Tweak to DNSSEC logging.

A call to get_new_frec() for a DNSSEC query could manage to
free the original frec that we're doing the DNSSEC query to validate.
Bad things then happen.

This requires that the original frec is old, so it doesn't happen
in practice. I found it when running under gdb, and there have been
reports of SEGV associated with large system-clock warps which are
probably the same thing.

debian/dnsmasq.runit

@@ -1 +1 @@
-debian/dnsmasq.runscript name=dnsmasq,logscript,since=2.80-1+runit
+debian/dnsmasq.runscript name=dnsmasq,logscript,presubj

man/dnsmasq.8

@@ -244,7 +244,7 @@ specified interface. The <domain> is the "glue record". It should
 resolve in the global DNS to an A and/or AAAA record which points to
 the address dnsmasq is listening on. When an interface is specified,
 it may be qualified with "/4" or "/6" to specify only the IPv4 or IPv6
-addresses associated with the interface. Since any defined authoritative zones are also available as part of the normal recusive DNS service supplied by dnsmasq, it can make sense to have an --auth-server declaration with no interfaces or address, but simply specifying the glue record. 
+addresses associated with the interface. Since any defined authoritative zones are also available as part of the normal recusive DNS service supplied by dnsmasq, it can make sense to have an --auth-server declaration with no interfaces or address, but simply specifying the primary external nameserver.
 .TP
 .B --local-service
 Accept DNS queries only from hosts whose address is on a local subnet,
@@ -366,10 +366,13 @@ been built with DBus support. If the service name is given, dnsmasq
 provides service at that name, rather than the default which is 
 .B uk.org.thekelleys.dnsmasq
 .TP 
-.B --enable-ubus
+.B --enable-ubus[=<service-name>]
 Enable dnsmasq UBus interface. It sends notifications via UBus on
 DHCPACK and DHCPRELEASE events. Furthermore it offers metrics.
-Requires that dnsmasq has been built with UBus support.
+Requires that dnsmasq has been built with UBus support. If the service
+name is given, dnsmasq provides service at that namespace, rather than
+the default which is
+.B dnsmasq
 .TP
 .B \-o, --strict-order
 By default, dnsmasq will send queries to any of the upstream servers
@@ -395,11 +398,13 @@ were previously disabled.
 .TP
 .B --stop-dns-rebind
 Reject (and log) addresses from upstream nameservers which are in the
-private IP ranges. This blocks an attack where a browser behind a
-firewall is used to probe machines on the local network.
+private ranges. This blocks an attack where a browser behind a
+firewall is used to probe machines on the local network. For IPv6, the
+private range covers the IPv4-mapped addresses in private space plus
+all link-local (LL) and site-local (ULA) addresses.
 .TP
 .B --rebind-localhost-ok
-Exempt 127.0.0.0/8 from rebinding checks. This address range is
+Exempt 127.0.0.0/8 and ::1 from rebinding checks. This address range is
 returned by realtime black hole servers, so blocking it may disable
 these services.
 .TP 

po/de.po

@@ -9,10 +9,10 @@
 # Simon Kelley <simon@thekelleys.org.uk>, 2005.
 msgid ""
 msgstr ""
-"Project-Id-Version: dnsmasq 2.80\n"
+"Project-Id-Version: dnsmasq 2.81\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2009-06-18 12:24+0100\n"
-"PO-Revision-Date: 2018-09-29 00:13+0200\n"
+"PO-Revision-Date: 2020-03-08 20:25+0100\n"
 "Last-Translator: Conrad Kostecki <conrad@kostecki.com>\n"
 "Language-Team: German <de@li.org>\n"
 "Language: de\n"
@@ -20,7 +20,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
-"X-Generator: Poedit 2.1.1\n"
+"X-Generator: Poedit 2.3\n"
 "X-Poedit-SourceCharset: UTF-8\n"
 
 #: cache.c:559
@@ -431,7 +431,7 @@ msgstr "DBus-Schnittstelle zum Festlegen vorgelagerter Server usw. festlegen."
 
 #: option.c:431
 msgid "Enable the UBus interface."
-msgstr ""
+msgstr "UBus-Schnittstelle aktivieren."
 
 #: option.c:432
 msgid "Do not provide DHCP on this interface, only provide DNS."
@@ -451,7 +451,7 @@ msgstr "DHCP-Anfragen von Alias-Schnittstellen für die Hauptschnittstelle beant
 
 #: option.c:436
 msgid "Specify extra networks sharing a broadcast domain for DHCP"
-msgstr ""
+msgstr "Geben Sie zusätzliche Netzwerke an, die eine Broadcast-Domäne für DHCP gemeinsam nutzen"
 
 #: option.c:437
 msgid "Disable ICMP echo address checking in the DHCP server."
@@ -546,7 +546,7 @@ msgstr "Bereich für vorübergehende Ports für TFTP-Übertragungen."
 
 #: option.c:459
 msgid "Use only one port for TFTP server."
-msgstr ""
+msgstr "Bitte nur einen Port für den TFTP-Server nutzen."
 
 #: option.c:460
 msgid "Extra logging for DHCP."
@@ -577,9 +577,8 @@ msgid "Set tag if client includes matching option in request."
 msgstr "Marke setzen, wenn Klient eine entsprechende Option anfragt."
 
 #: option.c:467
-#, fuzzy
 msgid "Set tag if client provides given name."
-msgstr "Marke setzen, wenn Klient eine entsprechende Option anfragt."
+msgstr "Setzt das Tag, wenn der Client diesen Namen anbietet."
 
 #: option.c:468
 msgid "Use alternative ports for DHCP."
@@ -651,9 +650,8 @@ msgid "Attempt to allocate sequential IP addresses to DHCP clients."
 msgstr "Versuche sequenzielle IP-Adressen an DHCP-Klienten zu vergeben."
 
 #: option.c:485
-#, fuzzy
 msgid "Ignore client identifier option sent by DHCP clients."
-msgstr "Von DHCP-Clients gelieferte Hostnamen ignorieren."
+msgstr "Ignorieren Sie die von DHCP-Clients gesendete Client-ID-Option."
 
 #: option.c:486
 msgid "Copy connection-track mark from queries to upstream connections."
@@ -677,7 +675,7 @@ msgstr "Spezifiziere Host (A/AAAA und PTR) Einträge"
 
 #: option.c:491
 msgid "Specify certification authority authorization record"
-msgstr ""
+msgstr "Geben Sie den Autorisierungsdatensatz der Zertifizierungsstelle an"
 
 #: option.c:492
 msgid "Specify arbitrary DNS resource record"
@@ -781,20 +779,19 @@ msgstr "Verzögere DHCP-Antworten für mindestens Anzahl von Sekunden."
 
 #: option.c:517
 msgid "Enables DHCPv4 Rapid Commit option."
-msgstr ""
+msgstr "Aktiviert die Option DHCPv4 Rapid Commit."
 
 #: option.c:518
 msgid "Path to debug packet dump file"
-msgstr ""
+msgstr "Pfad zur Debug-Paketdatei, wohin gedumpt werden soll"
 
 #: option.c:519
 msgid "Mask which packets to dump"
-msgstr ""
+msgstr "Maskiere Pakete, welche gedumpt werden sollen"
 
 #: option.c:520
-#, fuzzy
 msgid "Call dhcp-script when lease expiry changes."
-msgstr "Rufe dhcp-script mit Änderungen an der lokalen ARP-Tabelle auf."
+msgstr "Rufe dhcp-script auf, wenn der Ablauf des Leases sich ändert."
 
 #: option.c:725
 #, c-format
@@ -931,7 +928,7 @@ msgstr "unzulässige Brücken-Schnittstelle"
 
 #: option.c:2941
 msgid "bad shared-network"
-msgstr ""
+msgstr "unzulässiger geteiltes Netz"
 
 #: option.c:2996
 msgid "only one tag allowed"
@@ -970,9 +967,8 @@ msgid "bad hex constant"
 msgstr "Falscher Hexwert"
 
 #: option.c:3315
-#, fuzzy
 msgid "bad IPv6 prefix"
-msgstr "unzulässiger Präfix"
+msgstr "unzulässiger IPv6-Präfix"
 
 #: option.c:3362
 #, c-format
@@ -1008,9 +1004,8 @@ msgid "bad DUID"
 msgstr "unzulässige DUID"
 
 #: option.c:4023
-#, fuzzy
 msgid "missing address in alias"
-msgstr "Adresse ungültig"
+msgstr "Adresse fehlt in Alias"
 
 #: option.c:4029
 msgid "invalid alias range"
@@ -1037,9 +1032,8 @@ msgid "bad RR record"
 msgstr "unzulässiger RR-Eintrag"
 
 #: option.c:4236
-#, fuzzy
 msgid "bad CAA record"
-msgstr "unzulässiger RR-Eintrag"
+msgstr "unzulässiger CAA-Eintrag"
 
 #: option.c:4265
 msgid "bad TXT record"
@@ -1071,7 +1065,7 @@ msgstr "Unzulässiger Name in host-record"
 
 #: option.c:4444
 msgid "bad value for dnssec-check-unsigned"
-msgstr ""
+msgstr "Ungültiger Wert für dnssec-check-unsigned"
 
 #: option.c:4480
 msgid "bad trust anchor"
@@ -1310,9 +1304,9 @@ msgid "domain"
 msgstr "Domain"
 
 #: network.c:1543
-#, fuzzy, c-format
+#, c-format
 msgid "using only locally-known addresses for %s %s"
-msgstr "Benutze lokale Adressen nur für %s %s"
+msgstr "Benutze nur lokal-bekannte Adressen für %s %s"
 
 #: network.c:1546
 #, c-format
@@ -1394,9 +1388,8 @@ msgid "loop detection not available: set HAVE_LOOP in src/config.h"
 msgstr "Loop-Erkennung nicht verfügbar, Aktiviere HAVE_LOOP in src/config.h"
 
 #: dnsmasq.c:232
-#, fuzzy
 msgid "Ubus not available: set HAVE_UBUS in src/config.h"
-msgstr "DBus nicht verfügbar: setzen Sie HAVE_DBUS in src/config.h"
+msgstr "UBus nicht verfügbar: setzen Sie HAVE_UBUS in src/config.h"
 
 #: dnsmasq.c:236
 msgid "max_port cannot be smaller than min_port"
@@ -1404,7 +1397,7 @@ msgstr "max_port darf nicht kleiner als min_port sein"
 
 #: dnsmasq.c:243
 msgid "--auth-server required when an auth zone is defined."
-msgstr ""
+msgstr "--Auth-Server ist notwendig, wenn eine Auth-Zone definiert ist."
 
 #: dnsmasq.c:248
 msgid "zone serial must be configured in --auth-soa"
@@ -1429,9 +1422,8 @@ msgid "unknown interface %s"
 msgstr "unbekannte Schnittstelle %s"
 
 #: dnsmasq.c:406
-#, fuzzy
 msgid "Packet dumps not available: set HAVE_DUMP in src/config.h"
-msgstr "DBus nicht verfügbar: setzen Sie HAVE_DBUS in src/config.h"
+msgstr "Paketdump nicht verfügbar: setzen Sie HAVE_DUMP in src/config.h"
 
 #: dnsmasq.c:416 dnsmasq.c:1171
 #, c-format
@@ -1443,9 +1435,8 @@ msgid "DBus not available: set HAVE_DBUS in src/config.h"
 msgstr "DBus nicht verfügbar: setzen Sie HAVE_DBUS in src/config.h"
 
 #: dnsmasq.c:429
-#, fuzzy
 msgid "UBus not available: set HAVE_UBUS in src/config.h"
-msgstr "DBus nicht verfügbar: setzen Sie HAVE_DBUS in src/config.h"
+msgstr "UBus nicht verfügbar: setzen Sie HAVE_UBUS in src/config.h"
 
 #: dnsmasq.c:459
 #, c-format
@@ -1455,7 +1446,7 @@ msgstr "Unbekannter Benutzer oder Gruppe: %s"
 #: dnsmasq.c:535
 #, c-format
 msgid "process is missing required capability %s"
-msgstr ""
+msgstr "Prozess benötigt nicht vorhandene Fähigkeit %s"
 
 #: dnsmasq.c:567
 #, c-format
@@ -1475,7 +1466,7 @@ msgstr "gestartet, Version %s, Cachegröße %d"
 
 #: dnsmasq.c:822
 msgid "cache size greater than 10000 may cause performance issues, and is unlikely to be useful."
-msgstr ""
+msgstr "Die Cachegröße größer als 10000 kann Performanceprobleme verursachen und der positive Nutzen ist zudem unwahrscheinlich."
 
 #: dnsmasq.c:825
 #, c-format
@@ -1500,18 +1491,16 @@ msgid "DBus support enabled: bus connection pending"
 msgstr "DBus-Unterstützung eingeschaltet: warte auf Systembus-Verbindung"
 
 #: dnsmasq.c:850
-#, fuzzy
 msgid "UBus support enabled: connected to system bus"
-msgstr "DBus-Unterstützung eingeschaltet: mit Systembus verbunden"
+msgstr "UBus-Unterstützung aktiviert: Mit Systembus verbunden"
 
 #: dnsmasq.c:852
-#, fuzzy
 msgid "UBus support enabled: bus connection pending"
-msgstr "DBus-Unterstützung eingeschaltet: warte auf Systembus-Verbindung"
+msgstr "UBus-Unterstützung aktiviert: BUS-Verbindung wird hergestellt"
 
 #: dnsmasq.c:872
 msgid "DNSSEC validation enabled but all unsigned answers are trusted"
-msgstr ""
+msgstr "DNSSEC-Validierung aktiviert, jedoch wird allen unsignierten Antworten vertraut"
 
 #: dnsmasq.c:874
 msgid "DNSSEC validation enabled"
@@ -1528,7 +1517,7 @@ msgstr "DNSSEC Signatur-Zeitstempel werden erst überprüft, sobald die Systemuh
 #: dnsmasq.c:884
 #, c-format
 msgid "configured with trust anchor for %s keytag %u"
-msgstr ""
+msgstr "konfiguriert mit Vertrauensanker für% s Schlüsselwort % u"
 
 #: dnsmasq.c:890
 #, c-format
@@ -1580,9 +1569,8 @@ msgid "secure mode"
 msgstr "sicherer Modus"
 
 #: dnsmasq.c:961
-#, fuzzy
 msgid "single port mode"
-msgstr "unzulässige Portnummer"
+msgstr "Einzelport-Modus"
 
 #: dnsmasq.c:964
 #, c-format
@@ -1762,14 +1750,14 @@ msgid "DHCP relay %s -> %s"
 msgstr "DHCP Weiterleitung %s -> %s"
 
 #: lease.c:64
-#, fuzzy, c-format
+#, c-format
 msgid "ignoring invalid line in lease database: %s %s %s %s ..."
-msgstr "Fehler beim Parsen der Lease-Datenbank, ungültige Zeile: %s %s %s %s ..."
+msgstr "ignoriere fehlerhafte Zeile in Lease-Datenbank: %s %s %s %s ..."
 
 #: lease.c:101
 #, c-format
 msgid "ignoring invalid line in lease database, bad address: %s"
-msgstr ""
+msgstr "ignoriere fehlerhafte Zeile in Lease-Datenbank, ungültige Adresse: %s"
 
 #: lease.c:108
 msgid "too many stored leases"
@@ -1781,9 +1769,8 @@ msgid "cannot open or create lease file %s: %s"
 msgstr "kann Lease-Datei %s nicht öffnen: %s"
 
 #: lease.c:185
-#, fuzzy
 msgid "failed to parse lease database cleanly"
-msgstr "Fehler beim Parsen der Lease-Datenbank, ungültige Zeile: %s %s %s %s ..."
+msgstr "Fehler beim korrekten Parsen der Lease-Datenbank"
 
 #: lease.c:188
 #, c-format
@@ -2287,12 +2274,12 @@ msgstr "Prüfe jetzt DNSSEC Signatur-Zeitstempel."
 #: dnssec.c:902
 #, c-format
 msgid "Insecure DS reply received for %s, check domain configuration and upstream DNS server DNSSEC support"
-msgstr ""
+msgstr "Unsichere DS-Antwort für %s, bitte Domainkonfiguration und Upstream DNS-Server für DNSSEC-Unterstützung überprüfen"
 
 #: blockdata.c:55
-#, fuzzy, c-format
+#, c-format
 msgid "pool memory in use %u, max %u, allocated %u"
-msgstr "DNSSEC Speicher in Benutzung %u, Max %u, zugewiesen %u"
+msgstr "Pool Speicher in Benutzung %u, Max %u, zugewiesen %u"
 
 #: tables.c:61
 #, c-format
@@ -2369,65 +2356,63 @@ msgid "inotify, new or changed file %s"
 msgstr "inotify, neue oder geänderte Datei %s"
 
 #: dump.c:64
-#, fuzzy, c-format
+#, c-format
 msgid "cannot create %s: %s"
-msgstr "kann %s nicht lesen: %s"
+msgstr "kann %s nicht erstellen: %s"
 
 #: dump.c:70
-#, fuzzy, c-format
+#, c-format
 msgid "bad header in %s"
-msgstr "Adresse in Nutzung"
+msgstr "Unzulässiger Header in %s"
 
 #: dump.c:201
-#, fuzzy
 msgid "failed to write packet dump"
-msgstr "Fehlgeschlagen, folgendes Paket zu senden: %s"
+msgstr "schreiben des Paketmitschnitt fehlgeschlagen"
 
 #: dump.c:203
 #, c-format
 msgid "dumping UDP packet %u mask 0x%04x"
-msgstr ""
+msgstr "Dumpe UDP Paket %u Maske 0x%04x"
 
 #: ubus.c:52
 #, c-format
 msgid "UBus subscription callback: %s subscriber(s)"
-msgstr ""
+msgstr "UBus-Subskription Rückruf: %s Teilnehmer"
 
 #: ubus.c:73
-#, fuzzy, c-format
+#, c-format
 msgid "Cannot reconnect to UBus: %s"
-msgstr "Kann Logdatei %s nicht öffnen: %s"
+msgstr "Kann mit UBus nicht erneut verbinden: %s"
 
 #: ubus.c:89
 msgid "Cannot initialize UBus: connection failed"
-msgstr ""
+msgstr "Kann UBus nicht initialisieren: Verbindung fehlgeschlagen"
 
 #: ubus.c:102
-#, fuzzy, c-format
+#, c-format
 msgid "Cannot add object to UBus: %s"
-msgstr "Kann Logdatei %s nicht öffnen: %s"
+msgstr "Kann Objekt zu UBus nicht hinzufügen: %s"
 
 #: ubus.c:112
-#, fuzzy
 msgid "Connected to system UBus"
-msgstr "Mit System-DBus verbunden"
+msgstr "Mit System-UBus verbunden"
 
 #: ubus.c:122
 msgid "Cannot set UBus listeners: no connection"
-msgstr ""
+msgstr "Kann UBus-Zuhörer nicht setzen: Keine Verbindung"
 
 #: ubus.c:142
 msgid "Cannot poll UBus listeners: no connection"
-msgstr ""
+msgstr "Kann UBus-Zuhörer nicht abfragen: Keine Verbindung"
 
 #: ubus.c:155
 msgid "Disconnecting from UBus"
-msgstr ""
+msgstr "Mit System-UBus trennen"
 
 #: ubus.c:199
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to send UBus event: %s"
-msgstr "Fehlgeschlagen, folgendes Paket zu senden: %s"
+msgstr "Fehlgeschlagen, folgendes UBus-Event zu senden: %s"
 
 #~ msgid "Specify DHCPv6 prefix class"
 #~ msgstr "Spezifiziere DHCPv6 Prefix Klasse"

src/auth.c

@@ -628,16 +628,20 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n
 	{
 	  struct name_list *secondary;
 	  
-	  newoffset = ansp - (unsigned char *)header;
-	  if (add_resource_record(header, limit, &trunc, -offset, &ansp, 
-				  daemon->auth_ttl, NULL, T_NS, C_IN, "d", offset == 0 ? authname : NULL, daemon->authserver))
+	  /* Only include the machine running dnsmasq if it's acting as an auth server */
+	  if (daemon->authinterface)
 	    {
-	      if (offset == 0) 
-		offset = newoffset;
-	      if (ns) 
-		anscount++;
-	      else
-		authcount++;
+	      newoffset = ansp - (unsigned char *)header;
+	      if (add_resource_record(header, limit, &trunc, -offset, &ansp, 
+				      daemon->auth_ttl, NULL, T_NS, C_IN, "d", offset == 0 ? authname : NULL, daemon->authserver))
+		{
+		  if (offset == 0) 
+		    offset = newoffset;
+		  if (ns) 
+		    anscount++;
+		  else
+		    authcount++;
+		}
 	    }
 
 	  if (!subnet)

src/config.h

@@ -50,6 +50,7 @@
 #define RANDFILE "/dev/urandom"
 #define DNSMASQ_SERVICE "uk.org.thekelleys.dnsmasq" /* Default - may be overridden by config */
 #define DNSMASQ_PATH "/uk/org/thekelleys/dnsmasq"
+#define DNSMASQ_UBUS_NAME "dnsmasq" /* Default - may be overridden by config */
 #define AUTH_TTL 600 /* default TTL for auth DNS */
 #define SOA_REFRESH 1200 /* SOA refresh default */
 #define SOA_RETRY 180 /* SOA retry default */

src/dnsmasq.c

@@ -89,11 +89,15 @@ int main (int argc, char **argv)
   sigaction(SIGPIPE, &sigact, NULL);
 
   umask(022); /* known umask, create leases and pid files as 0644 */
- 
+
   rand_init(); /* Must precede read_opts() */
   
   read_opts(argc, argv, compile_opts);
  
+#ifdef HAVE_LINUX_NETWORK
+  daemon->kernel_version = kernel_version();
+#endif
+
   if (daemon->edns_pktsz < PACKETSZ)
     daemon->edns_pktsz = PACKETSZ;
 
@@ -1679,7 +1683,7 @@ static int set_dns_listeners(time_t now)
   
   /* will we be able to get memory? */
   if (daemon->port != 0)
-    get_new_frec(now, &wait, 0);
+    get_new_frec(now, &wait, NULL);
   
   for (serverfdp = daemon->sfds; serverfdp; serverfdp = serverfdp->next)
     poll_listen(serverfdp->fd, POLLIN);

src/dnsmasq.h

@@ -141,6 +141,7 @@ typedef unsigned long long u64;
 #endif
 
 #if defined(HAVE_LINUX_NETWORK)
+#include <linux/version.h>
 #include <linux/sockios.h>
 #include <linux/capability.h>
 /* There doesn't seem to be a universally-available 
@@ -1062,6 +1063,7 @@ extern struct daemon {
   unsigned int duid_enterprise, duid_config_len;
   unsigned char *duid_config;
   char *dbus_name;
+  char *ubus_name;
   char *dump_file;
   int dump_mask;
   unsigned long soa_sn, soa_refresh, soa_retry, soa_expiry;
@@ -1108,7 +1110,7 @@ extern struct daemon {
   int inotifyfd;
 #endif
 #if defined(HAVE_LINUX_NETWORK)
-  int netlinkfd;
+  int netlinkfd, kernel_version;
 #elif defined(HAVE_BSD_NETWORK)
   int dhcp_raw_fd, dhcp_icmp_fd, routefd;
 #endif
@@ -1288,6 +1290,9 @@ int read_write(int fd, unsigned char *packet, int size, int rw);
 void close_fds(long max_fd, int spare1, int spare2, int spare3);
 int wildcard_match(const char* wildcard, const char* match);
 int wildcard_matchn(const char* wildcard, const char* match, int num);
+#ifdef HAVE_LINUX_NETWORK
+int kernel_version(void);
+#endif
 
 /* log.c */
 void die(char *message, char *arg1, int exit_code) ATTRIBUTE_NORETURN;
@@ -1319,7 +1324,7 @@ void receive_query(struct listener *listen, time_t now);
 unsigned char *tcp_request(int confd, time_t now,
 			   union mysockaddr *local_addr, struct in_addr netmask, int auth_dns);
 void server_gone(struct server *server);
-struct frec *get_new_frec(time_t now, int *wait, int force);
+struct frec *get_new_frec(time_t now, int *wait, struct frec *force);
 int send_from(int fd, int nowild, char *packet, size_t len, 
 	       union mysockaddr *to, union all_addr *source,
 	       unsigned int iface);

src/dnssec.c

@@ -1003,7 +1003,7 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
       
       cache_end_insert();  
       
-      log_query(F_NOEXTRA | F_UPSTREAM, name, NULL, "no DS");
+      log_query(F_NOEXTRA | F_UPSTREAM, name, NULL, nons ? "no DS/cut" : "no DS");
     }
       
   return STAT_OK;

src/forward.c

@@ -348,7 +348,7 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr,
       type &= ~SERV_DO_DNSSEC;      
 
       if (daemon->servers && !flags)
-	forward = get_new_frec(now, NULL, 0);
+	forward = get_new_frec(now, NULL, NULL);
       /* table full - flags == 0, return REFUSED */
       
       if (forward)
@@ -1039,7 +1039,9 @@ void reply_query(int fd, int family, time_t now)
 		  /* Find the original query that started it all.... */
 		  for (orig = forward; orig->dependent; orig = orig->dependent);
 		  
-		  if (--orig->work_counter == 0 || !(new = get_new_frec(now, NULL, 1)))
+		  /* Make sure we don't expire and free the orig frec during the
+		     allocation of a new one. */
+		  if (--orig->work_counter == 0 || !(new = get_new_frec(now, NULL, orig)))
 		    status = STAT_ABANDONED;
 		  else
 		    {
@@ -2251,9 +2253,10 @@ static void free_frec(struct frec *f)
    else return *wait zero if one available, or *wait is delay to
    when the oldest in-use record will expire. Impose an absolute
    limit of 4*TIMEOUT before we wipe things (for random sockets).
-   If force is set, always return a result, even if we have
-   to allocate above the limit. */
-struct frec *get_new_frec(time_t now, int *wait, int force)
+   If force is non-NULL, always return a result, even if we have
+   to allocate above the limit, and never free the record pointed
+   to by the force argument. */
+struct frec *get_new_frec(time_t now, int *wait, struct frec *force)
 {
   struct frec *f, *oldest, *target;
   int count;
@@ -2270,7 +2273,7 @@ struct frec *get_new_frec(time_t now, int *wait, int force)
 	    /* Don't free DNSSEC sub-queries here, as we may end up with
 	       dangling references to them. They'll go when their "real" query 
 	       is freed. */
-	    if (!f->dependent)
+	    if (!f->dependent && f != force)
 #endif
 	      {
 		if (difftime(now, f->time) >= 4*TIMEOUT)

src/ipset.c

@@ -22,9 +22,7 @@
 #include <errno.h>
 #include <sys/types.h>
 #include <sys/socket.h>
-#include <sys/utsname.h>
 #include <arpa/inet.h>
-#include <linux/version.h>
 #include <linux/netlink.h>
 
 /* We want to be able to compile against old header files
@@ -87,20 +85,7 @@ static inline void add_attr(struct nlmsghdr *nlh, uint16_t type, size_t len, con
 
 void ipset_init(void)
 {
-  struct utsname utsname;
-  int version;
-  char *split;
-  
-  if (uname(&utsname) < 0)
-    die(_("failed to find kernel version: %s"), NULL, EC_MISC);
-  
-  split = strtok(utsname.release, ".");
-  version = (split ? atoi(split) : 0);
-  split = strtok(NULL, ".");
-  version = version * 256 + (split ? atoi(split) : 0);
-  split = strtok(NULL, ".");
-  version = version * 256 + (split ? atoi(split) : 0);
-  old_kernel = (version < KERNEL_VERSION(2,6,32));
+  old_kernel = (daemon->kernel_version < KERNEL_VERSION(2,6,32));
   
   if (old_kernel && (ipset_sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) != -1)
     return;

src/netlink.c

@@ -22,6 +22,15 @@
 #include <linux/netlink.h>
 #include <linux/rtnetlink.h>
 
+/* Blergh. Radv does this, so that's our excuse. */
+#ifndef SOL_NETLINK
+#define SOL_NETLINK 270
+#endif
+
+#ifndef NETLINK_NO_ENOBUFS
+#define NETLINK_NO_ENOBUFS 5
+#endif
+
 /* linux 2.6.19 buggers up the headers, patch it up here. */ 
 #ifndef IFA_RTA
 #  define IFA_RTA(r)  \
@@ -44,6 +53,7 @@ void netlink_init(void)
 {
   struct sockaddr_nl addr;
   socklen_t slen = sizeof(addr);
+  int opt = 1;
 
   addr.nl_family = AF_NETLINK;
   addr.nl_pad = 0;
@@ -72,9 +82,11 @@ void netlink_init(void)
     }
   
   if (daemon->netlinkfd == -1 || 
+      (daemon->kernel_version >= KERNEL_VERSION(2,6,30) &&
+       setsockopt(daemon->netlinkfd, SOL_NETLINK, NETLINK_NO_ENOBUFS, &opt, sizeof(opt)) == -1) ||
       getsockname(daemon->netlinkfd, (struct sockaddr *)&addr, &slen) == -1)
     die(_("cannot create netlink socket: %s"), NULL, EC_MISC);
-   
+  
   /* save pid assigned by bind() and retrieved by getsockname() */ 
   netlink_pid = addr.nl_pid;
   

src/option.c

@@ -238,7 +238,7 @@ static const struct myoption opts[] =
     { "caa-record", 1, 0 , LOPT_CAA },
     { "dns-rr", 1, 0, LOPT_RR },
     { "enable-dbus", 2, 0, '1' },
-    { "enable-ubus", 0, 0, LOPT_UBUS },
+    { "enable-ubus", 2, 0, LOPT_UBUS },
     { "bootp-dynamic", 2, 0, '3' },
     { "dhcp-mac", 1, 0, '4' },
     { "no-ping", 0, 0, '5' },
@@ -428,7 +428,7 @@ static struct {
   { 'z', OPT_NOWILD, NULL, gettext_noop("Bind only to interfaces in use."), NULL },
   { 'Z', OPT_ETHERS, NULL, gettext_noop("Read DHCP static host information from %s."), ETHERSFILE },
   { '1', ARG_ONE, "[=<busname>]", gettext_noop("Enable the DBus interface for setting upstream servers, etc."), NULL },
-  { LOPT_UBUS, OPT_UBUS, NULL, gettext_noop("Enable the UBus interface."), NULL },
+  { LOPT_UBUS, ARG_ONE, "[=<busname>]", gettext_noop("Enable the UBus interface."), NULL },
   { '2', ARG_DUP, "<interface>", gettext_noop("Do not provide DHCP on this interface, only provide DNS."), NULL },
   { '3', ARG_DUP, "[=tag:<tag>]...", gettext_noop("Enable dynamic address allocation for bootp."), NULL },
   { '4', ARG_DUP, "set:<tag>,<mac address>", gettext_noop("Map MAC address (with wildcards) to option set."), NULL },
@@ -1881,7 +1881,15 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
       else
 	daemon->dbus_name = DNSMASQ_SERVICE;
       break;
-      
+
+    case LOPT_UBUS: /* --enable-ubus */
+      set_option_bool(OPT_UBUS);
+      if (arg)
+	daemon->ubus_name = opt_string_alloc(arg);
+      else
+	daemon->ubus_name = DNSMASQ_UBUS_NAME;
+      break;
+
     case '8': /* --log-facility */
       /* may be a filename */
       if (strchr(arg, '/') || strcmp (arg, "-") == 0)

src/rfc1035.c

@@ -843,17 +843,31 @@ int extract_addresses(struct dns_header *header, size_t qlen, char *name, time_t
 			      if ((flags & F_IPV4) &&
 				  private_net(addr.addr4, !option_bool(OPT_LOCAL_REBIND)))
 				return 1;
-			      
-			      if ((flags & F_IPV6) &&
-				  IN6_IS_ADDR_V4MAPPED(&addr.addr6))
+
+			      /* Block IPv4-mapped IPv6 addresses in private IPv4 address space */
+			      if (flags & F_IPV6)
 				{
-				  struct in_addr v4;
-				  v4.s_addr = ((const uint32_t *) (&addr.addr6))[3];
-				  if (private_net(v4, !option_bool(OPT_LOCAL_REBIND)))
+				  if (IN6_IS_ADDR_V4MAPPED(&addr.addr6))
+				    {
+				      struct in_addr v4;
+				      v4.s_addr = ((const uint32_t *) (&addr.addr6))[3];
+				      if (private_net(v4, !option_bool(OPT_LOCAL_REBIND)))
+					return 1;
+				    }
+
+				  /* Check for link-local (LL) and site-local (ULA) IPv6 addresses */
+				  if (IN6_IS_ADDR_LINKLOCAL(&addr.addr6) ||
+				      IN6_IS_ADDR_SITELOCAL(&addr.addr6))
+				    return 1;
+
+				  /* Check for the IPv6 loopback address (::1) when
+				     option rebind-localhost-ok is NOT set */
+				  if (!option_bool(OPT_LOCAL_REBIND) &&
+				      IN6_IS_ADDR_LOOPBACK(&addr.addr6))
 				    return 1;
 				}
 			    }
-			  
+
 #ifdef HAVE_IPSET
 			  if (ipsets && (flags & (F_IPV4 | F_IPV6)))
 			    {

src/ubus.c

@@ -38,7 +38,7 @@ static struct ubus_object_type ubus_object_type =
   UBUS_OBJECT_TYPE("dnsmasq", ubus_object_methods);
 
 static struct ubus_object ubus_object = {
-  .name = "dnsmasq",
+  .name = NULL,
   .type = &ubus_object_type,
   .methods = ubus_object_methods,
   .n_methods = ARRAY_SIZE(ubus_object_methods),
@@ -94,6 +94,7 @@ void ubus_init()
       return;
     }
 
+  ubus_object.name = daemon->ubus_name;
   ret = ubus_add_object(ubus, &ubus_object);
   if (ret)
     {
@@ -102,6 +103,7 @@ void ubus_init()
           my_syslog(LOG_ERR, _("Cannot add object to UBus: %s"), ubus_strerror(ret));
           error_logged = 1;
         }
+      ubus_destroy(ubus);
       return;
     }
 

src/util.c

@@ -30,6 +30,10 @@
 #include <idna.h>
 #endif
 
+#ifdef HAVE_LINUX_NETWORK
+#include <sys/utsname.h>
+#endif
+
 /* SURF random number generator */
 
 static u32 seed[32];
@@ -782,3 +786,22 @@ int wildcard_matchn(const char* wildcard, const char* match, int num)
 
   return (!num) || (*wildcard == *match);
 }
+
+#ifdef HAVE_LINUX_NETWORK
+int kernel_version(void)
+{
+  struct utsname utsname;
+  int version;
+  char *split;
+  
+  if (uname(&utsname) < 0)
+    die(_("failed to find kernel version: %s"), NULL, EC_MISC);
+  
+  split = strtok(utsname.release, ".");
+  version = (split ? atoi(split) : 0);
+  split = strtok(NULL, ".");
+  version = version * 256 + (split ? atoi(split) : 0);
+  split = strtok(NULL, ".");
+  return version * 256 + (split ? atoi(split) : 0);
+}
+#endif

trust-anchors.conf

@@ -1,9 +1,8 @@
-# The root DNSSEC trust anchor, valid as at 10/02/2017
+# The root DNSSEC trust anchor, valid as at 11/01/2019
 
 # Note that this is a DS record (ie a hash of the root Zone Signing Key) 
 # If was downloaded from https://data.iana.org/root-anchors/root-anchors.xml
 
-trust-anchor=.,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5
 trust-anchor=.,20326,8,2,E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D