Initial commit

package/network/services/dnsmasq/patches/0001-Fix-spurious-resource-limit-exceeded-messages.patch

@@ -0,0 +1,43 @@
+From 1ed783b8d7343c42910a61f12a8fc6237eb80417 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Mon, 19 Feb 2024 12:22:43 +0000
+Subject: Fix spurious "resource limit exceeded" messages.
+
+Replies from upstream with a REFUSED rcode can result in
+log messages stating that a resource limit has been exceeded,
+which is not the case.
+
+Thanks to Dominik Derigs and the Pi-hole project for
+spotting this.
+---
+ CHANGELOG     | 5 +++++
+ src/forward.c | 6 +++---
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -1,3 +1,8 @@
++version 2.91
++	Fix spurious "resource limit exceeded messages". Thanks to 
++	Dominik Derigs for the bug report.
++	
++
+ version 2.90
+ 	Fix reversion in --rev-server introduced in 2.88 which
+ 	caused breakage if the prefix length is not exactly divisible
+--- a/src/forward.c
++++ b/src/forward.c
+@@ -937,10 +937,10 @@ static void dnssec_validate(struct frec
+ 	status = dnssec_validate_reply(now, header, plen, daemon->namebuff, daemon->keyname, &forward->class, 
+ 				       !option_bool(OPT_DNSSEC_IGN_NS) && (forward->sentto->flags & SERV_DO_DNSSEC),
+ 				       NULL, NULL, NULL, &orig->validate_counter);
+-    }
+ 
+-  if (STAT_ISEQUAL(status, STAT_ABANDONED))
+-    log_resource = 1;
++      if (STAT_ISEQUAL(status, STAT_ABANDONED))
++	log_resource = 1;
++    }
+   
+   /* Can't validate, as we're missing key data. Put this
+      answer aside, whilst we get that. */     

package/network/services/dnsmasq/patches/0002-PATCH-Fix-error-introduced-in-51471cafa5a4fa44d6fe49.patch

@@ -0,0 +1,31 @@
+From ccff85ad72d2f858d9743d40525128e4f62d41a8 Mon Sep 17 00:00:00 2001
+From: renmingshuai <renmingshuai@huawei.com>
+Date: Wed, 21 Feb 2024 00:24:25 +0000
+Subject: [PATCH] Fix error introduced in
+ 51471cafa5a4fa44d6fe490885d9910bd72a5907
+
+Signed-off-by: renmingshuai <renmingshuai@huawei.com>
+---
+ src/dnssec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/src/dnssec.c
++++ b/src/dnssec.c
+@@ -1547,7 +1547,7 @@ static int prove_non_existence_nsec3(str
+       nsecs[i] = NULL; /* Speculative, will be restored if OK. */
+       
+       if (!(p = skip_name(nsec3p, header, plen, 15)))
+-	return 0; /* bad packet */
++	return DNSSEC_FAIL_BADPACKET; /* bad packet */
+       
+       p += 10; /* type, class, TTL, rdlen */
+       
+@@ -1640,7 +1640,7 @@ static int prove_non_existence_nsec3(str
+   if (!wildname)
+     {
+       if (!(wildcard = strchr(next_closest, '.')) || wildcard == next_closest)
+-	return 0;
++	return DNSSEC_FAIL_NONSEC;
+       
+       wildcard--;
+       *wildcard = '*';

package/network/services/dnsmasq/patches/100-remove-old-runtime-kernel-support.patch

@@ -0,0 +1,165 @@
+From 02fbe60e1c7e74d2ba57109575e7bfc238b1b5d4 Mon Sep 17 00:00:00 2001
+From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Date: Sun, 5 Apr 2020 17:18:23 +0100
+Subject: [PATCH] drop runtime old kernel support
+
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ src/dnsmasq.c |  4 ----
+ src/dnsmasq.h |  5 +---
+ src/ipset.c   | 64 ++++-----------------------------------------------
+ src/util.c    | 19 ---------------
+ 4 files changed, 5 insertions(+), 87 deletions(-)
+
+--- a/src/dnsmasq.c
++++ b/src/dnsmasq.c
+@@ -105,10 +105,6 @@ int main (int argc, char **argv)
+   
+   read_opts(argc, argv, compile_opts);
+  
+-#ifdef HAVE_LINUX_NETWORK
+-  daemon->kernel_version = kernel_version();
+-#endif
+-
+   if (daemon->edns_pktsz < PACKETSZ)
+     daemon->edns_pktsz = PACKETSZ;
+ 
+--- a/src/dnsmasq.h
++++ b/src/dnsmasq.h
+@@ -1277,7 +1277,7 @@ extern struct daemon {
+   int inotifyfd;
+ #endif
+ #if defined(HAVE_LINUX_NETWORK)
+-  int netlinkfd, kernel_version;
++  int netlinkfd;
+ #elif defined(HAVE_BSD_NETWORK)
+   int dhcp_raw_fd, dhcp_icmp_fd, routefd;
+ #endif
+@@ -1491,9 +1491,6 @@ int read_write(int fd, unsigned char *pa
+ void close_fds(long max_fd, int spare1, int spare2, int spare3);
+ int wildcard_match(const char* wildcard, const char* match);
+ int wildcard_matchn(const char* wildcard, const char* match, int num);
+-#ifdef HAVE_LINUX_NETWORK
+-int kernel_version(void);
+-#endif
+ 
+ /* log.c */
+ void die(char *message, char *arg1, int exit_code) ATTRIBUTE_NORETURN;
+--- a/src/ipset.c
++++ b/src/ipset.c
+@@ -70,7 +70,7 @@ struct my_nfgenmsg {
+ 
+ #define NL_ALIGN(len) (((len)+3) & ~(3))
+ static const struct sockaddr_nl snl = { .nl_family = AF_NETLINK };
+-static int ipset_sock, old_kernel;
++static int ipset_sock;
+ static char *buffer;
+ 
+ static inline void add_attr(struct nlmsghdr *nlh, uint16_t type, size_t len, const void *data)
+@@ -85,12 +85,7 @@ static inline void add_attr(struct nlmsg
+ 
+ void ipset_init(void)
+ {
+-  old_kernel = (daemon->kernel_version < KERNEL_VERSION(2,6,32));
+-  
+-  if (old_kernel && (ipset_sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) != -1)
+-    return;
+-  
+-  if (!old_kernel && 
++  if (
+       (buffer = safe_malloc(BUFF_SZ)) &&
+       (ipset_sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER)) != -1 &&
+       (bind(ipset_sock, (struct sockaddr *)&snl, sizeof(snl)) != -1))
+@@ -147,65 +142,14 @@ static int new_add_to_ipset(const char *
+   return errno == 0 ? 0 : -1;
+ }
+ 
+-
+-static int old_add_to_ipset(const char *setname, const union all_addr *ipaddr, int remove)
+-{
+-  socklen_t size;
+-  struct ip_set_req_adt_get {
+-    unsigned op;
+-    unsigned version;
+-    union {
+-      char name[IPSET_MAXNAMELEN];
+-      uint16_t index;
+-    } set;
+-    char typename[IPSET_MAXNAMELEN];
+-  } req_adt_get;
+-  struct ip_set_req_adt {
+-    unsigned op;
+-    uint16_t index;
+-    uint32_t ip;
+-  } req_adt;
+-  
+-  if (strlen(setname) >= sizeof(req_adt_get.set.name)) 
+-    {
+-      errno = ENAMETOOLONG;
+-      return -1;
+-    }
+-  
+-  req_adt_get.op = 0x10;
+-  req_adt_get.version = 3;
+-  strcpy(req_adt_get.set.name, setname);
+-  size = sizeof(req_adt_get);
+-  if (getsockopt(ipset_sock, SOL_IP, 83, &req_adt_get, &size) < 0)
+-    return -1;
+-  req_adt.op = remove ? 0x102 : 0x101;
+-  req_adt.index = req_adt_get.set.index;
+-  req_adt.ip = ntohl(ipaddr->addr4.s_addr);
+-  if (setsockopt(ipset_sock, SOL_IP, 83, &req_adt, sizeof(req_adt)) < 0)
+-    return -1;
+-  
+-  return 0;
+-}
+-
+-
+-
+ int add_to_ipset(const char *setname, const union all_addr *ipaddr, int flags, int remove)
+ {
+   int ret = 0, af = AF_INET;
+ 
+   if (flags & F_IPV6)
+-    {
+       af = AF_INET6;
+-      /* old method only supports IPv4 */
+-      if (old_kernel)
+-	{
+-	  errno = EAFNOSUPPORT ;
+-	  ret = -1;
+-	}
+-    }
+-  
+-  if (ret != -1) 
+-    ret = old_kernel ? old_add_to_ipset(setname, ipaddr, remove) : new_add_to_ipset(setname, ipaddr, af, remove);
++
++  ret = new_add_to_ipset(setname, ipaddr, af, remove);
+ 
+   if (ret == -1)
+      my_syslog(LOG_ERR, _("failed to update ipset %s: %s"), setname, strerror(errno));
+--- a/src/util.c
++++ b/src/util.c
+@@ -866,22 +866,3 @@ int wildcard_matchn(const char* wildcard
+ 
+   return (!num) || (*wildcard == *match);
+ }
+-
+-#ifdef HAVE_LINUX_NETWORK
+-int kernel_version(void)
+-{
+-  struct utsname utsname;
+-  int version;
+-  char *split;
+-  
+-  if (uname(&utsname) < 0)
+-    die(_("failed to find kernel version: %s"), NULL, EC_MISC);
+-  
+-  split = strtok(utsname.release, ".");
+-  version = (split ? atoi(split) : 0);
+-  split = strtok(NULL, ".");
+-  version = version * 256 + (split ? atoi(split) : 0);
+-  split = strtok(NULL, ".");
+-  return version * 256 + (split ? atoi(split) : 0);
+-}
+-#endif

package/network/services/dnsmasq/patches/200-ubus_dns.patch

@@ -0,0 +1,278 @@
+--- a/src/dnsmasq.c
++++ b/src/dnsmasq.c
+@@ -2021,6 +2021,10 @@ static void check_dns_listeners(time_t n
+ 		  daemon->pipe_to_parent = pipefd[1];
+ 		}
+ 
++#ifdef HAVE_UBUS
++	      drop_ubus_listeners();
++#endif
++
+ 	      /* start with no upstream connections. */
+ 	      for (s = daemon->servers; s; s = s->next)
+ 		 s->tcpfd = -1; 
+--- a/src/dnsmasq.h
++++ b/src/dnsmasq.h
+@@ -1670,14 +1670,26 @@ void emit_dbus_signal(int action, struct
+ 
+ /* ubus.c */
+ #ifdef HAVE_UBUS
++struct blob_attr;
++typedef void (*ubus_dns_notify_cb)(struct blob_attr *msg, void *priv);
++
+ char *ubus_init(void);
+ void set_ubus_listeners(void);
+ void check_ubus_listeners(void);
++void drop_ubus_listeners(void);
++int ubus_dns_notify_has_subscribers(void);
++struct blob_buf *ubus_dns_notify_prepare(void);
++int ubus_dns_notify(const char *type, ubus_dns_notify_cb cb, void *priv);
+ void ubus_event_bcast(const char *type, const char *mac, const char *ip, const char *name, const char *interface);
+ #  ifdef HAVE_CONNTRACK
+ void ubus_event_bcast_connmark_allowlist_refused(u32 mark, const char *name);
+ void ubus_event_bcast_connmark_allowlist_resolved(u32 mark, const char *pattern, const char *ip, u32 ttl);
+ #  endif
++#else
++static inline int ubus_dns_notify_has_subscribers(void)
++{
++	return 0;
++}
+ #endif
+ 
+ /* ipset.c */
+--- a/src/forward.c
++++ b/src/forward.c
+@@ -803,7 +803,7 @@ static size_t process_reply(struct dns_h
+ 	  cache_secure = 0;
+ 	}
+       
+-      if (daemon->doctors && do_doctor(header, n, daemon->namebuff))
++      if ((daemon->doctors || ubus_dns_notify_has_subscribers()) && do_doctor(header, n, daemon->namebuff))
+ 	cache_secure = 0;
+       
+       /* check_for_bogus_wildcard() does it's own caching, so
+--- a/src/rfc1035.c
++++ b/src/rfc1035.c
+@@ -13,8 +13,10 @@
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+-
+ #include "dnsmasq.h"
++#ifdef HAVE_UBUS
++#include <libubox/blobmsg.h>
++#endif
+ 
+ int extract_name(struct dns_header *header, size_t plen, unsigned char **pp, 
+ 		 char *name, int isExtract, int extrabytes)
+@@ -384,10 +386,65 @@ static int private_net6(struct in6_addr
+     ((u32 *)a)[0] == htonl(0x20010db8); /* RFC 6303 4.6 */
+ }
+ 
++#ifdef HAVE_UBUS
++static void ubus_dns_doctor_cb(struct blob_attr *msg, void *priv)
++{
++	static const struct blobmsg_policy policy = {
++		.name = "address",
++		.type = BLOBMSG_TYPE_STRING,
++	};
++	struct blob_attr *val;
++	char **dest = priv;
++
++	blobmsg_parse(&policy, 1, &val, blobmsg_data(msg), blobmsg_data_len(msg));
++	if (val)
++		*dest = blobmsg_get_string(val);
++}
++
++static int ubus_dns_doctor(const char *name, int ttl, void *p, int af)
++{
++	struct blob_buf *b;
++	char *addr;
++
++	if (!name)
++		return 0;
++
++	b = ubus_dns_notify_prepare();
++	if (!b)
++		return 0;
++
++	blobmsg_add_string(b, "name", name);
++
++	blobmsg_add_u32(b, "ttl", ttl);
++
++	blobmsg_add_string(b, "type", af == AF_INET6 ? "AAAA" : "A");
++
++	addr = blobmsg_alloc_string_buffer(b, "address", INET6_ADDRSTRLEN);
++	if (!addr)
++		return 0;
++
++	inet_ntop(af, p, addr, INET6_ADDRSTRLEN);
++	blobmsg_add_string_buffer(b);
++
++	addr = NULL;
++	ubus_dns_notify("dns_result", ubus_dns_doctor_cb, &addr);
++
++	if (!addr)
++		return 0;
++
++	return inet_pton(af, addr, p) == 1;
++}
++#else
++static int ubus_dns_doctor(const char *name, int ttl, void *p, int af)
++{
++	return 0;
++}
++#endif
++
+ int do_doctor(struct dns_header *header, size_t qlen, char *namebuff)
+ {
+   unsigned char *p;
+-  int i, qtype, qclass, rdlen;
++  int i, qtype, qclass, rdlen, ttl;
+   int done = 0;
+   
+   if (!(p = skip_questions(header, qlen)))
+@@ -404,7 +461,7 @@ int do_doctor(struct dns_header *header,
+       
+       GETSHORT(qtype, p); 
+       GETSHORT(qclass, p);
+-      p += 4; /* ttl */
++      GETLONG(ttl, p); /* ttl */
+       GETSHORT(rdlen, p);
+       
+       if (qclass == C_IN && qtype == T_A)
+@@ -415,6 +472,9 @@ int do_doctor(struct dns_header *header,
+ 	  if (!CHECK_LEN(header, p, qlen, INADDRSZ))
+ 	    return done;
+ 	  
++	  if (ubus_dns_doctor(daemon->namebuff, ttl, p, AF_INET))
++	    header->hb3 &= ~HB3_AA;
++
+ 	  /* alignment */
+ 	  memcpy(&addr.addr4, p, INADDRSZ);
+ 	  
+@@ -444,6 +504,14 @@ int do_doctor(struct dns_header *header,
+ 	      break;
+ 	    }
+ 	}
++      else if (qclass == C_IN && qtype == T_AAAA)
++        {
++	  if (!CHECK_LEN(header, p, qlen, IN6ADDRSZ))
++	    return 0;
++
++	  if (ubus_dns_doctor(daemon->namebuff, ttl, p, AF_INET6))
++	    header->hb3 &= ~HB3_AA;
++	}
+       
+       if (!ADD_RDLEN(header, p, qlen, rdlen))
+ 	 return done; /* bad packet */
+--- a/src/ubus.c
++++ b/src/ubus.c
+@@ -72,6 +72,13 @@ static struct ubus_object ubus_object =
+   .subscribe_cb = ubus_subscribe_cb,
+ };
+ 
++static struct ubus_object_type ubus_dns_object_type =
++   { .name = "dnsmasq.dns" };
++
++static struct ubus_object ubus_dns_object = {
++	.type = &ubus_dns_object_type,
++};
++
+ static void ubus_subscribe_cb(struct ubus_context *ctx, struct ubus_object *obj)
+ {
+   (void)ctx;
+@@ -105,13 +112,21 @@ static void ubus_disconnect_cb(struct ub
+ char *ubus_init()
+ {
+   struct ubus_context *ubus = NULL;
++  char *dns_name;
+   int ret = 0;
+ 
+   if (!(ubus = ubus_connect(NULL)))
+     return NULL;
+   
++  dns_name = whine_malloc(strlen(daemon->ubus_name) + 5);
++  sprintf(dns_name, "%s.dns", daemon->ubus_name);
++
+   ubus_object.name = daemon->ubus_name;
++  ubus_dns_object.name = dns_name;
++
+   ret = ubus_add_object(ubus, &ubus_object);
++  if (!ret)
++    ret = ubus_add_object(ubus, &ubus_dns_object);
+   if (ret)
+     {
+       ubus_destroy(ubus);
+@@ -181,6 +196,17 @@ void check_ubus_listeners()
+       } \
+   } while (0)
+ 
++void drop_ubus_listeners()
++{
++  struct ubus_context *ubus = (struct ubus_context *)daemon->ubus;
++
++  if (!ubus)
++    return;
++
++  ubus_free(ubus);
++  daemon->ubus = NULL;
++}
++
+ static int ubus_handle_metrics(struct ubus_context *ctx, struct ubus_object *obj,
+ 			       struct ubus_request_data *req, const char *method,
+ 			       struct blob_attr *msg)
+@@ -328,6 +354,53 @@ fail:
+       } \
+   } while (0)
+ 
++int ubus_dns_notify_has_subscribers(void)
++{
++	return (daemon->ubus && ubus_dns_object.has_subscribers);
++}
++
++struct blob_buf *ubus_dns_notify_prepare(void)
++{
++	if (!ubus_dns_notify_has_subscribers())
++		return NULL;
++
++	blob_buf_init(&b, 0);
++	return &b;
++}
++
++struct ubus_dns_notify_req {
++	struct ubus_notify_request req;
++	ubus_dns_notify_cb cb;
++	void *priv;
++};
++
++static void dns_notify_cb(struct ubus_notify_request *req, int type, struct blob_attr *msg)
++{
++	struct ubus_dns_notify_req *dreq = container_of(req, struct ubus_dns_notify_req, req);
++
++	dreq->cb(msg, dreq->priv);
++}
++
++int ubus_dns_notify(const char *type, ubus_dns_notify_cb cb, void *priv)
++{
++	struct ubus_context *ubus = (struct ubus_context *)daemon->ubus;
++	struct ubus_dns_notify_req dreq;
++	int ret;
++
++	if (!ubus || !ubus_dns_object.has_subscribers)
++		return 0;
++
++	ret = ubus_notify_async(ubus, &ubus_dns_object, type, b.head, &dreq.req);
++	if (ret)
++		return ret;
++
++	dreq.req.data_cb = dns_notify_cb;
++	dreq.cb = cb;
++	dreq.priv = priv;
++
++	return ubus_complete_request(ubus, &dreq.req.req, 100);
++}
++
+ void ubus_event_bcast(const char *type, const char *mac, const char *ip, const char *name, const char *interface)
+ {
+   struct ubus_context *ubus = (struct ubus_context *)daemon->ubus;