2011-02-19 08:50:15 +00:00
|
|
|
#
|
2016-02-26 09:13:03 +00:00
|
|
|
# Copyright (C) 2006-2016 OpenWrt.org
|
2006-06-27 00:35:46 +00:00
|
|
|
#
|
|
|
|
|
# This is free software, licensed under the GNU General Public License v2.
|
|
|
|
|
# See /LICENSE for more information.
|
|
|
|
|
#
|
2005-03-21 08:12:49 +00:00
|
|
|
|
2005-03-06 03:34:52 +00:00
|
|
|
include $(TOPDIR)/rules.mk
|
|
|
|
|
|
2005-03-06 03:53:29 +00:00
|
|
|
PKG_NAME:=dnsmasq
|
2021-09-15 20:15:33 +00:00
|
|
|
PKG_UPSTREAM_VERSION:=2.87
|
2019-02-17 12:04:40 +00:00
|
|
|
PKG_VERSION:=$(subst test,~~test,$(subst rc,~rc,$(PKG_UPSTREAM_VERSION)))
|
2021-01-01 12:47:11 +00:00
|
|
|
PKG_RELEASE:=$(AUTORELEASE)
|
2005-03-21 08:12:49 +00:00
|
|
|
|
2019-02-17 12:04:40 +00:00
|
|
|
PKG_SOURCE:=$(PKG_NAME)-$(PKG_UPSTREAM_VERSION).tar.xz
|
2021-09-15 20:15:33 +00:00
|
|
|
PKG_SOURCE_URL:=https://thekelleys.org.uk/dnsmasq/
|
|
|
|
|
PKG_HASH:=0228c0364a7f2356fd7e7f1549937cbf3099a78d3b2eb1ba5bb0c31e2b89de7a
|
2012-07-17 11:48:27 +00:00
|
|
|
|
2014-11-03 09:56:44 +00:00
|
|
|
PKG_LICENSE:=GPL-2.0
|
|
|
|
|
PKG_LICENSE_FILES:=COPYING
|
2017-09-28 02:55:46 +00:00
|
|
|
PKG_CPE_ID:=cpe:/a:thekelleys:dnsmasq
|
2012-10-19 15:34:28 +00:00
|
|
|
|
2019-02-17 12:04:40 +00:00
|
|
|
PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_UPSTREAM_VERSION)
|
2011-11-25 00:53:13 +00:00
|
|
|
|
|
|
|
|
PKG_INSTALL:=1
|
2012-09-15 11:36:58 +00:00
|
|
|
PKG_BUILD_PARALLEL:=1
|
2019-10-27 13:48:24 +00:00
|
|
|
PKG_ASLR_PIE_REGULAR:=1
|
2017-12-10 15:25:18 +00:00
|
|
|
PKG_CONFIG_DEPENDS:= CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dhcp \
|
|
|
|
|
CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dhcpv6 \
|
2015-01-05 13:03:48 +00:00
|
|
|
CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dnssec \
|
|
|
|
|
CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_auth \
|
2016-04-27 09:14:01 +00:00
|
|
|
CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_ipset \
|
dnsmasq: Support nftables nftsets
Add build option for nftables sets. By default disable iptables ipset
support. By default enable nftable nftset support since this is what
fw4 uses.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
dnsmasq: nftset: serve from ipset config
Use existing ipset configs as source for nftsets to be compatible with
existing configs. As the OS can either have iptables XOR nftables
support, it's fine to provide both to dnsmasq. dnsmasq will silently
fail for the present one. Depending on the dnsmasq compile time options,
the ipsets or nftsets option will not be added to the dnsmasq config
file.
dnsmasq will try to add the IP addresses to all sets, regardless of the
IP version defined for the set. Adding an IPv6 to an IPv4 set and vice
versa will silently fail.
Signed-off-by: Mathias Kresin <dev@kresin.me>
dnsmasq: support populating nftsets in addition to ipsets
Tell dnsmasq to populate nftsets instead of ipsets, if firewall4 is present in
the system. Keep the same configuration syntax in /etc/config/dhcp, for
compatibility purposes.
Huge thanks to Jo-Philipp Wich for basically writing the function.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
dnsmasq: obtain nftset ip family from nft
Unfortunately dnsmasq nft is noisy if an attempt to add a mismatched ip address
family to an nft set is made.
Heuristic to guess which ip family a nft set might belong by inferring
from the set name.
In order of preference:
If setname ends with standalone '4' or '6' use that, else
if setname has '4' or '6' delimited by '-' or '_' use that (eg
foo-4-bar) else
If setname begins with '4' or '6' standalone use that.
By standalone I mean not as part of a larger number eg. 24
If the above fails then use the existing nft set query mechanism and if
that fails, well you're stuffed!
With-thanks-to: Jo-Philipp Wich <jo@mein.io> who improved my regexp
knowledge.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
dnsmasq: specify firewall table for nftset
Permit ipsets to specify an nftables table for the set. New config
parameter is 'table'. If not specified the default of 'fw4' is used.
config ipset
list name 'BK_4,BK_6'
option table 'dscpclassify'
option table_family 'ip'
option family '4'
list domain 'ms-acdc.office.com'
list domain 'windowsupdate.com'
list domain 'update.microsoft.com'
list domain 'graph.microsoft.com'
list domain '1drv.ms'
list domain '1drv.com'
The table family can also be specified, usually 'ip' or 'ip6' else the
default 'inet' capable of both ipv4 & ipv6 is used.
If the table family is not specified then finally a family option is
available to specify either '4' or '6' for ipv4 or ipv6 respectively.
This is all in addition to the existing heuristic that will look in the
nftset name for an ip family clue, or in total desperation, query the
value from the nftset itself.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2021-11-29 17:16:39 +00:00
|
|
|
CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_nftset \
|
2016-06-29 12:29:48 +00:00
|
|
|
CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_conntrack \
|
2016-09-09 08:03:27 +00:00
|
|
|
CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_noid \
|
2019-01-07 01:52:43 +00:00
|
|
|
CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_broken_rtc \
|
|
|
|
|
CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_tftp
|
2005-03-06 03:34:52 +00:00
|
|
|
|
2006-06-21 02:32:39 +00:00
|
|
|
include $(INCLUDE_DIR)/package.mk
|
2005-03-06 03:53:29 +00:00
|
|
|
|
2012-07-17 11:48:27 +00:00
|
|
|
define Package/dnsmasq/Default
|
2006-09-23 13:41:42 +00:00
|
|
|
SECTION:=net
|
|
|
|
|
CATEGORY:=Base system
|
2014-06-18 10:04:34 +00:00
|
|
|
TITLE:=DNS and DHCP server
|
2006-09-23 13:41:42 +00:00
|
|
|
URL:=http://www.thekelleys.org.uk/dnsmasq/
|
2017-08-22 14:43:02 +00:00
|
|
|
DEPENDS:=+libubus
|
2016-04-26 11:44:10 +00:00
|
|
|
USERID:=dnsmasq=453:dnsmasq=453
|
2006-05-09 23:19:52 +00:00
|
|
|
endef
|
|
|
|
|
|
2012-07-17 11:48:27 +00:00
|
|
|
define Package/dnsmasq
|
|
|
|
|
$(call Package/dnsmasq/Default)
|
|
|
|
|
VARIANT:=nodhcpv6
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Package/dnsmasq-dhcpv6
|
|
|
|
|
$(call Package/dnsmasq/Default)
|
|
|
|
|
TITLE += (with DHCPv6 support)
|
2017-08-22 14:43:02 +00:00
|
|
|
DEPENDS+=@IPV6
|
2012-07-17 11:48:27 +00:00
|
|
|
VARIANT:=dhcpv6
|
2018-08-27 11:31:29 +00:00
|
|
|
PROVIDES:=dnsmasq
|
2012-07-17 11:48:27 +00:00
|
|
|
endef
|
|
|
|
|
|
2014-06-18 10:04:25 +00:00
|
|
|
define Package/dnsmasq-full
|
|
|
|
|
$(call Package/dnsmasq/Default)
|
dnsmasq: Support nftables nftsets
Add build option for nftables sets. By default disable iptables ipset
support. By default enable nftable nftset support since this is what
fw4 uses.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
dnsmasq: nftset: serve from ipset config
Use existing ipset configs as source for nftsets to be compatible with
existing configs. As the OS can either have iptables XOR nftables
support, it's fine to provide both to dnsmasq. dnsmasq will silently
fail for the present one. Depending on the dnsmasq compile time options,
the ipsets or nftsets option will not be added to the dnsmasq config
file.
dnsmasq will try to add the IP addresses to all sets, regardless of the
IP version defined for the set. Adding an IPv6 to an IPv4 set and vice
versa will silently fail.
Signed-off-by: Mathias Kresin <dev@kresin.me>
dnsmasq: support populating nftsets in addition to ipsets
Tell dnsmasq to populate nftsets instead of ipsets, if firewall4 is present in
the system. Keep the same configuration syntax in /etc/config/dhcp, for
compatibility purposes.
Huge thanks to Jo-Philipp Wich for basically writing the function.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
dnsmasq: obtain nftset ip family from nft
Unfortunately dnsmasq nft is noisy if an attempt to add a mismatched ip address
family to an nft set is made.
Heuristic to guess which ip family a nft set might belong by inferring
from the set name.
In order of preference:
If setname ends with standalone '4' or '6' use that, else
if setname has '4' or '6' delimited by '-' or '_' use that (eg
foo-4-bar) else
If setname begins with '4' or '6' standalone use that.
By standalone I mean not as part of a larger number eg. 24
If the above fails then use the existing nft set query mechanism and if
that fails, well you're stuffed!
With-thanks-to: Jo-Philipp Wich <jo@mein.io> who improved my regexp
knowledge.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
dnsmasq: specify firewall table for nftset
Permit ipsets to specify an nftables table for the set. New config
parameter is 'table'. If not specified the default of 'fw4' is used.
config ipset
list name 'BK_4,BK_6'
option table 'dscpclassify'
option table_family 'ip'
option family '4'
list domain 'ms-acdc.office.com'
list domain 'windowsupdate.com'
list domain 'update.microsoft.com'
list domain 'graph.microsoft.com'
list domain '1drv.ms'
list domain '1drv.com'
The table family can also be specified, usually 'ip' or 'ip6' else the
default 'inet' capable of both ipv4 & ipv6 is used.
If the table family is not specified then finally a family option is
available to specify either '4' or '6' for ipv4 or ipv6 respectively.
This is all in addition to the existing heuristic that will look in the
nftset name for an ip family clue, or in total desperation, query the
value from the nftset itself.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2021-11-29 17:16:39 +00:00
|
|
|
TITLE += (with DNSSEC, DHCPv6, Auth DNS, IPset, Nftset, Conntrack, NO_ID enabled by default)
|
2017-08-22 14:43:02 +00:00
|
|
|
DEPENDS+=+PACKAGE_dnsmasq_full_dnssec:libnettle \
|
2016-04-27 09:14:01 +00:00
|
|
|
+PACKAGE_dnsmasq_full_ipset:kmod-ipt-ipset \
|
dnsmasq: Support nftables nftsets
Add build option for nftables sets. By default disable iptables ipset
support. By default enable nftable nftset support since this is what
fw4 uses.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
dnsmasq: nftset: serve from ipset config
Use existing ipset configs as source for nftsets to be compatible with
existing configs. As the OS can either have iptables XOR nftables
support, it's fine to provide both to dnsmasq. dnsmasq will silently
fail for the present one. Depending on the dnsmasq compile time options,
the ipsets or nftsets option will not be added to the dnsmasq config
file.
dnsmasq will try to add the IP addresses to all sets, regardless of the
IP version defined for the set. Adding an IPv6 to an IPv4 set and vice
versa will silently fail.
Signed-off-by: Mathias Kresin <dev@kresin.me>
dnsmasq: support populating nftsets in addition to ipsets
Tell dnsmasq to populate nftsets instead of ipsets, if firewall4 is present in
the system. Keep the same configuration syntax in /etc/config/dhcp, for
compatibility purposes.
Huge thanks to Jo-Philipp Wich for basically writing the function.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
dnsmasq: obtain nftset ip family from nft
Unfortunately dnsmasq nft is noisy if an attempt to add a mismatched ip address
family to an nft set is made.
Heuristic to guess which ip family a nft set might belong by inferring
from the set name.
In order of preference:
If setname ends with standalone '4' or '6' use that, else
if setname has '4' or '6' delimited by '-' or '_' use that (eg
foo-4-bar) else
If setname begins with '4' or '6' standalone use that.
By standalone I mean not as part of a larger number eg. 24
If the above fails then use the existing nft set query mechanism and if
that fails, well you're stuffed!
With-thanks-to: Jo-Philipp Wich <jo@mein.io> who improved my regexp
knowledge.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
dnsmasq: specify firewall table for nftset
Permit ipsets to specify an nftables table for the set. New config
parameter is 'table'. If not specified the default of 'fw4' is used.
config ipset
list name 'BK_4,BK_6'
option table 'dscpclassify'
option table_family 'ip'
option family '4'
list domain 'ms-acdc.office.com'
list domain 'windowsupdate.com'
list domain 'update.microsoft.com'
list domain 'graph.microsoft.com'
list domain '1drv.ms'
list domain '1drv.com'
The table family can also be specified, usually 'ip' or 'ip6' else the
default 'inet' capable of both ipv4 & ipv6 is used.
If the table family is not specified then finally a family option is
available to specify either '4' or '6' for ipv4 or ipv6 respectively.
This is all in addition to the existing heuristic that will look in the
nftset name for an ip family clue, or in total desperation, query the
value from the nftset itself.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2021-11-29 17:16:39 +00:00
|
|
|
+PACKAGE_dnsmasq_full_conntrack:libnetfilter-conntrack \
|
|
|
|
|
+PACKAGE_dnsmasq_full_nftset:nftables-json
|
2014-06-18 10:04:25 +00:00
|
|
|
VARIANT:=full
|
2018-08-27 11:31:29 +00:00
|
|
|
PROVIDES:=dnsmasq
|
2014-06-18 10:04:25 +00:00
|
|
|
endef
|
|
|
|
|
|
2007-09-07 08:34:51 +00:00
|
|
|
define Package/dnsmasq/description
|
2011-09-30 12:55:23 +00:00
|
|
|
It is intended to provide coupled DNS and DHCP service to a LAN.
|
2007-09-07 08:34:51 +00:00
|
|
|
endef
|
|
|
|
|
|
2012-07-17 11:48:27 +00:00
|
|
|
define Package/dnsmasq-dhcpv6/description
|
|
|
|
|
$(call Package/dnsmasq/description)
|
|
|
|
|
|
|
|
|
|
This is a variant with DHCPv6 support
|
|
|
|
|
endef
|
|
|
|
|
|
2014-06-18 10:04:25 +00:00
|
|
|
define Package/dnsmasq-full/description
|
|
|
|
|
$(call Package/dnsmasq/description)
|
|
|
|
|
|
2017-12-10 15:25:18 +00:00
|
|
|
This is a fully configurable variant with DHCPv4, DHCPv6, DNSSEC, Authoritative DNS
|
dnsmasq: Support nftables nftsets
Add build option for nftables sets. By default disable iptables ipset
support. By default enable nftable nftset support since this is what
fw4 uses.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
dnsmasq: nftset: serve from ipset config
Use existing ipset configs as source for nftsets to be compatible with
existing configs. As the OS can either have iptables XOR nftables
support, it's fine to provide both to dnsmasq. dnsmasq will silently
fail for the present one. Depending on the dnsmasq compile time options,
the ipsets or nftsets option will not be added to the dnsmasq config
file.
dnsmasq will try to add the IP addresses to all sets, regardless of the
IP version defined for the set. Adding an IPv6 to an IPv4 set and vice
versa will silently fail.
Signed-off-by: Mathias Kresin <dev@kresin.me>
dnsmasq: support populating nftsets in addition to ipsets
Tell dnsmasq to populate nftsets instead of ipsets, if firewall4 is present in
the system. Keep the same configuration syntax in /etc/config/dhcp, for
compatibility purposes.
Huge thanks to Jo-Philipp Wich for basically writing the function.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
dnsmasq: obtain nftset ip family from nft
Unfortunately dnsmasq nft is noisy if an attempt to add a mismatched ip address
family to an nft set is made.
Heuristic to guess which ip family a nft set might belong by inferring
from the set name.
In order of preference:
If setname ends with standalone '4' or '6' use that, else
if setname has '4' or '6' delimited by '-' or '_' use that (eg
foo-4-bar) else
If setname begins with '4' or '6' standalone use that.
By standalone I mean not as part of a larger number eg. 24
If the above fails then use the existing nft set query mechanism and if
that fails, well you're stuffed!
With-thanks-to: Jo-Philipp Wich <jo@mein.io> who improved my regexp
knowledge.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
dnsmasq: specify firewall table for nftset
Permit ipsets to specify an nftables table for the set. New config
parameter is 'table'. If not specified the default of 'fw4' is used.
config ipset
list name 'BK_4,BK_6'
option table 'dscpclassify'
option table_family 'ip'
option family '4'
list domain 'ms-acdc.office.com'
list domain 'windowsupdate.com'
list domain 'update.microsoft.com'
list domain 'graph.microsoft.com'
list domain '1drv.ms'
list domain '1drv.com'
The table family can also be specified, usually 'ip' or 'ip6' else the
default 'inet' capable of both ipv4 & ipv6 is used.
If the table family is not specified then finally a family option is
available to specify either '4' or '6' for ipv4 or ipv6 respectively.
This is all in addition to the existing heuristic that will look in the
nftset name for an ip family clue, or in total desperation, query the
value from the nftset itself.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2021-11-29 17:16:39 +00:00
|
|
|
and nftset, Conntrack support & NO_ID enabled by default.
|
2014-06-18 10:04:25 +00:00
|
|
|
endef
|
|
|
|
|
|
2009-02-03 22:27:44 +00:00
|
|
|
define Package/dnsmasq/conffiles
|
|
|
|
|
/etc/config/dhcp
|
2009-09-21 13:25:11 +00:00
|
|
|
/etc/dnsmasq.conf
|
2020-04-24 13:43:49 +00:00
|
|
|
/etc/dnsmasq.d/
|
2009-02-03 22:27:44 +00:00
|
|
|
endef
|
|
|
|
|
|
2015-01-05 13:03:48 +00:00
|
|
|
define Package/dnsmasq-full/config
|
|
|
|
|
if PACKAGE_dnsmasq-full
|
2017-12-10 15:25:18 +00:00
|
|
|
config PACKAGE_dnsmasq_full_dhcp
|
|
|
|
|
bool "Build with DHCP support."
|
|
|
|
|
default y
|
2015-01-05 13:03:48 +00:00
|
|
|
config PACKAGE_dnsmasq_full_dhcpv6
|
|
|
|
|
bool "Build with DHCPv6 support."
|
2017-12-10 15:25:18 +00:00
|
|
|
depends on IPV6 && PACKAGE_dnsmasq_full_dhcp
|
2015-01-05 13:03:48 +00:00
|
|
|
default y
|
|
|
|
|
config PACKAGE_dnsmasq_full_dnssec
|
|
|
|
|
bool "Build with DNSSEC support."
|
|
|
|
|
default y
|
|
|
|
|
config PACKAGE_dnsmasq_full_auth
|
|
|
|
|
bool "Build with the facility to act as an authoritative DNS server."
|
|
|
|
|
default y
|
|
|
|
|
config PACKAGE_dnsmasq_full_ipset
|
|
|
|
|
bool "Build with IPset support."
|
dnsmasq: Support nftables nftsets
Add build option for nftables sets. By default disable iptables ipset
support. By default enable nftable nftset support since this is what
fw4 uses.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
dnsmasq: nftset: serve from ipset config
Use existing ipset configs as source for nftsets to be compatible with
existing configs. As the OS can either have iptables XOR nftables
support, it's fine to provide both to dnsmasq. dnsmasq will silently
fail for the present one. Depending on the dnsmasq compile time options,
the ipsets or nftsets option will not be added to the dnsmasq config
file.
dnsmasq will try to add the IP addresses to all sets, regardless of the
IP version defined for the set. Adding an IPv6 to an IPv4 set and vice
versa will silently fail.
Signed-off-by: Mathias Kresin <dev@kresin.me>
dnsmasq: support populating nftsets in addition to ipsets
Tell dnsmasq to populate nftsets instead of ipsets, if firewall4 is present in
the system. Keep the same configuration syntax in /etc/config/dhcp, for
compatibility purposes.
Huge thanks to Jo-Philipp Wich for basically writing the function.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
dnsmasq: obtain nftset ip family from nft
Unfortunately dnsmasq nft is noisy if an attempt to add a mismatched ip address
family to an nft set is made.
Heuristic to guess which ip family a nft set might belong by inferring
from the set name.
In order of preference:
If setname ends with standalone '4' or '6' use that, else
if setname has '4' or '6' delimited by '-' or '_' use that (eg
foo-4-bar) else
If setname begins with '4' or '6' standalone use that.
By standalone I mean not as part of a larger number eg. 24
If the above fails then use the existing nft set query mechanism and if
that fails, well you're stuffed!
With-thanks-to: Jo-Philipp Wich <jo@mein.io> who improved my regexp
knowledge.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
dnsmasq: specify firewall table for nftset
Permit ipsets to specify an nftables table for the set. New config
parameter is 'table'. If not specified the default of 'fw4' is used.
config ipset
list name 'BK_4,BK_6'
option table 'dscpclassify'
option table_family 'ip'
option family '4'
list domain 'ms-acdc.office.com'
list domain 'windowsupdate.com'
list domain 'update.microsoft.com'
list domain 'graph.microsoft.com'
list domain '1drv.ms'
list domain '1drv.com'
The table family can also be specified, usually 'ip' or 'ip6' else the
default 'inet' capable of both ipv4 & ipv6 is used.
If the table family is not specified then finally a family option is
available to specify either '4' or '6' for ipv4 or ipv6 respectively.
This is all in addition to the existing heuristic that will look in the
nftset name for an ip family clue, or in total desperation, query the
value from the nftset itself.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2021-11-29 17:16:39 +00:00
|
|
|
default n
|
|
|
|
|
config PACKAGE_dnsmasq_full_nftset
|
|
|
|
|
bool "Build with Nftset support."
|
2015-01-05 13:03:48 +00:00
|
|
|
default y
|
2016-04-27 09:14:01 +00:00
|
|
|
config PACKAGE_dnsmasq_full_conntrack
|
|
|
|
|
bool "Build with Conntrack support."
|
|
|
|
|
default y
|
2016-09-09 08:03:27 +00:00
|
|
|
config PACKAGE_dnsmasq_full_noid
|
|
|
|
|
bool "Build with NO_ID. (hide *.bind pseudo domain)"
|
|
|
|
|
default y
|
2016-06-29 12:29:48 +00:00
|
|
|
config PACKAGE_dnsmasq_full_broken_rtc
|
|
|
|
|
bool "Build with HAVE_BROKEN_RTC."
|
|
|
|
|
default n
|
2019-01-07 01:52:43 +00:00
|
|
|
config PACKAGE_dnsmasq_full_tftp
|
|
|
|
|
bool "Build with TFTP server support."
|
|
|
|
|
default y
|
2015-01-05 13:03:48 +00:00
|
|
|
endif
|
2014-12-17 05:59:12 +00:00
|
|
|
endef
|
|
|
|
|
|
2012-07-17 11:48:27 +00:00
|
|
|
Package/dnsmasq-dhcpv6/conffiles = $(Package/dnsmasq/conffiles)
|
2014-06-18 10:04:25 +00:00
|
|
|
Package/dnsmasq-full/conffiles = $(Package/dnsmasq/conffiles)
|
2012-07-17 11:48:27 +00:00
|
|
|
|
2019-10-27 20:17:39 +00:00
|
|
|
TARGET_CFLAGS += -flto
|
|
|
|
|
TARGET_LDFLAGS += -flto=jobserver
|
2014-06-18 10:04:02 +00:00
|
|
|
|
2019-03-09 08:40:57 +00:00
|
|
|
COPTS = -DHAVE_UBUS -DHAVE_POLL_H \
|
2018-09-05 13:39:39 +00:00
|
|
|
$(if $(CONFIG_IPV6),,-DNO_IPV6)
|
2011-03-02 12:47:57 +00:00
|
|
|
|
2012-07-17 11:48:27 +00:00
|
|
|
ifeq ($(BUILD_VARIANT),nodhcpv6)
|
2014-06-18 10:04:02 +00:00
|
|
|
COPTS += -DNO_DHCP6
|
2012-07-17 11:48:27 +00:00
|
|
|
endif
|
|
|
|
|
|
2014-06-18 10:04:25 +00:00
|
|
|
ifeq ($(BUILD_VARIANT),full)
|
2017-12-10 15:25:18 +00:00
|
|
|
COPTS += $(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dhcp),,-DNO_DHCP) \
|
|
|
|
|
$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dhcpv6),,-DNO_DHCP6) \
|
2014-12-17 05:59:12 +00:00
|
|
|
$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dnssec),-DHAVE_DNSSEC) \
|
|
|
|
|
$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_auth),,-DNO_AUTH) \
|
2016-04-27 09:14:01 +00:00
|
|
|
$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_ipset),,-DNO_IPSET) \
|
dnsmasq: Support nftables nftsets
Add build option for nftables sets. By default disable iptables ipset
support. By default enable nftable nftset support since this is what
fw4 uses.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
dnsmasq: nftset: serve from ipset config
Use existing ipset configs as source for nftsets to be compatible with
existing configs. As the OS can either have iptables XOR nftables
support, it's fine to provide both to dnsmasq. dnsmasq will silently
fail for the present one. Depending on the dnsmasq compile time options,
the ipsets or nftsets option will not be added to the dnsmasq config
file.
dnsmasq will try to add the IP addresses to all sets, regardless of the
IP version defined for the set. Adding an IPv6 to an IPv4 set and vice
versa will silently fail.
Signed-off-by: Mathias Kresin <dev@kresin.me>
dnsmasq: support populating nftsets in addition to ipsets
Tell dnsmasq to populate nftsets instead of ipsets, if firewall4 is present in
the system. Keep the same configuration syntax in /etc/config/dhcp, for
compatibility purposes.
Huge thanks to Jo-Philipp Wich for basically writing the function.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
dnsmasq: obtain nftset ip family from nft
Unfortunately dnsmasq nft is noisy if an attempt to add a mismatched ip address
family to an nft set is made.
Heuristic to guess which ip family a nft set might belong by inferring
from the set name.
In order of preference:
If setname ends with standalone '4' or '6' use that, else
if setname has '4' or '6' delimited by '-' or '_' use that (eg
foo-4-bar) else
If setname begins with '4' or '6' standalone use that.
By standalone I mean not as part of a larger number eg. 24
If the above fails then use the existing nft set query mechanism and if
that fails, well you're stuffed!
With-thanks-to: Jo-Philipp Wich <jo@mein.io> who improved my regexp
knowledge.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
dnsmasq: specify firewall table for nftset
Permit ipsets to specify an nftables table for the set. New config
parameter is 'table'. If not specified the default of 'fw4' is used.
config ipset
list name 'BK_4,BK_6'
option table 'dscpclassify'
option table_family 'ip'
option family '4'
list domain 'ms-acdc.office.com'
list domain 'windowsupdate.com'
list domain 'update.microsoft.com'
list domain 'graph.microsoft.com'
list domain '1drv.ms'
list domain '1drv.com'
The table family can also be specified, usually 'ip' or 'ip6' else the
default 'inet' capable of both ipv4 & ipv6 is used.
If the table family is not specified then finally a family option is
available to specify either '4' or '6' for ipv4 or ipv6 respectively.
This is all in addition to the existing heuristic that will look in the
nftset name for an ip family clue, or in total desperation, query the
value from the nftset itself.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2021-11-29 17:16:39 +00:00
|
|
|
$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_nftset),-DHAVE_NFTSET,) \
|
2016-06-29 12:29:48 +00:00
|
|
|
$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_conntrack),-DHAVE_CONNTRACK,) \
|
2016-09-09 08:03:27 +00:00
|
|
|
$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_noid),-DNO_ID,) \
|
2019-01-07 01:52:43 +00:00
|
|
|
$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_broken_rtc),-DHAVE_BROKEN_RTC) \
|
|
|
|
|
$(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_tftp),,-DNO_TFTP)
|
2014-06-18 10:04:25 +00:00
|
|
|
COPTS += $(if $(CONFIG_LIBNETTLE_MINI),-DNO_GMP,)
|
2014-06-18 10:04:34 +00:00
|
|
|
else
|
2016-09-09 08:03:27 +00:00
|
|
|
COPTS += -DNO_AUTH -DNO_IPSET -DNO_ID
|
2014-06-18 10:04:25 +00:00
|
|
|
endif
|
|
|
|
|
|
2011-11-25 00:53:13 +00:00
|
|
|
MAKE_FLAGS := \
|
|
|
|
|
$(TARGET_CONFIGURE_OPTS) \
|
2017-09-16 23:27:37 +00:00
|
|
|
CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \
|
2014-06-18 10:04:17 +00:00
|
|
|
LDFLAGS="$(TARGET_LDFLAGS)" \
|
2014-06-18 10:04:02 +00:00
|
|
|
COPTS="$(COPTS)" \
|
2011-11-25 00:53:13 +00:00
|
|
|
PREFIX="/usr"
|
2006-06-18 18:27:23 +00:00
|
|
|
|
2006-05-09 23:19:52 +00:00
|
|
|
define Package/dnsmasq/install
|
2006-11-23 00:29:07 +00:00
|
|
|
$(INSTALL_DIR) $(1)/usr/sbin
|
2011-11-25 00:53:13 +00:00
|
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/dnsmasq $(1)/usr/sbin/
|
2007-03-17 13:31:13 +00:00
|
|
|
$(INSTALL_DIR) $(1)/etc/config
|
2018-10-11 08:46:42 +00:00
|
|
|
$(INSTALL_CONF) ./files/dhcp.conf $(1)/etc/config/dhcp
|
|
|
|
|
$(INSTALL_CONF) ./files/dnsmasq.conf $(1)/etc/dnsmasq.conf
|
2006-11-23 00:29:07 +00:00
|
|
|
$(INSTALL_DIR) $(1)/etc/init.d
|
|
|
|
|
$(INSTALL_BIN) ./files/dnsmasq.init $(1)/etc/init.d/dnsmasq
|
2017-05-06 10:56:26 +00:00
|
|
|
$(INSTALL_DIR) $(1)/etc/hotplug.d/dhcp
|
|
|
|
|
$(INSTALL_DIR) $(1)/etc/hotplug.d/neigh
|
2016-06-14 10:00:21 +00:00
|
|
|
$(INSTALL_DIR) $(1)/etc/hotplug.d/ntp
|
2017-05-06 10:56:26 +00:00
|
|
|
$(INSTALL_DIR) $(1)/etc/hotplug.d/tftp
|
2020-10-28 01:56:16 +00:00
|
|
|
$(INSTALL_DATA) ./files/dnsmasqsec.hotplug $(1)/etc/hotplug.d/ntp/25-dnsmasqsec
|
2017-02-20 10:15:55 +00:00
|
|
|
$(INSTALL_DIR) $(1)/usr/share/dnsmasq
|
2018-10-11 08:46:42 +00:00
|
|
|
$(INSTALL_CONF) ./files/dhcpbogushostname.conf $(1)/usr/share/dnsmasq/
|
|
|
|
|
$(INSTALL_CONF) ./files/rfc6761.conf $(1)/usr/share/dnsmasq/
|
2017-05-06 10:56:26 +00:00
|
|
|
$(INSTALL_DIR) $(1)/usr/lib/dnsmasq
|
|
|
|
|
$(INSTALL_BIN) ./files/dhcp-script.sh $(1)/usr/lib/dnsmasq/dhcp-script.sh
|
2017-08-22 14:43:02 +00:00
|
|
|
$(INSTALL_DIR) $(1)/usr/share/acl.d
|
|
|
|
|
$(INSTALL_DATA) ./files/dnsmasq_acl.json $(1)/usr/share/acl.d/
|
2020-01-09 13:32:12 +00:00
|
|
|
$(INSTALL_DIR) $(1)/etc/uci-defaults
|
|
|
|
|
$(INSTALL_BIN) ./files/50-dnsmasq-migrate-resolv-conf-auto.sh $(1)/etc/uci-defaults
|
2022-05-04 19:50:41 +00:00
|
|
|
$(INSTALL_BIN) ./files/50-dnsmasq-migrate-ipset.sh $(1)/etc/uci-defaults
|
2006-05-09 23:19:52 +00:00
|
|
|
endef
|
2005-05-12 19:41:18 +00:00
|
|
|
|
2012-07-17 11:48:27 +00:00
|
|
|
Package/dnsmasq-dhcpv6/install = $(Package/dnsmasq/install)
|
|
|
|
|
|
2014-06-18 10:04:25 +00:00
|
|
|
define Package/dnsmasq-full/install
|
|
|
|
|
$(call Package/dnsmasq/install,$(1))
|
2015-01-05 13:03:48 +00:00
|
|
|
ifneq ($(CONFIG_PACKAGE_dnsmasq_full_dnssec),)
|
2014-06-18 10:04:25 +00:00
|
|
|
$(INSTALL_DIR) $(1)/usr/share/dnsmasq
|
2018-10-11 08:46:42 +00:00
|
|
|
$(INSTALL_CONF) $(PKG_BUILD_DIR)/trust-anchors.conf $(1)/usr/share/dnsmasq
|
2015-01-05 13:03:48 +00:00
|
|
|
endif
|
2014-06-18 10:04:25 +00:00
|
|
|
endef
|
|
|
|
|
|
2006-05-09 23:19:52 +00:00
|
|
|
$(eval $(call BuildPackage,dnsmasq))
|
2012-07-17 11:48:27 +00:00
|
|
|
$(eval $(call BuildPackage,dnsmasq-dhcpv6))
|
2014-06-18 10:04:25 +00:00
|
|
|
$(eval $(call BuildPackage,dnsmasq-full))
|
