonftset, $(DEB_BUILD_OPTIONS)))
+	COPTS += -DHAVE_NFTSET
 endif

 ifeq (,$(filter noconntrack,$(DEB_BUILD_OPTIONS)))
 ifeq ($(DEB_HOST_ARCH_OS),linux)
-     DEB_COPTS += -DHAVE_CONNTRACK
+	COPTS += -DHAVE_CONNTRACK
 endif
 endif

 ifneq (,$(filter noipset,$(DEB_BUILD_OPTIONS)))
-     DEB_COPTS += -DNO_IPSET
+	COPTS += -DNO_IPSET
 endif

 ifneq (,$(filter nodhcp6,$(DEB_BUILD_OPTIONS)))
-     DEB_COPTS += -DNO_DHCP6
+	COPTS += -DNO_DHCP6
 endif

 ifneq (,$(filter noipv6,$(DEB_BUILD_OPTIONS)))
-     DEB_COPTS += -DNO_IPV6
+	COPTS += -DNO_IPV6
 endif

 ifneq (,$(filter notftp,$(DEB_BUILD_OPTIONS)))
-     DEB_COPTS += -DNO_TFTP
+	COPTS += -DNO_TFTP
 endif

 ifneq (,$(filter nodhcp,$(DEB_BUILD_OPTIONS)))
-     DEB_COPTS += -DNO_DHCP
+	COPTS += -DNO_DHCP
 endif

 ifneq (,$(filter noscript,$(DEB_BUILD_OPTIONS)))
-     DEB_COPTS += -DNO_SCRIPT
+	COPTS += -DNO_SCRIPT
 endif

 ifneq (,$(filter nortc,$(DEB_BUILD_OPTIONS)))
-     DEB_COPTS += -DHAVE_BROKEN_RTC
-endif
-
-ifneq (,$(filter noi18n,$(DEB_BUILD_OPTIONS)))
-     TARGET = install
-     ifeq (,$(filter noidn, $(DEB_BUILD_OPTIONS)))
-	DEB_COPTS += -DHAVE_IDN
-     endif	
-endif
-
-ifneq (,$(filter uselua,$(DEB_BUILD_OPTIONS)))
-     DEB_COPTS += -DHAVE_LUASCRIPT
+	COPTS += -DHAVE_BROKEN_RTC
 endif

 ifeq (,$(filter nodnssec,$(DEB_BUILD_OPTIONS)))
-     DEB_COPTS += -DHAVE_DNSSEC
+	COPTS += -DHAVE_DNSSEC
 endif

-ifneq ($(DEB_HOST_ARCH_OS),linux)
-     # For strlcpy in FreeBSD
-     LDFLAGS += -lbsd
-endif

-clean:
-	$(checkdir)
-	rm -rf debian/daemon debian/base debian/utils debian/*~ debian/files debian/substvars debian/utils-substvars
-	make clean
-	make -C contrib/wrt clean
+%:
+	# Ubuntu and derivates do not support runit, see
+	# https://bugs.debian.org/960401 for details.
+	if dpkg-vendor --derives-from Ubuntu; then \
+		dh $@; \
+	else \
+		dh $@ --with runit; \
+	fi

-binary-indep:	checkroot
-	$(checkdir)
-	rm -rf debian/daemon
-	install -m 755 \
-	        -d debian/daemon/DEBIAN \
-		-d debian/daemon/usr/share/doc \
-	        -d debian/daemon/etc/init.d \
-		-d debian/daemon/etc/dnsmasq.d \
-	        -d debian/daemon/etc/resolvconf/update.d \
-		-d debian/daemon/usr/lib/resolvconf/dpkg-event.d \
-	        -d debian/daemon/etc/default \
-		-d debian/daemon/lib/systemd/system \
-                -d debian/daemon/etc/insserv.conf.d
-	install -m 644 debian/conffiles debian/daemon/DEBIAN
-	install -m 755 debian/postinst debian/postrm debian/prerm debian/daemon/DEBIAN
-	install -m 755 debian/init debian/daemon/etc/init.d/dnsmasq
-	install -m 755 debian/resolvconf debian/daemon/etc/resolvconf/update.d/dnsmasq
-	install -m 755 debian/resolvconf-package debian/daemon/usr/lib/resolvconf/dpkg-event.d/dnsmasq
-	install -m 644 debian/default debian/daemon/etc/default/dnsmasq
-	install -m 644 dnsmasq.conf.example debian/daemon/etc/dnsmasq.conf
-	install -m 644 debian/readme.dnsmasq.d debian/daemon/etc/dnsmasq.d/README
-	install -m 644 debian/systemd.service debian/daemon/lib/systemd/system/dnsmasq.service
-	install -m 644 debian/insserv debian/daemon/etc/insserv.conf.d/dnsmasq
-	ln -s $(package) debian/daemon/usr/share/doc/dnsmasq
-	cd debian/daemon && find . -type f ! -regex '.*DEBIAN/.*' -printf '%P\0' | xargs -r0 md5sum > DEBIAN/md5sums	
-	dpkg-gencontrol $(PACKAGE_VERSION) -T -pdnsmasq -Pdebian/daemon
-	chown -R root.root debian/daemon
-	chmod -R g-ws debian/daemon
-	dpkg --build debian/daemon ..
+# Upstream builds and installs in one go, so do we.
+override_dh_auto_build:

-binary-arch:	checkroot 
-	$(checkdir)
-	rm -rf debian/base
-	install -m 755 \
-		-d debian/base/DEBIAN \
-		-d debian/base/etc/dbus-1/system.d \
-	        -d debian/base/usr/share/doc/$(package) \
-		-d debian/base/usr/share/doc/$(package)/examples \
-	        -d debian/base/var/run \
-		-d debian/base/usr/share/$(package) \
-	        -d debian/base/var/lib/misc
-	make $(TARGET) PREFIX=/usr DESTDIR=`pwd`/debian/base CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" COPTS="$(DEB_COPTS)" CC=gcc
-ifeq (,$(findstring nodocs,$(DEB_BUILD_OPTIONS)))
-# Need to remove paypal links in Debian Package for policy reasons.
-	sed -e /\<H2\>Donations/Q -e /icon.png/d doc.html -e /favicon.ico/d >debian/base/usr/share/doc/$(package)/doc.html
-	echo "</BODY>" >>debian/base/usr/share/doc/$(package)/doc.html 
-	install -m 644 setup.html debian/base/usr/share/doc/$(package)/.
-	install -m 644 dnsmasq.conf.example debian/base/usr/share/doc/$(package)/examples/.
-	install -m 644 trust-anchors.conf debian/base/usr/share/$(package)/.
-	install -m 644 FAQ debian/base/usr/share/doc/$(package)/.
-	gzip -9n debian/base/usr/share/doc/$(package)/FAQ
-	install -m 644 CHANGELOG debian/base/usr/share/doc/$(package)/changelog
-	gzip -9n debian/base/usr/share/doc/$(package)/changelog
-	install -m 644 CHANGELOG.archive debian/base/usr/share/doc/$(package)/changelog.archive
-	gzip -9n debian/base/usr/share/doc/$(package)/changelog.archive
-	install -m 644 dbus/DBus-interface debian/base/usr/share/doc/$(package)/.
-	gzip -9n debian/base/usr/share/doc/$(package)/DBus-interface	
-endif
-	install -m 644 debian/dnsmasq-base.conffiles debian/base/DEBIAN/conffiles
-	install -m 755 debian/dnsmasq-base.postinst debian/base/DEBIAN/postinst
-	install -m 755 debian/dnsmasq-base.postrm  debian/base/DEBIAN/postrm
-	install -m 644 debian/changelog debian/base/usr/share/doc/$(package)/changelog.Debian
-	gzip -9n debian/base/usr/share/doc/$(package)/changelog.Debian
-	install -m 644 debian/readme debian/base/usr/share/doc/$(package)/README.Debian
-	install -m 644 debian/copyright debian/base/usr/share/doc/$(package)/copyright
-	install -m 644 debian/dbus.conf debian/base/etc/dbus-1/system.d/dnsmasq.conf
-	gzip -9n debian/base/usr/share/man/man8/dnsmasq.8
-	for f in debian/base/usr/share/man/*; do \
-		if [ -f $$f/man8/dnsmasq.8 ]; then \
-                       gzip -9n $$f/man8/dnsmasq.8 ; \
-                fi \
+override_dh_auto_install:
+	dh_auto_build -p dnsmasq-base --no-parallel -- install-i18n \
+		BUILDDIR=debian/auto-build/dnsmasq-base \
+		DESTDIR=$(CURDIR)/debian/dnsmasq-base \
+		PREFIX=$(PREFIX) CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" \
+		COPTS="$(COPTS)"
+	dh_auto_build -p dnsmasq-base-lua --no-parallel -- install-i18n \
+		BUILDDIR=debian/auto-build/dnsmasq-base-lua \
+		DESTDIR=$(CURDIR)/debian/dnsmasq-base-lua \
+		PREFIX=$(PREFIX) CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" \
+		LUA=lua5.4 COPTS="$(COPTS) -DHAVE_LUASCRIPT"
+	dh_auto_build -p dnsmasq-utils -D contrib/lease-tools
+
+override_dh_auto_clean:
+	dh_auto_clean -p dnsmasq-base -- \
+		BUILDDIR=debian/auto-build/dnsmasq-base
+	dh_auto_clean -p dnsmasq-base-lua -- \
+		BUILDDIR=debian/auto-build/dnsmasq-base-lua
+	rm -rf debian/auto-build
+	dh_auto_clean -p dnsmasq-utils -D contrib/lease-tools
+
+override_dh_install:
+	dh_install -p dnsmasq-utils --sourcedir=contrib/lease-tools
+	dh_install --remaining-packages
+
+# If 'nodoc' is absent from DEB_BUILD_OPTIONS, Correct name or location of
+# some doc files.
+# We would prefer do this via dh-exec if it would support dh_installdocs.
+ifeq (,$(findstring nodoc,$(DEB_BUILD_OPTIONS)))
+execute_after_dh_installdocs:
+	for d in $(CURDIR)/debian/dnsmasq-base*/usr/share/doc/dnsmasq-base*; do \
+		cd $$d; \
+		mv readme README.Debian; \
+		mv CHANGELOG.archive changelog.archive; \
+		mkdir examples; \
+		mv dnsmasq.conf.example examples/; \
 	done
-ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
-	strip -R .note -R .comment debian/base/usr/sbin/dnsmasq
-endif
-	cd debian/base && find . -type f ! -regex '.*DEBIAN/.*' -printf '%P\0' | xargs -r0 md5sum > DEBIAN/md5sums
-	dpkg-shlibdeps --warnings=1 debian/base/usr/sbin/dnsmasq
-	dpkg-gencontrol $(PACKAGE_VERSION) -pdnsmasq-base -Pdebian/base
-	chown -R root.root debian/base
-	chmod -R g-ws debian/base 
-	dpkg --build debian/base ..
-
-ifeq ($(DEB_HOST_ARCH_OS),linux)
-	rm -rf debian/utils
-	install -m 755 -d debian/utils/DEBIAN \
-                       -d debian/utils/usr/share/man/man1 \
-	               -d debian/utils/usr/bin \
-                       -d debian/utils/usr/share/doc/dnsmasq-utils
-	make -C contrib/wrt PREFIX=/usr DESTDIR=`pwd`/debian/utils CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" COPTS="$(DEB_COPTS)" CC=gcc
-	install -m 755 contrib/wrt/dhcp_release debian/utils/usr/bin/dhcp_release
-	install -m 644 contrib/wrt/dhcp_release.1 debian/utils/usr/share/man/man1/dhcp_release.1
-	gzip -9n debian/utils/usr/share/man/man1/dhcp_release.1
-	install -m 755 contrib/wrt/dhcp_lease_time debian/utils/usr/bin/dhcp_lease_time
-	install -m 644 contrib/wrt/dhcp_lease_time.1 debian/utils/usr/share/man/man1/dhcp_lease_time.1
-	install -m 644 debian/copyright debian/utils/usr/share/doc/dnsmasq-utils/copyright
-	install -m 644 debian/changelog debian/utils/usr/share/doc/dnsmasq-utils/changelog.Debian
-	gzip -9n debian/utils/usr/share/doc/dnsmasq-utils/changelog.Debian
-	gzip -9n debian/utils/usr/share/man/man1/dhcp_lease_time.1
-ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
-	strip -R .note -R .comment debian/utils/usr/bin/dhcp_release
-	strip -R .note -R .comment debian/utils/usr/bin/dhcp_lease_time
-endif	
-	cd debian/utils && find . -type f ! -regex '.*DEBIAN/.*' -printf '%P\0' | xargs -r0 md5sum > DEBIAN/md5sums
-	dpkg-shlibdeps -Tdebian/utils-substvars debian/utils/usr/bin/dhcp_release debian/utils/usr/bin/dhcp_lease_time
-	dpkg-gencontrol $(PACKAGE_VERSION) -Tdebian/utils-substvars -pdnsmasq-utils -Pdebian/utils
-	chown -R root.root debian/utils
-	chmod -R g-ws debian/utils 
-	dpkg --build debian/utils ..
 endif

-define checkdir
-	test -f Makefile -a -f debian/rules
-endef
-
-# Below here is fairly generic really
-
-binary:		binary-arch binary-indep
-
-build:		
-build-arch:
-build-indep:
-
-checkroot:
-	test root = "`whoami`"
-
-.PHONY: binary binary-arch binary-indep clean checkroot
-
-
+# If 'nodoc' is present in DEB_BUILD_OPTIONS, drop the man pages already
+# installed by the upstream build script. Then, let dh_installman do what
+# else needs doing.
+override_dh_installman:
+ifneq (,$(findstring nodoc,$(DEB_BUILD_OPTIONS)))
+	rm -rf debian/dnsmasq-base*/usr/share/man
+endif
+	dh_installman -p dnsmasq-utils --sourcedir=contrib/lease-tools
+	dh_installman --remaining-packages
@@ -1 +1 @@
-1.0
+3.0 (quilt)
@@ -0,0 +1,34 @@
+#!/bin/sh
+
+. /usr/share/dnsmasq/init-system-common
+
+case "$1" in
+	checkconfig)
+		checkconfig
+		;;
+	start-resolvconf)
+		start_resolvconf
+		;;
+	stop-resolvconf)
+		stop_resolvconf
+		;;
+	exec)
+		# /run may be volatile, so we need to ensure that
+		# /run/dnsmasq exists here as well as in postinst
+		if [ ! -d /run/dnsmasq ]; then
+			mkdir /run/dnsmasq || { [ -d /run/dnsmasq ] || exit 2 ; }
+			chown dnsmasq:nogroup /run/dnsmasq || exit 2
+		fi
+		exec ${DAEMON} -x /run/dnsmasq/${NAME}${INSTANCE:+.${INSTANCE}}.pid \
+			${MAILHOSTNAME:+ -m ${MAILHOSTNAME}} \
+			${MAILTARGET:+ -t ${MAILTARGET}} \
+			${DNSMASQ_USER:+ -u ${DNSMASQ_USER}} \
+			${DNSMASQ_INTERFACES:+ ${DNSMASQ_INTERFACES}} \
+			${DHCP_LEASE:+ -l ${DHCP_LEASE}} \
+			${DOMAIN_SUFFIX:+ -s ${DOMAIN_SUFFIX}} \
+			${RESOLV_CONF:+ -r ${RESOLV_CONF}} \
+			${CACHESIZE:+ -c ${CACHESIZE}} \
+			${CONFIG_DIR:+ -7 ${CONFIG_DIR}} \
+			${DNSMASQ_OPTS:+ ${DNSMASQ_OPTS}}
+		;;
+esac
@@ -1,27 +0,0 @@
-[Unit]
-Description=dnsmasq - A lightweight DHCP and caching DNS server
-
-[Service]
-Type=forking
-PIDFile=/var/run/dnsmasq/dnsmasq.pid
-
-# Test the config file and refuse starting if it is not valid.
-ExecStartPre=/usr/sbin/dnsmasq --test
-
-# We run dnsmasq via the /etc/init.d/dnsmasq script which acts as a
-# wrapper picking up extra configuration files and then execs dnsmasq
-# itself, when called with the "systemd-exec" function.
-ExecStart=/etc/init.d/dnsmasq systemd-exec
-
-# The systemd-*-resolvconf functions configure (and deconfigure)
-# resolvconf to work with the dnsmasq DNS server. They're called liek
-# this to get correct error handling (ie don't start-resolvconf if the 
-# dnsmasq daemon fails to start.
-ExecStartPost=/etc/init.d/dnsmasq systemd-start-resolvconf
-ExecStop=/etc/init.d/dnsmasq systemd-stop-resolvconf
-
-
-ExecReload=/bin/kill -HUP $MAINPID
-
-[Install]
-WantedBy=multi-user.target
@@ -0,0 +1,41 @@
+HOWTO
+=====
+dnsmasq comes with the possibility to run multiple systemd service instances on the same machine.
+There is the main service which is enabled by default via `systemctl enable dnsmasq.service` and uses the configuration from `/etc/default/dnsmasq`.
+
+Additional service instances can be enabled via `systemctl enable dnsmasq@<instance name>.service` that use the configuration from `/etc/default/dnsmasq.<instance name>`.
+It is recommended to use a separate configuration file and directory for each instance.
+Additionally make sure that all instances use either different ports and/or ip addresses to avoid binding collisions.
+
+Example setup for an instance called "alt"
+#1 File `/etc/dnsmasq.alt.conf` copied from `/etc/dnsmasq.conf`
+#2 Directory `/etc/dnsmasq.alt.d`
+#3 File `/etc/default/dnsmasq.alt` copied from `/etc/default/dnsmasq` with following adaptions:
+   * The options DNSMASQ_OPTS and CONFIG_DIR point to the correct configuration file and directory.
+     DNSMASQ_OPTS="... --conf-file=/etc/dnsmasq.alt.conf ..."
+     CONFIG_DIR=/etc/dnsmasq.alt.d,.dpkg-dist,.dpkg-old,.dpkg-new
+   * The option DNSMASQ_EXCEPT must contain "lo" to avoid that an instance becomes the machine's DNS resolver.
+     DNSMASQ_EXCEPT="lo"
+  * If the additional instance should bind to all IP addresses of a specific interface, e.g. "dnsalt01", then the following addition could be used:
+    DNSMASQ_OPTS="... --bind-dynamic --interface=dnsalt01 ..."
+    Additionally the main instance must be stopped from binding to interfaces that are used by other instances:
+    DNSMASQ_OPTS="... --bind-dynamic --except-interface=dnsalt* ..."
+  * If the additional instance should not use the machine's DNS resolver, normally that's the dnsmasq main instance, as upstream server, then the following addition could be used:
+    IGNORE_RESOLVCONF=yes
+#4 Enable additional instance via `systemctl enable dnsmasq@alt.service`
+#5 Start additional instance without reboot via `systemctl start dnsmasq@alt.service`
+
+
+
+TODO
+====
+#1 - Found shortcoming on 2019-03-10
+Only the option DNSMASQ_EXCEPT="lo" avoids that an DNS instance will be set as the machine's DNS resolver.
+This may interfere with the wish to run an additional instance on a different port on the localhost addresses.
+My suggestion in the initial Debian report [1] was to specify an explicit variable for this.
+
+[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914305#5
+
+
+#2 - Preferred configuration way
+Should the variables DNSMASQ_INTERFACE and DNSMASQ_EXCEPT be used instead of --interface and --except-interface?  (while "lo" still has to be in DNSMASQ_EXCEPT as of now)
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -e
+
+. debian/tests/functions
+
+check_compile_time_options
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -e
+
+. debian/tests/functions
+
+check_compile_time_options +lua
@@ -0,0 +1,39 @@
+Tests: compile-time-options
+Depends: dnsmasq,
+         dnsmasq-base,
+Restrictions: needs-root,
+              isolation-container,
+
+Tests: compile-time-options+lua
+Depends: dnsmasq,
+         dnsmasq-base-lua,
+Restrictions: needs-root,
+              isolation-container,
+
+Tests: get-address+query-dns+check-utils
+Depends: bind9,
+         bind9-dnsutils,
+         dnsmasq,
+         dnsmasq-base,
+         dnsmasq-utils,
+Restrictions: needs-root,
+              allow-stderr,
+              isolation-container,
+
+Tests: get-address+query-dns+lua+alt
+Depends: bind9,
+         bind9-dnsutils,
+         dnsmasq,
+         dnsmasq-base-lua,
+Restrictions: needs-root,
+              allow-stderr,
+              isolation-container,
+
+Tests: get-address+query-dns+sysv+alt
+Depends: bind9,
+         bind9-dnsutils,
+         dnsmasq,
+         dnsmasq-base,
+Restrictions: needs-root,
+              allow-stderr,
+              isolation-container,
@@ -0,0 +1,151 @@
+# -*- shell-script -*-
+
+FUNCTIONS_DIR="debian/tests/functions.d"
+
+match_or_exit () {
+	file_to_match="$1"
+	pattern_file="$2"
+
+	while read line_to_match <&3 && read pattern_line <&4 ; do
+		if [ "${line_to_match##$pattern_line}" ]; then
+			echo '!!! MISMATCH !!!' >&2
+			echo "Line:    ${line_to_match}" >&2
+			echo "Pattern: ${pattern_line}" >&2
+			exit 1
+		fi;
+	done 3<"${file_to_match}" 4<"${pattern_file}"
+}
+
+linecount () {
+	wc -l $1 | cut -d' ' -f1
+}
+
+error_exit () {
+	echo "ERROR: $1"
+	exit 1
+}
+
+stop_dnsmasq_bind_networking () {
+	systemctl stop dnsmasq.service
+	systemctl stop named.service
+	systemctl stop networking.service
+}
+
+configure_and_start_networking () {
+	#Add interfaces needed for the test
+	cat ${FUNCTIONS_DIR}/add-to.interfaces >> /etc/network/interfaces
+	systemctl start networking.service
+}
+
+configure_and_start_bind () {
+	cp ${FUNCTIONS_DIR}/db.autopkg.test /etc/bind/
+	cat ${FUNCTIONS_DIR}/add-to.named.conf.local >> /etc/bind/named.conf.local
+	cp ${FUNCTIONS_DIR}/named.conf.options /etc/bind/named.conf.options
+	systemctl start named.service
+}
+
+configure_and_start_dnsmasq () {
+	alt_mode=0
+	lua_mode=0
+	sysv_mode=0
+	service='dnsmasq.service'
+	sysv_param2=''
+	conf_dir='/etc/dnsmasq.d'
+
+	while [ -n "$1" ]; do
+		case "$1" in
+			alt|lua|sysv) eval ${1}_mode=1 ;;
+			*) error_exit "configure_and_start_dnsmasq(): invalid flag '$1'"
+		esac
+		shift
+	done
+
+	if [ ${alt_mode} -eq 1 ]; then
+		cp ${FUNCTIONS_DIR}/dnsmasq.alt-autopkgtest.default /etc/default/dnsmasq.alt
+		cp /etc/dnsmasq.conf /etc/dnsmasq.alt.conf
+		mkdir /etc/dnsmasq.alt.d
+		service='dnsmasq@alt.service'
+		sysv_param2='alt'
+		conf_dir='/etc/dnsmasq.alt.d'
+	fi
+
+	cp ${FUNCTIONS_DIR}/dnsmasq-autopkgtest.conf "${conf_dir}"
+
+	if [ ${lua_mode} -eq 1 ]; then
+		mkdir -p /usr/local/share/dnsmasq
+		cp ${FUNCTIONS_DIR}/log.lua /usr/local/share/dnsmasq/
+		echo "dhcp-luascript=/usr/local/share/dnsmasq/log.lua\n" \
+			>>"${conf_dir}"/dnsmasq-autopkgtest.conf
+	fi
+
+	if [ ${sysv_mode} -eq 1 ]; then
+		SYSTEMCTL_SKIP_REDIRECT=1 /etc/init.d/dnsmasq start "${sysv_param2}"
+	else
+		systemctl enable "${service}"
+		systemctl start "${service}"
+	fi
+}
+
+check_compile_time_options () {
+	journalctl -b -u dnsmasq
+	echo ~~~ Check compile time options...
+	journalctl -b -u dnsmasq -g '[a-z]+: ' --output cat >options.msg
+	cat options.msg
+	match_or_exit options.msg ${FUNCTIONS_DIR}/options${1}.patterns
+}
+
+get_address_on_veth1_and_check_the_result () {
+	echo ~~~ Get an address on veth1 and check the result...
+	ip netns exec clientnet ifup veth1
+	ip netns exec clientnet ip addr show dev veth1 >ip-addr.out 2>&1
+	cat ip-addr.out
+	match_or_exit ip-addr.out ${FUNCTIONS_DIR}/ip-addr.patterns
+}
+
+query_test_zone_records_and_check_the_result () {
+	echo ~~~ Query some test zone records and check the result...
+	ip netns exec clientnet dig +short SOA autopkg.test >dig.out 2>&1
+	ip netns exec clientnet dig +short NS autopkg.test >>dig.out 2>&1
+	ip netns exec clientnet dig +short A ns.autopkg.test >>dig.out 2>&1
+	ip netns exec clientnet dig +short A dhcp3.autopkg.test >>dig.out 2>&1
+	cat dig.out
+	if [ `linecount dig.out` -ne `linecount ${FUNCTIONS_DIR}/dig.patterns` ] ; then
+		error_exit 'empty or unexpected output'
+	fi
+	match_or_exit dig.out ${FUNCTIONS_DIR}/dig.patterns
+}
+
+check_utils () {
+	#Test dhcp_lease_time and dhcp_release
+	leases_file='/var/lib/misc/dnsmasq.leases'
+	client_ip_address=`cut -d' ' -f3 $leases_file`
+	client_mac_address=`cut -d' ' -f2 $leases_file`
+	echo ~~~ Test dhcp_lease_time...
+	if ! dhcp_lease_time $client_ip_address; then
+		error_exit "'dhcp_lease_time $client_ip_address' failed with return code $?"
+	else
+		#Add \n to dhcp_lease_time's output
+		echo ''
+	fi
+	echo ~~~ Test dhcp_release...
+	cat $leases_file
+	if ! dhcp_release veth0 $client_ip_address 1-$client_mac_address; then
+		error_exit "'dhcp_release veth0 $client_ip_address 1-$client_mac_address' failed with return code $?0"
+	fi
+	if [ -n "`cat $leases_file`" ]; then
+		cat $leases_file
+		error_exit "$leases_file is not empty"
+	fi
+}
+
+check_lua_log () {
+	log_file='/var/log/dnsmasq-lua.log'
+	echo ~~~ Check log file generated by lua script
+	ls -l ${log_file}
+	if [ -s ${log_file} ]; then
+		cat ${log_file}
+		match_or_exit ${log_file} ${FUNCTIONS_DIR}/log.patterns
+	else
+		error_exit "${log_file} is empty"
+	fi
+}
@@ -0,0 +1,18 @@
+
+auto dummy0
+iface dummy0 inet static
+    pre-up ip link add dummy0 type dummy
+    address 192.168.141.1
+    netmask 255.255.255.248
+    post-down ip link del dummy0
+
+auto veth0
+iface veth0 inet static
+    pre-up ip netns add clientnet
+    pre-up ip link add veth0 type veth peer veth1 netns clientnet
+    address 192.168.142.1
+    netmask 255.255.255.248
+    post-down ip link del veth0
+    post-down ip netns del clientnet
+
+iface veth1 inet dhcp
@@ -0,0 +1,2 @@
+zone "autopkg.test"      { type master; file "/etc/bind/db.autopkg.test"; };
+
@@ -0,0 +1,18 @@
+$TTL    604800
+@       IN      SOA     ns.autopkg.test. hostmaster.autopkg.test. (
+                              2         ; Serial
+                         604800         ; Refresh
+                          86400         ; Retry
+                        2419200         ; Expire
+                            300 )       ; Negative Cache TTL
+;
+@	IN	NS	ns
+ns	IN	A	192.168.141.1
+host	IN	A	192.168.142.1
+dhcp0	IN	A	192.168.142.2
+dhcp1	IN	A	192.168.142.3
+dhcp2	IN	A	192.168.142.4
+dhcp3	IN	A	192.168.142.5
+dhcp4	IN	A	192.168.142.6
+brdcst	IN	A	192.168.142.7
+
@@ -0,0 +1,4 @@
+ns.autopkg.test. hostmaster.autopkg.test. 2 604800 86400 2419200 300
+ns.autopkg.test.
+192.168.141.1
+192.168.142.5
@@ -0,0 +1,6 @@
+no-resolv
+server=/autopkg.test/192.168.141.1
+listen-address=192.168.142.1,127.0.0.1
+bind-interfaces
+dhcp-range=192.168.142.2,192.168.142.6
+dhcp-authoritative
@@ -0,0 +1,42 @@
+# This file has six functions:
+# 1) to completely disable starting this dnsmasq instance
+# 2) to set DOMAIN_SUFFIX by running `dnsdomainname`
+# 3) to select an alternative config file
+#    by setting DNSMASQ_OPTS to --conf-file=<file>
+# 4) to tell dnsmasq to read the files in /etc/dnsmasq.d for
+#    more configuration variables.
+# 5) to stop the resolvconf package from controlling dnsmasq's
+#    idea of which upstream nameservers to use.
+# 6) to avoid using this dnsmasq instance as the system's default resolver
+#    by setting DNSMASQ_EXCEPT="lo"
+# For upgraders from very old versions, all the shell variables set
+# here in previous versions are still honored by the init script
+# so if you just keep your old version of this file nothing will break.
+
+#DOMAIN_SUFFIX=`dnsdomainname`
+DNSMASQ_OPTS="--conf-file=/etc/dnsmasq.alt.conf"
+
+# The dnsmasq daemon is run by default conforming to the Debian Policy.
+# To disable the service,
+# for SYSV init, use "update-rc.d dnsmasq disable",
+# for systemd, use "systemctl disable dnsmasq".
+
+# By default search this drop directory for configuration options.
+# Libvirt leaves a file here to make the system dnsmasq play nice.
+# Comment out this line if you don't want this. The dpkg-* are file
+# endings which cause dnsmasq to skip that file. This avoids pulling
+# in backups made by dpkg.
+CONFIG_DIR=/etc/dnsmasq.alt.d,.dpkg-dist,.dpkg-old,.dpkg-new
+
+# If the resolvconf package is installed, dnsmasq will use its output
+# rather than the contents of /etc/resolv.conf to find upstream
+# nameservers. Uncommenting this line inhibits this behaviour.
+# Note that including a "resolv-file=<filename>" line in
+# /etc/dnsmasq.conf is not enough to override resolvconf if it is
+# installed: the line below must be uncommented.
+#IGNORE_RESOLVCONF=yes
+
+# If the resolvconf package is installed, dnsmasq will tell resolvconf
+# to use dnsmasq under 127.0.0.1 as the system's default resolver.
+# Uncommenting this line inhibits this behaviour.
+#DNSMASQ_EXCEPT="lo"
@@ -0,0 +1,6 @@
+?: veth1@if?: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
+    link/ether ??:??:??:??:??:?? brd ff:ff:ff:ff:ff:ff link-netnsid 0
+    inet 192.168.142.?/29 brd 192.168.142.7 scope global dynamic veth1
+       valid_lft 3[56][0-9][0-9]sec preferred_lft 3[56][0-9][0-9]sec
+    inet6 fe80::*:*:*:*/64 scope link*
+       valid_lft forever preferred_lft forever
@@ -0,0 +1,40 @@
+-- Lua script logging calls from dnsmasq
+
+-- Open the log file in append mode 
+logfile = assert(io.open("/var/log/dnsmasq-lua.log", "a"))
+
+-- Prepend date and time to a string and write the result to the log file
+function __log(str)
+	logfile:write(os.date("!%FT%TZ ")..str.."\n")
+end
+
+-- flush the log file
+function __flush_log()
+	logfile:flush()
+end
+
+-- Log a call to init()
+function init()
+	__log("initialising")
+	__flush_log()
+end
+
+-- Log a call to shutdown()
+function shutdown()
+	__log("shutting down")
+	__flush_log()
+end
+
+-- Log a call to lease() including all arguments
+function lease(operation, params)
+	local lines = {}
+	__log(operation.." lease")
+	for key,value in pairs(params) do
+		table.insert(lines, key..": "..value)
+	end
+	table.sort(lines)
+	for index,line in ipairs(lines) do
+		__log("\t"..line)
+	end
+	__flush_log()
+end
@@ -0,0 +1,10 @@
+????-??-??T??:??:??Z initialising
+????-??-??T??:??:??Z add lease
+????-??-??T??:??:??Z 	client_id: ??:??:??:??:??:??:??:??:??:??:??:??:??:??:??:??:??:??:??
+????-??-??T??:??:??Z 	data_missing: 1.0
+????-??-??T??:??:??Z 	hostname: ?*
+????-??-??T??:??:??Z 	interface: veth0
+????-??-??T??:??:??Z 	ip_address: 192.168.142.[2-6]
+????-??-??T??:??:??Z 	lease_expires: [1-9]*
+????-??-??T??:??:??Z 	mac_address: ??:??:??:??:??:??
+????-??-??T??:??:??Z 	time_remaining: 3600.0
@@ -0,0 +1,6 @@
+options {
+        directory "/var/cache/bind";
+        listen-on { 192.168.141.1; };
+        recursion no;
+};
+
@@ -0,0 +1 @@
+*: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 Lua TFTP conntrack ipset nftset auth cryptohash DNSSEC loop-detect inotify dumpfile
@@ -0,0 +1 @@
+*: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset nftset auth cryptohash DNSSEC loop-detect inotify dumpfile
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set -e
+
+. debian/tests/functions
+
+stop_dnsmasq_bind_networking
+configure_and_start_networking
+configure_and_start_bind
+configure_and_start_dnsmasq
+
+get_address_on_veth1_and_check_the_result
+
+query_test_zone_records_and_check_the_result
+
+check_utils
+
+#Done
+echo Looks good.
				`@@ -0,0 +1 @@`
				`usr/share/dnsmasq-base/trust-anchors.conf usr/share/dnsmasq/trust-anchors.conf`
				`@@ -0,0 +1 @@`
				`debian/dnsmasq.runscript name=dnsmasq,logscript,presubj`
				`@@ -0,0 +1,2 @@`
				`zone "autopkg.test" { type master; file "/etc/bind/db.autopkg.test"; };`
				`@@ -0,0 +1 @@`
				`*: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 Lua TFTP conntrack ipset nftset auth cryptohash DNSSEC loop-detect inotify dumpfile`