Man page update.

Also remove unused "isloop" field.

CHANGELOG

@@ -1,18 +1,61 @@
+version 2.63
+            Do duplicate dhcp-host address check in --test mode.
+
+	    Check that tftp-root directories are accessible before
+	    start-up. Thanks to Daniel Veillard for the initial patch.
+
+	    Allow more than one --tfp-root flag. The per-interface
+	    stuff is pointless without that.
+
+	    Add --bind-dynamic. A hybrid mode between the default and
+	    --bind-interfaces which copes with dynamically created
+	    interfaces. 
+
+
+version 2.62
+            Update German translation. Thanks to Conrad Kostecki.
+
+	    Cope with router-solict packets wich don't have a valid 
+	    source address. Thanks to Vladislav Grishenko for the patch.
+
+	    Fixed bug which caused missing periodic router
+	    advertisements with some configurations. Thanks to
+	    Vladislav Grishenko for the patch.
+
+	    Fixed bug which broke DHCPv6/RA with prefix lengths 
+	    which are not divisible by 8. Thanks to Andre Coetzee 
+	    for spotting this.
+
+	    Fix non-response to router-solicitations when
+	    router-advertisement configured, but DHCPv6 not
+	    configured. Thanks to Marien Zwart for the patch.
+
+	    Add --dns-rr, to allow arbitrary DNS resource records.
+
+	    Fixed bug which broke RA scheduling when an interface had
+	    two addresses in the same network. Thanks to Jim Bos for
+	    his help nailing this.
+
+
 version 2.61
 	    Re-write interface discovery code on *BSD to use
 	    getifaddrs. This is more portable, more straightforward,
 	    and allows us to find the prefix length for IPv6
 	    addresses.
 
-	    Add ra-names DHCPv6 keyword which adds AAAA records
-	    for dual-stack hosts which get IPv6 addresses via SLAAC.
+	    Add ra-names, ra-stateless and slaac keywords for DHCPv6.
+	    Dnsmasq can now synthesise AAAA records for dual-stack 
+            hosts which get IPv6 addresses via SLAAC. It is also now 
+	    possible to use SLAAC and stateless DHCPv6, and to 
+	    tell clients to use SLAAC addresses as well as DHCP ones.
+	    Thanks to Dave Taht for help with this.
 
 	    Add --dhcp-duid to allow DUID-EN uids to be used.
 
 	    Explicity send DHCPv6 replies to the correct port, instead
 	    of relying on clients to send requests with the correct
 	    source address, since at least one client in the wild gets
-	    this wrong. Thanks to Conrda Kostecki for help tracking
+	    this wrong. Thanks to Conrad Kostecki for help tracking
 	    this down.
 
 	    Send a preference value of 255 in DHCPv6 replies when 
@@ -55,7 +98,52 @@ version 2.61
 	    received from a network which has no valid dhcp-range.
 	    Thanks to Stephane Glondu for the bug report.
 
- 
+	    Add a new DHCP lease time keyword, "deprecated" for
+	    --dhcp-range. This is only valid for IPv6, and sets the
+	    preffered lease time for both DHCP and RA to zero. The
+	    effect is that clients can continue to use the address 
+	    for existing connections, but new connections will use
+            other addresses, if they exist. This makes hitless
+	    renumbering at least possible.
+
+	    Fix bug in address6_available() which caused DHCPv6 lease
+	    aquisition to fail if more than one dhcp-range in use.
+
+	    Provide RDNSS and DNSSL data in router advertisements,
+	    using the settings provided for DHCP options
+	    option6:domain-search and option6:dns-server.
+
+	    Tweak logo/favicon.ico to add some transparency. Thanks to
+	    SamLT for work on this.
+	    
+	    Don't cache data from non-recursive nameservers, since it
+	    may erroneously look like a valid CNAME to a non-exitant
+	    name. Thanks to Ben Winslow for finding this.
+
+	    Call SO_BINDTODEVICE on the DHCP socket(s) when doing DHCP
+	    on exactly one interface and --bind-interfaces is set. This 
+	    makes the OpenStack use-case of one dnsmasq per virtual
+	    interface work. This is only available on Linux; it's not
+	    supported on other platforms. Thanks to Vishvananda Ishaya
+	    and the OpenStack team for the suggestion.
+
+	    Updated French translation. Thanks to Gildas Le Nadan.
+
+	    Give correct from-cache answers to explict CNAME queries.
+	    Thanks to Rob Zwissler for spotting this.
+	    
+	    Add --tftp-lowercase option. Thanks to Oliver Rath for the
+	    patch. 
+
+	    Ensure that the DBus DhcpLeaseUpdated events are generated
+	    when a lease goes through INIT_REBOOT state, even if the
+	    dhcp-script is not in use. Thanks to Antoaneta-Ecaterina
+	    Ene for the patch.
+
+	    Fix failure of TFTP over IPv4 on OpenBSD platform. Thanks
+	    to Brad Smith for spotting this.
+	    
+
 version 2.60
             Fix compilation problem in Mac OS X Lion. Thanks to Olaf
             Flebbe for the patch.

bld/get-version

@@ -18,7 +18,7 @@ else
      vers=`cat $1/VERSION | sed 's/[(), ]/,/ g' | tr ',' '\n' | grep $v[0-9]`
 
      if [ $? -eq 0 ]; then
-         echo "${vers}" | head -n 1 | tail -c +2
+         echo "${vers}" | head -n 1 | sed 's/^v//'
      else
          cat $1/VERSION
      fi

contrib/systemd/dbus_activation

@@ -0,0 +1,57 @@
+To: dnsmasq-discuss@lists.thekelleys.org.uk
+From: Alex Elsayed <eternaleye+usenet@gmail.com>
+Date: Tue, 15 May 2012 01:53:54 -0700
+Subject: [Dnsmasq-discuss] [PATCH] Support dbus activation
+
+Introduce dbus service file and turn dbus on in the systemd
+unit.
+
+Note to packagers:
+To add support for dbus activation, you must install the dbus
+service file (dbus/uk.org.thekelleys.dnsmasq.service) into
+$DATADIR/dbus-1/system-services.
+
+---
+ contrib/systemd/dnsmasq.service        |    2 +-
+ dbus/uk.org.thekelleys.dnsmasq.service |    7 +++++++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+ create mode 100644 dbus/uk.org.thekelleys.dnsmasq.service
+
+diff --git a/contrib/systemd/dnsmasq.service 
+b/contrib/systemd/dnsmasq.service
+index a27fe6d..4a784d3 100644
+--- a/contrib/systemd/dnsmasq.service
++++ b/contrib/systemd/dnsmasq.service
+@@ -5,7 +5,7 @@ Description=A lightweight DHCP and caching DNS server
+ Type=dbus
+ BusName=uk.org.thekelleys.dnsmasq
+ ExecStartPre=/usr/sbin/dnsmasq --test
+-ExecStart=/usr/sbin/dnsmasq -k
++ExecStart=/usr/sbin/dnsmasq -k -1
+ ExecReload=/bin/kill -HUP $MAINPID
+ 
+ [Install]
+diff --git a/dbus/uk.org.thekelleys.dnsmasq.service 
+b/dbus/uk.org.thekelleys.dnsmasq.service
+new file mode 100644
+index 0000000..f5fe98d
+--- /dev/null
++++ b/dbus/uk.org.thekelleys.dnsmasq.service
+@@ -0,0 +1,7 @@
++[D-BUS Service]
++Name=uk.org.thekelleys.dnsmasq
++Exec=/usr/sbin/dnsmasq -k -1
++User=root
++SystemdService=dnsmasq.service
++
++
+-- 
+1.7.10.2
+
+
+
+_______________________________________________
+Dnsmasq-discuss mailing list
+Dnsmasq-discuss@lists.thekelleys.org.uk
+http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
+

debian/changelog

@@ -1,10 +1,37 @@
+dnsmasq (2.63-1) unstable; urgency=low
+
+   * New upstream.
+
+ -- Simon Kelley <simon@thekelleys.org.uk>  Mon, 11 Jun 2012 21:55:35 +0000
+
+dnsmasq (2.62-3) unstable; urgency=low
+
+   * Do resolvconf and /etc/default startup logic when
+     starting with systemd. (closes: #675854)
+
+ -- Simon Kelley <simon@thekelleys.org.uk>  Mon, 11 Jun 2012 21:50:11 +0000
+
+dnsmasq (2.62-2) unstable; urgency=low
+
+   * Pass LDFLAGS to make to get hardening in linker.
+
+ -- Simon Kelley <simon@thekelleys.org.uk>  Thu, 7 Jun 2012 09:53:43 +0000
+
+dnsmasq (2.62-1) unstable; urgency=low
+
+   * New upstream.
+   * Use dpkg-buildflags. (Enables hardening).
+
+ -- Simon Kelley <simon@thekelleys.org.uk>  Sat, 12 May 2012 15:25:23 +0000
+
 dnsmasq (2.61-1) unstable; urgency=low
 
    * New upstream.
    * Provide "dump-stats" initscript method. (closes: #654656)
    * Add (empty) build-indep and build-arch rules targets.
    * Bump standards-version to 3.9.3
-	
+   * Add port option to example dnsmasq.conf (closes: #668386)
+
  -- Simon Kelley <simon@thekelleys.org.uk>  Tue, 6 Mar 2012 19:45:43 +0000
 
 dnsmasq (2.60-2) unstable; urgency=high

debian/init

@@ -259,6 +259,27 @@ case "$1" in
   dump-stats)
         kill -s USR1 `cat /var/run/dnsmasq/$NAME.pid`
 	;;
+  systemd-start-resolvconf)
+	start_resolvconf
+	;;
+  systemd-stop-resolvconf)
+	stop_resolvconf
+	;;
+  systemd-exec)
+#  --pid-file without argument disables writing a PIDfile, we don't need one with sytemd.
+# Enable DBus by default because we use DBus activation with systemd.
+	exec $DAEMON --keep-in-foreground --pid-file --enable-dbus \
+	    ${MAILHOSTNAME:+ -m $MAILHOSTNAME} \
+	    ${MAILTARGET:+ -t $MAILTARGET} \
+	    ${DNSMASQ_USER:+ -u $DNSMASQ_USER} \
+	    ${DNSMASQ_INTERFACES:+ $DNSMASQ_INTERFACES} \
+	    ${DHCP_LEASE:+ -l $DHCP_LEASE} \
+	    ${DOMAIN_SUFFIX:+ -s $DOMAIN_SUFFIX} \
+	    ${RESOLV_CONF:+ -r $RESOLV_CONF} \
+	    ${CACHESIZE:+ -c $CACHESIZE} \
+	    ${CONFIG_DIR:+ -7 $CONFIG_DIR} \
+	    ${DNSMASQ_OPTS:+ $DNSMASQ_OPTS} 
+	;;
   *)
 	echo "Usage: /etc/init.d/$NAME {start|stop|restart|force-reload|dump-stats|status}" >&2
 	exit 3

debian/rules

@@ -11,14 +11,14 @@
 
 package=dnsmasq-base
 
-# policy manual, section 10.1
-ifneq (,$(filter noopt,$(DEB_BUILD_OPTIONS)))
-     CFLAGS = -g -O0 -Wall -W
-else
-     CFLAGS = -g -O2 -Wall -W
-endif
+CFLAGS = $(shell export DEB_BUILD_OPTIONS=$(DEB_BUILD_OPTIONS); dpkg-buildflags --get CFLAGS)
+CFLAGS += $(shell dpkg-buildflags --get CPPFLAGS)
+CFLAGS += -Wall -W
+
+LDFLAGS = $(shell dpkg-buildflags --get LDFLAGS)
 
 COPTS = 
+
 TARGET = install-i18n
 
 DEB_BUILD_ARCH_OS := $(shell dpkg-architecture -qDEB_BUILD_ARCH_OS)
@@ -115,7 +115,7 @@ binary-arch:	checkroot
 		-d debian/base/usr/share/doc/$(package)/examples \
 	        -d debian/base/var/run \
 	        -d debian/base/var/lib/misc
-	make $(TARGET) PREFIX=/usr DESTDIR=`pwd`/debian/base CFLAGS="$(CFLAGS)" COPTS="$(COPTS)" CC=gcc
+	make $(TARGET) PREFIX=/usr DESTDIR=`pwd`/debian/base CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" COPTS="$(COPTS)" CC=gcc
 ifeq (,$(findstring nodocs,$(DEB_BUILD_OPTIONS)))
 	install -m 644 doc.html debian/base/usr/share/doc/$(package)/.
 	install -m 644 setup.html debian/base/usr/share/doc/$(package)/.
@@ -155,7 +155,7 @@ ifeq ($(DEB_BUILD_ARCH_OS),linux)
                        -d debian/utils/usr/share/man/man1 \
 	               -d debian/utils/usr/bin \
                        -d debian/utils/usr/share/doc/dnsmasq-utils
-	make -C contrib/wrt PREFIX=/usr DESTDIR=`pwd`/debian/utils CFLAGS="$(CFLAGS)" COPTS="$(COPTS)" CC=gcc
+	make -C contrib/wrt PREFIX=/usr DESTDIR=`pwd`/debian/utils CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" COPTS="$(COPTS)" CC=gcc
 	install -m 755 contrib/wrt/dhcp_release debian/utils/usr/bin/dhcp_release
 	install -m 644 contrib/wrt/dhcp_release.1 debian/utils/usr/share/man/man1/dhcp_release.1
 	gzip -9 debian/utils/usr/share/man/man1/dhcp_release.1

debian/systemd.service

@@ -8,22 +8,24 @@ BusName=uk.org.thekelleys.dnsmasq
 # Test the config file and refuse starting if it is not valid.
 ExecStartPre=/usr/sbin/dnsmasq --test
 
-# Enable DBus by default because we use DBus activation.
+# We run dnsmasq via the /etc/init.d/dnsmasq script which acts as a
+# wrapper picking up extra configuration files and then execs dnsmasq
+# itself, when called with the "systemd-exec" function.
 #
-# Drop privileges and become the 'dnsmasq' user. It is recommended by dnsmasq
-# upstream to run dnsmasq as an isolated user that does not run any other
-# processes, owns no files and has no shell. The default 'nobody' user has a
-# shell and might be used for other processes.
+# It also adds the command-line flags
+#    --keep-in-foreground --pid-file --enable-dbus 
+# to disable writing a pid-file (not needed with systemd) and 
+# enable DBus by default because we use DBus activation.
 #
-# Debian-specific: add /etc/dnsmasq.d to config search path (with the exception
-# of .dpkg-*). Packages such as libvirt leave config files there.
-#
-# --pid-file without argument disables writing a PIDfile, we don't need one.
-ExecStart=/usr/sbin/dnsmasq -k \
-          --enable-dbus \
-          --user=dnsmasq \
-          -7 /etc/dnsmasq.d,.dpkg-dist,.dpkg-old,.dpkg-new \
-          --pid-file
+ExecStart=/etc/init.d/dnsmasq systemd-exec
+
+# The systemd-*-resolvconf functions configure (and deconfigure)
+# resolvconf to work with the dnsmasq DNS server. They're called liek
+# this to get correct error handling (ie don't start-resolvconf if the 
+# dnsmasq daemon fails to start.
+ExecStartPost=/etc/init.d/dnsmasq systemd-start-resolvconf
+ExecStop=/etc/init.d/dnsmasq systemd-stop-resolvconf
+
 
 ExecReload=/bin/kill -HUP $MAINPID
 

dnsmasq.conf.example

@@ -4,6 +4,11 @@
 # as the long options legal on the command line. See
 # "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details.
 
+# Listen on this specific port instead of the standard DNS port
+# (53). Setting this to zero completely disables DNS function,
+# leaving only DHCP and/or TFTP.
+#port=5353
+
 # The following two options make you a better netizen, since they
 # tell dnsmasq to filter out queries which the public DNS cannot
 # answer, and which load the servers (especially the root servers)
@@ -169,14 +174,32 @@
 # hosts. Use the DHCPv4 lease to derive the name, network segment and 
 # MAC address and assume that the host will also have an
 # IPv6 address calculated using the SLAAC alogrithm.
-# This will generate an erroneous AAAA record if a host is using privacy 
-# extensions or does not support IPv6. Use with care.
 #dhcp-range=1234::, ra-names
 
 # Do Router Advertisements, BUT NOT DHCP for this subnet.
 # Set the lifetime to 46 hours. (Note: minimum lifetime is 2 hours.)
 #dhcp-range=1234::, ra-only, 48h
 
+# Do DHCP and Router Advertisements for this subnet. Set the A bit in the RA
+# so that clients can use SLAAC addresses as well as DHCP ones.
+#dhcp-range=1234::2, 1234::500, slaac
+
+# Do Router Advertisements and stateless DHCP for this subnet. Clients will
+# not get addresses from DHCP, but they will get other configuration information.
+# They will use SLAAC for addresses.
+#dhcp-range=1234::, ra-stateless
+
+# Do stateless DHCP, SLAAC, and generate DNS names for SLAAC addresses
+# from DHCPv4 leases.
+#dhcp-range=1234::, ra-stateless, ra-names
+
+# Do router advertisements for all subnets where we're doing DHCPv6
+# Unless overriden by ra-stateless, ra-names, et al, the router 
+# advertisements will have the M and O bits set, so that the clients
+# get addresses and configuration from DHCPv6, and the A bit reset, so the 
+# clients don't use SLAAC addresses.
+#enable-ra
+
 # Supply parameters for specified hosts using DHCP. There are lots
 # of valid alternatives, so we will give examples of each. Note that
 # IP addresses DO NOT have to be in the range given above, they just

man/dnsmasq.8

@@ -23,7 +23,7 @@ options. It includes a secure, read-only,
 TFTP server to allow net/PXE boot of DHCP hosts and also supports BOOTP.
 .PP
 Dnsmasq 
-supports IPv6 for all functions and a minimal router-advertisemnet daemon.
+supports IPv6 for all functions and a minimal router-advertisement daemon.
 .SH OPTIONS
 Note that in general missing parameters are allowed and switch off
 functions, for instance "--pid-file" disables writing a PID file. On
@@ -204,6 +204,17 @@ running another nameserver (or another instance of dnsmasq) on the
 same machine. Setting this option also enables multiple instances of
 dnsmasq which provide DHCP service to run in the same machine.
 .TP
+.B --bind-dynamic
+Enable a network mode which is a hybrid between 
+.B --bind-interfaces
+and the default. Dnsmasq binds the address of indivdual interfaces,
+allowing multiple dnsmasq instances, but if new interfaces or
+addresses appear, it automatically listens on those (subject to any
+access-control configuration). This makes dynamically created
+interfaces work in the same way as the default. Implementing this
+option requires non-standard networking APIs and it is only availble
+under Linux. On other platforms it falls-back to --bind-interfaces mode.
+.TP
 .B \-y, --localise-queries
 Return answers to DNS queries from /etc/hosts which depend on the interface over which the query was
 received. If a name in /etc/hosts has more than one address associated with
@@ -416,7 +427,7 @@ zone files: the port, weight and priority numbers are in a different
 order. More than one SRV record for a given service/domain is allowed,
 all that match are returned.
 .TP
-.B --host-record=<name>[,<name>....][<IPv4-address>],[IPv6-address]
+.B --host-record=<name>[,<name>....][<IPv4-address>],[<IPv6-address>]
 Add A, AAAA and PTR records to the DNS. This adds one or more names to
 the DNS with associated IPv4 (A) and IPv6 (AAAA) records. A name may
 appear in more than one 
@@ -427,10 +438,12 @@ the same rule as is used reading hosts-files.
 .B host-record
 options are considered to be read before host-files, so a name
 appearing there inhibits PTR-record creation if it appears in
-hosts-file also. Unlike host-files, names are not expanded, even when
+hosts-file also. Unlike hosts-files, names are not expanded, even when
 .B expand-hosts
 is in effect. Short and long names may appear in the same 
-.B host-record, eg. --host-record=laptop,laptop.thekelleys.org,192.168.0.1,1234::100
+.B host-record,
+eg. 
+.B --host-record=laptop,laptop.thekelleys.org,192.168.0.1,1234::100
 .TP
 .B \-Y, --txt-record=<name>[[,<text>],<text>]
 Return a TXT DNS record. The value of TXT record is a set of strings,
@@ -452,6 +465,12 @@ hosts files) or from DHCP. If the target does not satisfy this
 criteria, the whole cname is ignored. The cname must be unique, but it
 is permissable to have more than one cname pointing to the same target.
 .TP
+.B --dns-rr=<name>,<RR-number>,[<hex data>]
+Return an arbitrary DNS Resource Record. The number is the type of the
+record (which is always in the C_IN class). The value of the record is
+given by the hex data, which may be of the for 01:23:45 or 01 23 45 or
+012345 or any mixture of these.
+.TP
 .B --interface-name=<name>,<interface>
 Return a DNS record associating the name with the primary address on
 the given interface. This flag specifies an A record for the given
@@ -510,9 +529,9 @@ compiled in and the kernel must have conntrack support
 included and configured. This option cannot be combined with
 --query-port. 
 .TP
-.B \-F, --dhcp-range=[interface:<interface>,][tag:<tag>[,tag:<tag>],][set:<tag],]<start-addr>,<end-addr>[,<netmask>[,<broadcast>]][,<lease time>]
+.B \-F, --dhcp-range=[interface:<interface>,][tag:<tag>[,tag:<tag>],][set:<tag],]<start-addr>[,<end-addr>][,<mode>][,<netmask>[,<broadcast>]][,<lease time>]
 .TP
-.B \-F, --dhcp-range=[interface:<interface>,][tag:<tag>[,tag:<tag>],][set:<tag],]<start-IPv6addr>,<end-IPv6addr>[,<prefix-len>][,<lease time>]
+.B \-F, --dhcp-range=[interface:<interface>,][tag:<tag>[,tag:<tag>],][set:<tag],]<start-IPv6addr>[,<end-IPv6addr>][,<mode>][,<prefix-len>][,<lease time>]
 
 Enable the DHCP server. Addresses will be given out from the range
 <start-addr> to <end-addr> and from statically defined addresses given
@@ -522,8 +541,12 @@ options. If the lease time is given, then leases
 will be given for that length of time. The lease time is in seconds,
 or minutes (eg 45m) or hours (eg 1h) or "infinite". If not given,
 the default lease time is one hour. The
-minimum lease time is two minutes. This
-option may be repeated, with different addresses, to enable DHCP
+minimum lease time is two minutes. For IPv6 ranges, the lease time
+maybe "deprecated"; this sets the preferred lifetime sent in a DHCP
+lease or router advertisement to zero, which causes clients to use
+other addresses, if available, for new connections as a prelude to renumbering.
+
+This option may be repeated, with different addresses, to enable DHCP
 service to more than one network. For directly connected networks (ie,
 networks on which the machine running dnsmasq has an interface) the
 netmask is optional: dnsmasq will determine it from the interface
@@ -548,7 +571,7 @@ When it is prefixed with 'tag:' instead, then its meaning changes from setting
 a tag to matching it. Only one tag may be set, but more than one tag
 may be matched.
 
-The end address may be replaced by the keyword 
+The optional <mode> keyword may be 
 .B static
 which tells dnsmasq to enable DHCP for the network specified, but not
 to dynamically allocate IP addresses: only hosts which have static
@@ -556,34 +579,50 @@ addresses given via
 .B dhcp-host
 or from /etc/ethers will be served. 
 
-The end address may be replaced by
-the keyword
+For IPv4, the <mode> may be 
 .B proxy
 in which case dnsmasq will provide proxy-DHCP on the specified
 subnet. (See 
 .B pxe-prompt
 and 
 .B pxe-service
-for details, applies to IPv4 only.)
+for details.)
+
+For IPv6, the mode may be some combination of
+.B ra-only, slaac, ra-names, ra-stateless.
 
-The end address may be replaced by
-the keyword
 .B ra-only
-which tells dnsmasq to offer Router Advertisement only on this subnet,
-and not DHCP. This applies to IPv6 only, see
-.B enable-ra
-for details. Instead, the keyword
+tells dnsmasq to offer Router Advertisement only on this subnet,
+and not DHCP. 
+
+.B slaac
+tells dnsmasq to offer Router Advertisement on this subnet and to set
+the A bit in the router advertisement, so that the client will use
+SLAAC addresses. When used with a DHCP range or static DHCP address
+this results in the client having both a DHCP-assigned and a SLAAC
+address.
+
+.B ra-stateless
+sends router advertisements with the O and A bits set, and provides a
+stateless DHCP service. The client will use a SLAAC address, and use
+DHCP for other configuration information.
+
 .B ra-names
-may be used. This does the same at ra-only, but also enables a mode
+enables a mode
 which gives DNS names to dual-stack hosts which do SLAAC for
 IPv6. Dnsmasq uses the host's IPv4 lease to derive the name, network
 segment and MAC address and assumes that the host will also have an
-IPv6 address calculated using the SLAAC alogrithm, on the same network
+IPv6 address calculated using the SLAAC algorithm, on the same network
 segment. The address is pinged, and if a reply is received, an AAAA
 record is added to the DNS for this IPv6
 address. Note that this is only happens for directly-connected
 networks, (not one doing DHCP via a relay) and it will not work 
 if a host is using privacy extensions. 
+.B ra-names
+can be combined  with 
+.B ra-stateless
+and
+.B slaac.
 
 The interface:<interface name> section is not normally used. See the
 NOTES section for details of this.
@@ -1120,7 +1159,9 @@ is known.
 DNSMASQ_TAGS contains all the tags set during the
 DHCP transaction, separated by spaces.
 
-DNSMASQ_LOG_DHCP is set if --log-dhcp is in effect.
+DNSMASQ_LOG_DHCP is set if
+.B --log-dhcp
+is in effect.
 
 For IPv4 only:
 
@@ -1173,7 +1214,7 @@ with an "old " event.
 There are two further actions which may appear as the first argument
 to the script, "init" and "tftp". More may be added in the future, so
 scripts should be written to ignore unknown actions. "init" is
-decsribed below in 
+described below in 
 .B --leasefile-ro
 The "tftp" action is invoked when a TFTP file transfer completes: the
 arguments are the file size in bytes, the address to which the file
@@ -1319,20 +1360,14 @@ only a subset of this is needed, and dnsmasq can handle it, using
 existing DHCP configuration to provide most data. When RA is enabled,
 dnsmasq will advertise a prefix for each dhcp-range, with default
 router and recursive DNS server as the relevant link-local address on 
-the machine running dnsmasq. The "managed address" bits are set, and
-the "use SLAAC" bit is reset, except for a dhcp-range which is 
-marked as "ra-only" or "ra-names", in which case RA is provided but no 
-DHCPv6 service and the managed address bits are
-cleared and the "use SLAAC" bit set. If the same subnet appears in a
-normal dhcp-range and an "ra-only" dhcp-range, then the "managed
-address" bits and the "use SLAAC" bits are all set, allowing SLAAC and
-DHCP address to co-exist on the same subnet.  
-.B enable-ra
-enables router advertisement for prefixes where dnsmasq is doing
-DHCPv6. It is not needed for "ra-only" prefixes. Creating an "ra-only"
-prefix and not setting 
-.B enable-ra
-sends advertisements only to "ra-only" prefixes. 
+the machine running dnsmasq. By default, he "managed address" bits are set, and
+the "use SLAAC" bit is reset. This can be changed for individual
+subnets with the mode keywords described in
+.B --dhcp-range.
+RFC6106 DNS parameters are included in the advertisements. By default,
+the relevant link-local address of the machine running dnsmasq is sent
+as recursive DNS server. If provided, the DHCPv6 options dns-server and
+domain-search are used for RDNSS and DNSSL.
 .TP
 .B --enable-tftp[=<interface>]
 Enable the TFTP server function. This is deliberately limited to that
@@ -1367,6 +1402,12 @@ are accessible. It is not recommended to run dnsmasq as root with TFTP
 enabled, and certainly not without specifying --tftp-root. Doing so
 can expose any world-readable file on the server to any host on the net. 
 .TP
+.B --tftp-lowercase
+Convert filenames in TFTP requests to all lowercase. This is useful
+for requests from Windows machines, which have case-insensitive
+filesystems and tend to play fast-and-loose with case in filenames.
+Note that dnsmasq's tftp server always converts "\\" to "/" in filenames.
+.TP
 .B --tftp-max=<connections>
 Set the maximum number of concurrent TFTP connections allowed. This
 defaults to 50. When serving a large number of TFTP connections,

man/fr/dnsmasq.8

@@ -22,7 +22,8 @@ peut être configuré pour envoyer n'importe quel option DHCP.
 Il inclut un serveur TFTP sécurisé en lecture seule permettant le démarrage via
 le réseau/PXE de clients DHCP et supporte également le protocole BOOTP.
 .PP
-Dnsmasq supporte IPv6 pour le DNS et TFTP mais pas pour le DHCP.
+Dnsmasq supporte IPv6 et contient un démon minimaliste capable de faire des
+annonces routeurs ("router-advertisements").
 .SH OPTIONS
 Notes : Il est possible d'utiliser des options sans leur donner de paramètre.
 Dans ce cas, la fonction correspondante sera désactivée. Par exemple
@@ -492,6 +493,27 @@ dans un ordre différents. Pour un service/domaine donné, plus d'un
 enregistrement SRV est autorisé et tous les enregistrements qui coïncident sont
 retournés dans la réponse.
 .TP
+.B --host-record=<nom>[,<nom>....][<adresse IPv4>],[<adresse IPv6>]
+Ajoute des enregistrements A, AAAA et PTR dans le DNS. Ceci permet d'ajouter
+un ou plusieurs noms dans le DNS et de les associer à des enregistrements IPv4
+(A) ou IPv6 (AAAA). Un nom peut apparaître dans plus d'une entrée
+.B host-record
+et de fait être associé à plus d'une adresse. Seule la première entrée créée
+l'enregistrement PTR associée au nom. Ceci correspond à la même règle que celle
+utilisée lors de la lecture du fichier hosts.
+Les options
+.B host-record
+sont considérées lues avant le fichier hosts, ainsi un nom apparaissant dans
+une option host-record et dans le fichier hosts n'aura pas d'enregistrement
+PTR associé à l'entrée dans le fichier hosts. A l'inverse du fichier hosts, les
+noms ne sont pas étendus, même lorsque l'option
+.B expand-hosts
+est activée. Les noms longs et les noms courts peuvent apparaitre dans la même
+entrée 
+.B host-record,
+c-à-d
+.B --host-record=laptop,laptop.thekelleys.org,192.168.0.1,1234::100
+.TP
 .B \-Y, --txt-record=<nom>[[,<texte>],<texte>]
 Définit un enregistrement DNS de type TXT. La valeur de l'enregistrement TXT est
 un ensemble de chaînes de caractères, donc un nombre variable de chaînes de
@@ -577,11 +599,11 @@ l'ayant déclenché, ce qui est pratique pour la gestion de la bande passante
 (accounting) et le filtrage (firewall). Dnsmasq doit pour cela être compilé
 avec le support conntrack, le noyau doit également inclure conntrack et être
 configuré pour cela. Cette option ne peut pas être combinée avec
---query-port. 
+--query-port.
 .TP
-.B \-F, --dhcp-range=[interface:<interface>,][tag:<label>[,tag:<label>],][set:<label>],]<adresse de début>,<adresse de fin>[,<masque de réseau>[,<broadcast>]][,<durée de bail>]
+.B \-F, --dhcp-range=[interface:<interface>,][tag:<label>[,tag:<label>],][set:<label>],]<adresse de début>[,<adresse de fin>][,<mode>][,<masque de réseau>[,<broadcast>]][,<durée de bail>]
 .TP
-.B \-F, --dhcp-range=[interface:<interface>,][tag:<label>[,tag:<label>],][set:<label>],]<addresse IPv6 de début>,<adresse IPv6 de fin>[,<longueur de préfixe>][,<durée de bail>]
+.B \-F, --dhcp-range=[interface:<interface>,][tag:<label>[,tag:<label>],][set:<label>],]<addresse IPv6 de début>[,<adresse IPv6 de fin>][,<mode>][,<longueur de préfixe>][,<durée de bail>]
 Active le serveur DHCP. Les adresses seront données dans la plage comprise entre
 <adresse de début> et <adresse de fin> et à partir des adresses définies
 statiquement dans l'option
@@ -592,6 +614,13 @@ en heures (exemple : 1h) ou être la chaine de caractère "infinite" pour une
 durée indéterminée. Si aucune valeur n'est donnée, une durée de bail par défaut
 de une heure est appliquée. La valeur minimum pour un bail DHCP est de 2
 minutes.
+
+Pour les plages IPv6, la durée de bail peut-être égale au mot-clef "deprecated"
+(obsolète); Cela positionne la durée de vie préférée envoyée dans les baux DHCP
+ou les annonces routeurs à zéro, ce qui incite les clients à utiliser d'autres
+adresses autant que possible, pour toute nouvelle connexion, en préalable à
+la renumérotation.
+
 Cette option peut être répétée, avec différentes adresses,
 pour activer le service DHCP sur plus d'un réseau. Pour des réseaux directement
 connectés (c'est-à-dire des réseaux dans lesquels la machine sur laquelle tourne
@@ -622,30 +651,59 @@ Lorsque préfixé par 'tag:', la signification change, et au lieu de définir un
 label, il définit le label pour laquelle la règle s'applique. Un seul label peut-
 être défini mais plusieurs labels peuvent coïncider.
 
-L'adresse de fin peut être remplacée par le mot-clef
+Le mot clef optionnel <mode> peut être égal à
 .B static
-("statique") qui indique à Dnsmasq d'activer le service DHCP pour le réseau
+("statique") ce qui indique à Dnsmasq d'activer le service DHCP pour le réseau
 spécifié, mais de ne pas activer l'allocation dynamique d'adresses IP : Seuls
 les hôtes possédant des adresses IP statiques fournies via 
 .B dhcp-host
 ou présentes dans le fichier /etc/ethers seront alors servis par le DHCP.
 
-L'adresse de fin peut-être remplacée par le mot-clef
+Pour IPv4, le <mode> peut est égal à
 .B proxy
 , auquel cas Dnsmasq fournira un service de DHCP proxy pour le sous-réseau
 spécifié. (voir
 .B pxe-prompt
 et
 .B pxe-service
-pour plus de détails, s'applique à IPv4 seulement).
+pour plus de détails).
+
+Pour IPv6, le mode peut-être une combinaison des valeurs
+.B ra-only, slaac, ra-names, ra-stateless.
 
-L'adresse de fin peut être remplacée par le mot-clef
 .B ra-only
-qui indique à dnsmasq de n'effectuer que des annonces de routeur (Router
-Advertisement, RA) sur ce sous-réseau, et de ne pas faire de DHCP. Ceci
-s'applique uniquement à IPv6, voir
-.B enable-ra
-pour plus de détails.
+indique à dnsmasq de n'effectuer que des annonces de routeur (Router
+Advertisement, RA) sur ce sous-réseau, et de ne pas faire de DHCP.
+
+.B slaac
+indique à dnsmasq d'effectuer des annonces de routeur sur ce sous-réseau
+et de positionner dans celles-ci le bit A, afin que les clients utilisent
+des adresses SLAAC. Lorsqu'utilisé conjointement avec une plage DHCP ou des
+affectations statiques d'adresses DHCP, les clients disposeront à la fois
+d'adresses DHCP assignées et d'adresses SLAAC.
+
+.B ra-stateless
+indique à dnsmasq d'effectuer des annonces de routeur avec les bits 0 et A
+positionnés, et de fournir un service DHCP sans état ("stateless"). Les clients
+utiliseront des adresses SLAAC, et utiliseront DHCP pour toutes les autres
+informations de configuration.
+
+.B ra-names
+active un mode qui fourni des noms DNS aux hôtes fonctionnant en double pile
+("dual stack") et configurés pour faire du SLAAC en IPv6. Dnsmasq utilise le
+bail IPv4 de l'hôte afin de dériver le nom, le segment de réseau et l'adresse
+MAC et assume que l'hôte disposera d'une adresse IPv6 calculée via l'algorithme
+SLAAC, sur le même segment de réseau. Un ping est envoyé à l'adresse, et si une
+réponse est obtenue, un enregistrement AAAA est rajouté dans le DNS pour cette
+adresse IPv6. Veuillez-noter que cela n'arrive que pour les réseaux directement
+connectés (et non ceux pour lesquels DHCP se fait via relai), et ne
+fonctionnera pas si un hôte utilise les "extensions de vie privée"
+("privacy extensions").
+.B ra-names
+peut-être combiné avec
+.B ra-stateless
+et
+.B slaac.
 
 La section interface:<nom d'interface> n'est normalement pas utilisée. Se
 référer aux indications de la section NOTES pour plus de détail à ce sujet.
@@ -1170,9 +1228,21 @@ détermination de celles-ci.
 .B \-l, --dhcp-leasefile=<chemin de fichier>
 Utilise le fichier dont le chemin est fourni pour stocker les informations de
 baux DHCP.
-.TP 
+.TP
+.B --dhcp-duid=<ID d'entreprise>,<uid>
+(IPv6 seulement) Spécifie le numéro d'UID de serveur persistant que le serveur
+DHCPv6 doit utiliser. Cette option n'est normalement pas requise, Dnsmasq
+créant un DUID automatiquement lorsque cela est nécessaire. Lorsque cette
+option est positionnée, elle fournit à Dnsmasq les données nécessaires à la
+création d'un DUID de type DUID-EN. Veuillez noter qu'une fois créé, le DUID
+est stocké dans la base des baux, aussi changer entre un DUID créé
+automatiquement et un DUID-EN et vice-versa impose de réinitialiser la base de
+baux. Le numéro d'ID d'entreprise est assigné par l'IANA, et l'uid est une
+chaine hexadécimale unique à chaque serveur.
+.TP
 .B \-6 --dhcp-script=<chemin de fichier>
-Lorsqu'un bail DHCP est créé, ou qu'un ancien est supprimé, le fichier dont le
+Lorsqu'un bail DHCP est créé, qu'un ancien est supprimé, ou qu'un transfert
+TFTP est terminé, le fichier dont le
 chemin  est spécifié est exécuté. Le <chemin de fichier> doit être un chemin
 absolu, aucune recherche n'est effectuée via la variable d'environnement PATH.
 Les arguments fournis à celui-ci sont soit
@@ -1223,6 +1293,10 @@ relai DHCP pour contacter Dnsmasq, si l'adresse IP du relai est connue.
 DNSMASQ_TAGS contient tous les labels fournis pendant la transaction DHCP,
 séparés par des espaces.
 
+DNSMASQ_LOG_DHCP est positionné si
+.B --log-dhcp
+est activé.
+
 Pour IPv4 seulement :
 
 DNSMASQ_CLIENT_ID, si l'hôte a fourni un identifiant de client.
@@ -1262,6 +1336,16 @@ Au démarrage de Dnsmasq, le script sera invoqué pour chacun des baux existants
 dans le fichier des baux. Le script sera lancé avec l'action "del" pour les
 baux expirés, et "old" pour les autres. Lorsque Dnsmasq reçoit un signal HUP,
 le script sera invoqué avec une action "old" pour tous les baux existants.
+
+Il existe deux autres actions pouvant apparaître comme argument au script :
+"init" et "tftp". D'autres sont susceptibles d'être rajoutées dans le futur,
+aussi les scripts devraient-être écrits de sorte à ignorer les actions
+inconnues. "init" est décrite ci-dessous dans
+.B --leasefile-ro.
+L'action "tftp" est invoquée lorsqu'un transfert de fichier TFTP s'est
+terminé. Ses arguments sont la taille du fichier en octets, l'adresse à
+laquelle le fichier a été envoyé, ainsi que le chemin complet du fichier.
+
 .TP
 .B --dhcp-luascript=<chemin>
 Spécifie un script écrit en Lua, devant être exécuté lorsque des baux sont
@@ -1276,8 +1360,10 @@ et peut fournir des fonctions
 et
 .B shutdown
 qui sont appellées, sans arguments, lorsque dnsmasq démarre ou s'arrête.
+Il peut également fournir une fonction
+.B tftp.
 
-La méthode
+La fonction
 .B lease
 reçoit les informations détaillées dans
 .B --dhcp-script. 
@@ -1301,6 +1387,16 @@ et
 ainsi que
 .B hostname
 (le nom d'hôte) dans le cas d'IPv6.
+
+La fonction
+.B tftp
+est appelée de la même façon que la fonction "lease", et la table contient les
+labels
+.B destination_address,
+.B file_name
+et
+.B file_size
+(respectivement "adresse de destination", "nom de fichier" et "taille de fichier").
 .TP
 .B --dhcp-scriptuser
 Spécifie l'utilisateur sous lequel le script shell lease-change ou le script
@@ -1367,7 +1463,7 @@ Si la gamme d'adresse est fournie sous la forme
 qui a pour effect d'ajouter --local-declarations aux requêtes DNS directes et
 inverses. C-à-d
 .B --domain=thekelleys.org.uk,192.168.0.0/24,local
-est indentique à
+est identique à
 .B --domain=thekelleys.org.uk,192.168.0.0/24
 --local=/thekelleys.org.uk/ --local=/0.168.192.in-addr.arpa/
 La taille de réseau doit-être de 8, 16 ou 24 pour être valide.
@@ -1411,10 +1507,15 @@ Advertisement") sont activées, dnsmasq va annoncer un préfixe pour chaque
 dhcp-range et, par défaut, fournir comme valeur de routeur et de DNS récursif
 la valeur d'adresse link-local appropriée parmi celles de la machine sur
 laquelle tourne dnsmasq.
-Les bits "managed address" sont positionnés, sauf pour un dhcp-range marqué
-comme "ra-only" (annonce routeur uniquement). Dans ce cas le service d'annonce
-routeur est rendu mais aucun service DHCPv6 n'est assuré, et les bits "managed
-address" ne sont pas positionnés.
+Par défaut, les bits "managed address" sont positionnés, et le bit "use SLAAC"
+("utiliser SLAAC") est réinitialisé. Cela peut-être changé pour des
+sous-réseaux donnés par le biais du mot clef de mode décris dans
+.B --dhcp-range.
+Les paramètres DNS du RFC6106 sont inclus dans les annonces. Par défaut,
+l'adresse link-local appropriée parmi celles de la machine sur laquelle tourne
+dnsmasq est spécifiée comme DNS récursif. Si elles sont fournies, les
+options dns-server et domain-search sont utilisées respectivement pour RDNSS et
+DNSSL.
 .TP
 .B --enable-tftp[=<interface>]
 Active la fonction serveur TFTP. Celui-ci est de manière délibérée limité aux

po/de.po

@@ -12,8 +12,8 @@ msgstr ""
 "Project-Id-Version: dnsmasq 2.53rc1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2009-06-18 12:24+0100\n"
-"PO-Revision-Date: 2010-05-24 16:29+0200\n"
-"Last-Translator: Matthias Andree <matthias.andree@gmx.de>\n"
+"PO-Revision-Date: 2012-04-05 17:54+0100\n"
+"Last-Translator: Conrad Kostecki <ConiKost@gmx.de>\n"
 "Language-Team: German <de@li.org>\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -25,17 +25,20 @@ msgstr ""
 msgid "failed to load names from %s: %s"
 msgstr "Fehler beim Laden der Namen von %s: %s"
 
-#: cache.c:797 dhcp.c:855
+#: cache.c:797
+#: dhcp.c:855
 #, c-format
 msgid "bad address at %s line %d"
 msgstr "Fehlerhafte Adresse in %s Zeile %d"
 
-#: cache.c:846 dhcp.c:871
+#: cache.c:846
+#: dhcp.c:871
 #, c-format
 msgid "bad name at %s line %d"
 msgstr "Fehlerhafter Name in %s Zeile %d"
 
-#: cache.c:853 dhcp.c:946
+#: cache.c:853
+#: dhcp.c:946
 #, c-format
 msgid "read %s - %d addresses"
 msgstr "%s gelesen - %d Adressen"
@@ -47,7 +50,7 @@ msgstr "Cache geleert"
 #: cache.c:953
 #, c-format
 msgid "No IPv4 address found for %s"
-msgstr ""
+msgstr "Keine IPv4-Adresse für %s gefunden"
 
 #: cache.c:1005
 #, c-format
@@ -88,7 +91,8 @@ msgstr "Konnte den Zufallszahlengenerator nicht initialisieren: %s"
 msgid "failed to allocate memory"
 msgstr "Konnte Speicher nicht belegen"
 
-#: util.c:227 option.c:717
+#: util.c:227
+#: option.c:717
 msgid "could not get memory"
 msgstr "Speicher nicht verfügbar"
 
@@ -171,19 +175,16 @@ msgid "Set address or hostname for a specified machine."
 msgstr "Adresse oder Hostnamen für einen angegebenen Computer setzen."
 
 #: option.c:268
-#, fuzzy
 msgid "Read DHCP host specs from file."
-msgstr "DHCP-Host-Angaben aus Datei lesen"
+msgstr "DHCP-Host-Angaben aus Datei lesen."
 
 #: option.c:269
-#, fuzzy
 msgid "Read DHCP option specs from file."
-msgstr "DHCP-Optionen aus Datei lesen"
+msgstr "DHCP-Optionen aus Datei lesen."
 
 #: option.c:270
-#, fuzzy
 msgid "Evaluate conditional tag expression."
-msgstr "Auswertung eines Ausdrucks bedingter Marken"
+msgstr "Auswertung eines Ausdrucks bedingter Marken."
 
 #: option.c:271
 #, c-format
@@ -325,7 +326,6 @@ msgid "Specify time-to-live in seconds for negative caching."
 msgstr "Gültigkeitsdauer in Sekunden für Caching negativer Ergebnisse festlegen."
 
 #: option.c:304
-#, fuzzy
 msgid "Specify time-to-live in seconds for maximum TTL to send to clients."
 msgstr "Gültigkeitsdauer in Sekunden für Caching negativer Ergebnisse festlegen."
 
@@ -414,17 +414,14 @@ msgid "Disable ICMP echo address checking in the DHCP server."
 msgstr "ICMP-Echo-Adressprüfung im DHCP-Server abschalten."
 
 #: option.c:325
-#, fuzzy
 msgid "Shell script to run on DHCP lease creation and destruction."
 msgstr "Skript, das bei Erzeugung/Löschung einer DHCP-Lease laufen soll."
 
 #: option.c:326
-#, fuzzy
 msgid "Lua script to run on DHCP lease creation and destruction."
-msgstr "Skript, das bei Erzeugung/Löschung einer DHCP-Lease laufen soll."
+msgstr "Lua-Skript, welches bei Erzeugung/Löschung eines DHCP-Leases laufen soll."
 
 #: option.c:327
-#, fuzzy
 msgid "Run lease-change scripts as this user."
 msgstr "Lease-Änderungs-Skript mit den Rechten dieses Nutzers ausführen."
 
@@ -504,7 +501,6 @@ msgid "Allow rebinding of 127.0.0.0/8, for RBL servers."
 msgstr "Auflösung zu 127.0.0.0/8 erlauben, für RBL-Server."
 
 #: option.c:346
-#, fuzzy
 msgid "Inhibit DNS-rebind protection on this domain."
 msgstr "DNS-Rebind-Schutz für diese Domäne sperren."
 
@@ -534,9 +530,8 @@ msgstr "Für DHCP-Klienten nur vollständig bestimmte Domänennamen benutzen."
 
 # FIXME: probably typo in original message. -- MA
 #: option.c:353
-#, fuzzy
 msgid "Generate hostnames based on MAC address for nameless clients."
-msgstr "Für namenlose Klienten die Hostnamen MAC-basiert erzeugen."
+msgstr "Generiere Hostnamen auf Basis der MAC-Adresse für namenlose Klienten."
 
 #: option.c:354
 msgid "Use these DHCP relays as full proxies."
@@ -560,28 +555,27 @@ msgstr "Konfigurationssyntax prüfen."
 
 #: option.c:359
 msgid "Add requestor's MAC address to forwarded DNS queries."
-msgstr ""
+msgstr "Anfragende MAC-Adresse in die weiterleitende DNS-Anfrage einfügen"
 
 #: option.c:360
-#, fuzzy
 msgid "Proxy DNSSEC validation results from upstream nameservers."
-msgstr "IPv4-Adressen von vorgelagerten Servern übersetzen."
+msgstr "Proxy-DNSSEC-Validierung-Ergebnisse von Upstream-Namensservern."
 
 #: option.c:361
 msgid "Attempt to allocate sequential IP addresses to DHCP clients."
-msgstr ""
+msgstr "Versuche sequenzielle IP-Adressen an DHCP-Klienten zu vergeben."
 
 #: option.c:362
 msgid "Copy connection-track mark from queries to upstream connections."
-msgstr ""
+msgstr "Kopiere \"connection-track mark\" von Anfragen nach Upstream-Verbindungen."
 
 #: option.c:363
 msgid "Allow DHCP clients to do their own DDNS updates."
-msgstr ""
+msgstr "Erlaube DHCP-Klienten ihre eigenen DDNS-Updates durchzuführen."
 
 #: option.c:364
 msgid "Send router-advertisements for interfaces doing DHCPv6"
-msgstr ""
+msgstr "Sende \"Router-Advertisments\" für Netzwerkschnittstellen, welche DHCPv6 nutzen"
 
 #: option.c:782
 #, c-format
@@ -608,13 +602,13 @@ msgid "Known DHCP options:\n"
 msgstr "Bekannte DHCP-Optionen:\n"
 
 #: option.c:838
-#, fuzzy, c-format
+#, c-format
 msgid "Known DHCPv6 options:\n"
-msgstr "Bekannte DHCP-Optionen:\n"
+msgstr "Bekannte DHCPv6-Optionen:\n"
 
 #: option.c:973
 msgid "unsupported encapsulation for IPv6 option"
-msgstr ""
+msgstr "Nicht unterstützte Verkapselung für eine IPv6-Option"
 
 #: option.c:1001
 msgid "bad dhcp-option"
@@ -624,10 +618,11 @@ msgstr "Fehlerhafte DHCP-Option"
 msgid "bad IP address"
 msgstr "Fehlerhafte IP-Adresse"
 
-#: option.c:1071 option.c:1177 option.c:2511
-#, fuzzy
+#: option.c:1071
+#: option.c:1177
+#: option.c:2511
 msgid "bad IPv6 address"
-msgstr "Fehlerhafte IP-Adresse"
+msgstr "Fehlerhafte IPv6-Adresse"
 
 #: option.c:1205
 msgid "bad domain in dhcp-option"
@@ -649,23 +644,25 @@ msgstr "unzulässig wiederholte Markierung"
 msgid "illegal repeated keyword"
 msgstr "unzulässig wiederholtes Schlüsselwort"
 
-#: option.c:1452 option.c:3536
+#: option.c:1452
+#: option.c:3536
 #, c-format
 msgid "cannot access directory %s: %s"
 msgstr "Kann auf Verzeichnis %s nicht zugreifen: %s"
 
-#: option.c:1483 tftp.c:464
+#: option.c:1483
+#: tftp.c:464
 #, c-format
 msgid "cannot access %s: %s"
 msgstr "Kann auf %s nicht zugreifen: %s"
 
 #: option.c:1512
 msgid "setting log facility is not possible under Android"
-msgstr ""
+msgstr "Die Einstellung Protokolliereinrichtung kann unter Android nicht gesetzt werden"
 
 #: option.c:1521
 msgid "bad log facility"
-msgstr ""
+msgstr "Falsche Protokolliereinrichtung"
 
 #: option.c:1570
 msgid "bad MX preference"
@@ -688,19 +685,21 @@ msgid "recompile with HAVE_SCRIPT defined to enable lease-change scripts"
 msgstr "Neuübersetzung mit HAVE_SCRIPT nötig, um Lease-Änderungs-Skripte auszuführen"
 
 #: option.c:1607
-#, fuzzy
 msgid "recompile with HAVE_LUASCRIPT defined to enable Lua scripts"
-msgstr "Neuübersetzung mit HAVE_SCRIPT nötig, um Lease-Änderungs-Skripte auszuführen"
+msgstr "Um Benutzerdefinierte Lua-Scripte zu ermöglichen, muss mit HAVE_LUASCRIPT neu kompiliert werden"
 
-#: option.c:1988 option.c:1992
+#: option.c:1988
+#: option.c:1992
 msgid "bad port"
 msgstr "unzulässiger Port"
 
-#: option.c:2015 option.c:2046
+#: option.c:2015
+#: option.c:2046
 msgid "interface binding not supported"
 msgstr "Schnittstellenbindung nicht unterstützt"
 
-#: option.c:2026 option.c:3088
+#: option.c:2026
+#: option.c:3088
 msgid "bad interface name"
 msgstr "unzulässiger Schnittestellenname"
 
@@ -726,20 +725,20 @@ msgstr "inkonsistenter DHCP-Bereich"
 
 #: option.c:2374
 msgid "prefix must be at least 64"
-msgstr ""
+msgstr "Der Prefix muss mindestens 64 sein"
 
 #: option.c:2378
-#, fuzzy
 msgid "inconsistent DHCPv6 range"
-msgstr "inkonsistenter DHCP-Bereich"
+msgstr "Inkonsistenter DHCPv6-Bereich"
 
-#: option.c:2481 option.c:2521
+#: option.c:2481
+#: option.c:2521
 msgid "bad hex constant"
-msgstr ""
+msgstr "Falscher Hexwert"
 
 #: option.c:2503
 msgid "cannot match tags in --dhcp-host"
-msgstr ""
+msgstr "Kann die Tags in --dhcp-host nicht abgleichen"
 
 #: option.c:2583
 msgid "bad DHCP host name"
@@ -749,7 +748,8 @@ msgstr "unzulässiger DHCP-Hostname"
 msgid "bad tag-if"
 msgstr "unzulässige bedingte Marke (tag-if)"
 
-#: option.c:2973 option.c:3258
+#: option.c:2973
+#: option.c:3258
 msgid "invalid port number"
 msgstr "unzulässige Portnummer"
 
@@ -826,19 +826,21 @@ msgstr "Fehler"
 msgid "%s at line %d of %%s"
 msgstr "%s in Zeile %d von %%s"
 
-#: option.c:3491 tftp.c:627
+#: option.c:3491
+#: tftp.c:627
 #, c-format
 msgid "cannot read %s: %s"
 msgstr "kann %s nicht lesen: %s"
 
-#: option.c:3657 option.c:3693
+#: option.c:3657
+#: option.c:3693
 #, c-format
 msgid "read %s"
 msgstr "%s gelesen"
 
 #: option.c:3745
 msgid "junk found in command line"
-msgstr ""
+msgstr "Mist in der Kommandozeile gefunden"
 
 #: option.c:3780
 #, c-format
@@ -846,12 +848,12 @@ msgid "Dnsmasq version %s  %s\n"
 msgstr "Dnsmasq Version %s  %s\n"
 
 #: option.c:3781
-#, fuzzy, c-format
+#, c-format
 msgid ""
 "Compile time options: %s\n"
 "\n"
 msgstr ""
-"Übersetzungs-Optionen %s\n"
+"Kompilierungs-Optionen %s\n"
 "\n"
 
 #: option.c:3782
@@ -863,12 +865,12 @@ msgstr "Für diese Software wird ABSOLUT KEINE GARANTIE gewährt.\n"
 #: option.c:3783
 #, c-format
 msgid "Dnsmasq is free software, and you are welcome to redistribute it\n"
-msgstr ""
+msgstr "Dnsmasq ist freie Software, und du bist willkommen es weiter zu verteilen\n"
 
 #: option.c:3784
 #, c-format
 msgid "under the terms of the GNU General Public License, version 2 or 3.\n"
-msgstr ""
+msgstr "unter den Bedingungen der GNU General Public Lizenz, Version 2 oder 3.\n"
 
 #: option.c:3795
 msgid "try --help"
@@ -896,7 +898,9 @@ msgstr "mit -n/--no-poll ist nur eine resolv.conf-Datei zulässig."
 msgid "must have exactly one resolv.conf to read domain from."
 msgstr "Um die Domäne zu lesen, muss genau eine resolv.conf-Datei verwendet werden."
 
-#: option.c:3882 network.c:822 dhcp.c:804
+#: option.c:3882
+#: network.c:822
+#: dhcp.c:804
 #, c-format
 msgid "failed to read %s: %s"
 msgstr "konnte %s nicht lesen: %s"
@@ -907,18 +911,17 @@ msgid "no search directive found in %s"
 msgstr "keine \"search\"-Anweisung in %s gefunden"
 
 #: option.c:3920
-#, fuzzy
 msgid "there must be a default domain when --dhcp-fqdn is set"
-msgstr "für --dhcp-fqdn muss eine Domäne vorausgewählt werden"
+msgstr "Es muss eine standard Domain gesetzt sein, wenn --dhcp-fqdn gesetzt ist"
 
 #: option.c:3924
 msgid "syntax check OK"
 msgstr "Syntaxprüfung OK"
 
 #: forward.c:113
-#, fuzzy, c-format
+#, c-format
 msgid "failed to send packet: %s"
-msgstr "konnte Socket nicht zum Empfang einrichten: %s"
+msgstr "Fehlgeschlagen, folgendes Paket zu senden: %s"
 
 #: forward.c:474
 #, c-format
@@ -931,9 +934,9 @@ msgid "possible DNS-rebind attack detected: %s"
 msgstr "möglichen DNS-Rebind-Angriff entdeckt: %s"
 
 #: network.c:355
-#, fuzzy, c-format
+#, c-format
 msgid "failed to create listening socket for %s: %s"
-msgstr "Konnte Empfangs-Socket nicht erzeugen: %s"
+msgstr "Konnte Empfangs-Socket für %s: %s nicht erzeugen"
 
 #: network.c:720
 #, c-format
@@ -953,44 +956,44 @@ msgstr "ignoriere Namensserver %s - kann Socket nicht erzeugen/binden: %s"
 # FIXME: this isn't translatable - always provide full strings, do not assemble yourself! -- MA
 #: network.c:785
 msgid "unqualified"
-msgstr ""
+msgstr "unqualifiziert"
 
 #: network.c:785
 msgid "names"
-msgstr ""
+msgstr "Namen"
 
 #: network.c:787
 msgid "default"
-msgstr ""
+msgstr "Standard"
 
 #: network.c:789
 msgid "domain"
-msgstr ""
+msgstr "Domain"
 
 #: network.c:792
 #, c-format
 msgid "using local addresses only for %s %s"
-msgstr ""
+msgstr "Benutze lokale Adressen nur für %s %s"
 
 #: network.c:794
 #, c-format
 msgid "using standard nameservers for %s %s"
-msgstr ""
+msgstr "Benutze standard Namensserver für %s %s"
 
 #: network.c:796
 #, c-format
 msgid "using nameserver %s#%d for %s %s"
-msgstr ""
+msgstr "Benutze Namensserver %s#%d für %s %s"
 
 #: network.c:799
 #, c-format
 msgid "using nameserver %s#%d(via %s)"
-msgstr ""
+msgstr "Benutze Namensserver %s#%d(via %s)"
 
 #: network.c:801
 #, c-format
 msgid "using nameserver %s#%d"
-msgstr ""
+msgstr "Benutze Namensserver %s#%d"
 
 #: dnsmasq.c:123
 msgid "TFTP server not available: set HAVE_TFTP in src/config.h"
@@ -998,21 +1001,19 @@ msgstr "TFTP-Server nicht verfügbar, setzen Sie HAVE_TFTP in src/config.h"
 
 #: dnsmasq.c:128
 msgid "Cannot use --conntrack AND --query-port"
-msgstr ""
+msgstr "Kann nicht --conntrack UND --query-port einsetzen"
 
 #: dnsmasq.c:131
-#, fuzzy
 msgid "Conntrack support not available: set HAVE_CONNTRACK in src/config.h"
-msgstr "TFTP-Server nicht verfügbar, setzen Sie HAVE_TFTP in src/config.h"
+msgstr "Conntrack-Unterstützung nicht verfügbar: setze HAVE_CONNTRACK in src/config.h"
 
 #: dnsmasq.c:136
 msgid "asychronous logging is not available under Solaris"
 msgstr "asynchrone Protokollierung unter Solaris nicht verfügbar"
 
 #: dnsmasq.c:141
-#, fuzzy
 msgid "asychronous logging is not available under Android"
-msgstr "asynchrone Protokollierung unter Solaris nicht verfügbar"
+msgstr "Asynchrone Protokollierung unter Android nicht verfügbar"
 
 #: dnsmasq.c:190
 #, c-format
@@ -1029,7 +1030,8 @@ msgstr "unbekannte Schnittstelle %s"
 msgid "no interface with address %s"
 msgstr "keine Schnittstelle mit Adresse %s"
 
-#: dnsmasq.c:220 dnsmasq.c:770
+#: dnsmasq.c:220
+#: dnsmasq.c:770
 #, c-format
 msgid "DBus error: %s"
 msgstr "DBus-Fehler: %s"
@@ -1062,7 +1064,7 @@ msgstr "gestartet, Version %s, Cachegröße %d"
 #: dnsmasq.c:485
 #, c-format
 msgid "started, version %s cache disabled"
-msgstr ""
+msgstr "Gestartet, Version %s Cache deaktiviert"
 
 #: dnsmasq.c:487
 #, c-format
@@ -1106,7 +1108,7 @@ msgstr "asynchrone Protokollierung eingeschaltet, Warteschlange fasst %d Nachric
 
 #: dnsmasq.c:524
 msgid "IPv6 router advertisement enabled"
-msgstr ""
+msgstr "IPv6-Router-Advertisement aktiviert"
 
 #: dnsmasq.c:554
 #, c-format
@@ -1114,9 +1116,9 @@ msgid "DHCP, static leases only on %.0s%s, lease time %s"
 msgstr "DHCP, nur statische Leases auf %.0s%s, Lease-Zeit %s"
 
 #: dnsmasq.c:556
-#, fuzzy, c-format
+#, c-format
 msgid "router advertisement only on %.0s%s, lifetime %s"
-msgstr "DHCP, nur statische Leases auf %.0s%s, Lease-Zeit %s"
+msgstr "Router-Advertisment nur auf %.0s%s, Lebenszeit %s"
 
 #: dnsmasq.c:558
 #, c-format
@@ -1128,17 +1130,18 @@ msgstr "DHCP, Proxy im Subnetz %.0s%s%.0s"
 msgid "DHCP, IP range %s -- %s, lease time %s"
 msgstr "DHCP, IP-Bereich %s - %s, Lease-Zeit %s "
 
+# FIXME: this and the next few must be full strings to be translatable - do not assemble in code"
 #: dnsmasq.c:588
 msgid "root is "
-msgstr "FIXME: this and the next few must be full strings to be translatable - do not assemble in code"
+msgstr "Wurzel ist"
 
 #: dnsmasq.c:588
 msgid "enabled"
-msgstr ""
+msgstr "Aktiviert"
 
 #: dnsmasq.c:590
 msgid "secure mode"
-msgstr ""
+msgstr "sicherer Modus"
 
 #: dnsmasq.c:616
 #, c-format
@@ -1180,24 +1183,24 @@ msgid "failed to open pidfile %s: %s"
 msgstr "kann die Prozessidentifikations-(PID)-Datei %s nicht öffnen: %s"
 
 #: dnsmasq.c:930
-#, fuzzy, c-format
+#, c-format
 msgid "cannot open log %s: %s"
-msgstr "kann %s nicht öffnen: %s"
+msgstr "Kann Logdatei %s nicht öffnen: %s"
 
 #: dnsmasq.c:933
-#, fuzzy, c-format
+#, c-format
 msgid "failed to load Lua script: %s"
-msgstr "konnte %s nicht lesen: %s"
+msgstr "Konnte Lua-Script nicht laden: %s"
 
 #: dnsmasq.c:1002
-#, fuzzy, c-format
+#, c-format
 msgid "script process killed by signal %d"
-msgstr "Tochterprozess durch Signal %d zerstört"
+msgstr "Scriptprozess durch Signal %d getötet"
 
 #: dnsmasq.c:1006
-#, fuzzy, c-format
+#, c-format
 msgid "script process exited with status %d"
-msgstr "Tochterprozess beendete sich mit Status %d"
+msgstr "Scriptprozess hat sich mit Status %d beendet"
 
 #: dnsmasq.c:1010
 #, c-format
@@ -1308,22 +1311,23 @@ msgstr "Ignoriere Domäne %s für DHCP-Hostnamen %s"
 #: rfc2131.c:337
 #, c-format
 msgid "no address range available for DHCP request %s %s"
-msgstr ""
+msgstr "Kein verfügbarer DHCP-Bereich für Anfrage %s %s"
 
 #: rfc2131.c:338
 msgid "with subnet selector"
-msgstr ""
+msgstr "mit Subnetz-Wähler"
 
 #: rfc2131.c:338
 msgid "via"
-msgstr ""
+msgstr "via"
 
 #: rfc2131.c:350
 #, c-format
 msgid "%u available DHCP subnet: %s/%s"
 msgstr "%u verfügbare(s) DHCP-Subnetz: %s/%s"
 
-#: rfc2131.c:353 rfc3315.c:209
+#: rfc2131.c:353
+#: rfc3315.c:209
 #, c-format
 msgid "%u available DHCP range: %s -- %s"
 msgstr "%u verfügbare(r) DHCP-Bereich: %s - %s"
@@ -1331,33 +1335,40 @@ msgstr "%u verfügbare(r) DHCP-Bereich: %s - %s"
 # FIXME: do not programmatically assemble strings - untranslatable
 #: rfc2131.c:382
 msgid "disabled"
-msgstr ""
+msgstr "deaktiviert"
 
-#: rfc2131.c:423 rfc2131.c:941 rfc2131.c:1341
+#: rfc2131.c:423
+#: rfc2131.c:941
+#: rfc2131.c:1341
 msgid "ignored"
-msgstr ""
+msgstr "ignoriert"
 
-#: rfc2131.c:438 rfc2131.c:1179
+#: rfc2131.c:438
+#: rfc2131.c:1179
 msgid "address in use"
-msgstr ""
+msgstr "Adresse in Nutzung"
 
-#: rfc2131.c:452 rfc2131.c:995
+#: rfc2131.c:452
+#: rfc2131.c:995
 msgid "no address available"
-msgstr ""
+msgstr "Keine Adresse verfügbar"
 
-#: rfc2131.c:459 rfc2131.c:1142
+#: rfc2131.c:459
+#: rfc2131.c:1142
 msgid "wrong network"
-msgstr ""
+msgstr "Falsches Netzwerk"
 
 #: rfc2131.c:474
 msgid "no address configured"
-msgstr ""
+msgstr "Keine Adresse konfiguriert"
 
-#: rfc2131.c:480 rfc2131.c:1192
+#: rfc2131.c:480
+#: rfc2131.c:1192
 msgid "no leases left"
-msgstr ""
+msgstr "Keine Leases übrig"
 
-#: rfc2131.c:564 rfc3315.c:362
+#: rfc2131.c:564
+#: rfc3315.c:362
 #, c-format
 msgid "%u client provides name: %s"
 msgstr "%u Klient stellt Name bereit: %s"
@@ -1376,7 +1387,8 @@ msgstr "%u Benutzerklasse: %s"
 msgid "PXE BIS not supported"
 msgstr "PXE BIS nicht unterstützt"
 
-#: rfc2131.c:911 rfc3315.c:1098
+#: rfc2131.c:911
+#: rfc3315.c:1098
 #, c-format
 msgid "disabling DHCP static address %s for %s"
 msgstr "schalte statische DHCP-Adresse %s für %s ab"
@@ -1384,9 +1396,10 @@ msgstr "schalte statische DHCP-Adresse %s für %s ab"
 # FIXME: do not assemble
 #: rfc2131.c:932
 msgid "unknown lease"
-msgstr ""
+msgstr "Unbekannter Lease"
 
-#: rfc2131.c:964 rfc3315.c:556
+#: rfc2131.c:964
+#: rfc3315.c:556
 #, c-format
 msgid "not using configured address %s because it is leased to %s"
 msgstr "benutze konfigurierte Adresse %s nicht, weil sie an %s verleast ist"
@@ -1396,39 +1409,41 @@ msgstr "benutze konfigurierte Adresse %s nicht, weil sie an %s verleast ist"
 msgid "not using configured address %s because it is in use by the server or relay"
 msgstr "benutze konfigurierte Adresse %s nicht, weil sie von Server/Relais verwendet wird"
 
-#: rfc2131.c:977 rfc3315.c:560
+#: rfc2131.c:977
+#: rfc3315.c:560
 #, c-format
 msgid "not using configured address %s because it was previously declined"
 msgstr "benutze konfigurierte Adresse %s nicht, weil sie zuvor abgelehnt wurde"
 
 # FIXME: do not assemble
-#: rfc2131.c:993 rfc2131.c:1185
+#: rfc2131.c:993
+#: rfc2131.c:1185
 msgid "no unique-id"
-msgstr ""
+msgstr "Keine eindeutige ID"
 
 #: rfc2131.c:1080
 msgid "wrong server-ID"
-msgstr ""
+msgstr "Falsche Server-ID"
 
 #: rfc2131.c:1099
 msgid "wrong address"
-msgstr ""
+msgstr "Falsche Adresse"
 
 #: rfc2131.c:1117
 msgid "lease not found"
-msgstr ""
+msgstr "Lease nicht gefunden"
 
 #: rfc2131.c:1150
 msgid "address not available"
-msgstr ""
+msgstr "Adresse nicht verfügbar"
 
 #: rfc2131.c:1161
 msgid "static lease available"
-msgstr ""
+msgstr "Statischer Lease verfügbar"
 
 #: rfc2131.c:1165
 msgid "address reserved"
-msgstr ""
+msgstr "Adresse reserviert"
 
 #: rfc2131.c:1173
 #, c-format
@@ -1464,7 +1479,8 @@ msgstr "kann DHCP/BOOTP-Opition %d nicht setzen: kein Platz mehr im Paket"
 msgid "PXE menu too large"
 msgstr "PXE-Menüeintrag zu groß"
 
-#: rfc2131.c:2117 rfc3315.c:1294
+#: rfc2131.c:2117
+#: rfc3315.c:1294
 #, c-format
 msgid "%u requested options: %s"
 msgstr "%u angeforderte Optionen: %s"
@@ -1508,7 +1524,7 @@ msgstr "DHCP-Anfrage für nicht unterstützen Hardwaretyp (%d) auf %s empfangen"
 
 #: helper.c:140
 msgid "lease() function missing in Lua script"
-msgstr ""
+msgstr "Die Funktion lease() fehlt im Lua-Script"
 
 #: tftp.c:285
 msgid "unable to get free port for TFTP"
@@ -1556,37 +1572,37 @@ msgstr "Start fehlgeschlagen"
 #: conntrack.c:65
 #, c-format
 msgid "Conntrack connection mark retrieval failed: %s"
-msgstr ""
+msgstr "\"Conntrack connection mark\"-Abruf fehlgeschlagen: %s"
 
 #: dhcp6.c:46
-#, fuzzy, c-format
+#, c-format
 msgid "cannot create DHCPv6 socket: %s"
-msgstr "kann DHCP-Socket nicht erzeugen: %s"
+msgstr "Kann DHCPv6-Socket nicht erzeugen: %s"
 
 #: dhcp6.c:57
-#, fuzzy, c-format
+#, c-format
 msgid "failed to bind DHCPv6 server socket: %s"
-msgstr "kann nicht an DHCP-Server-Socket binden: %s"
+msgstr "Kann nicht an DHCPv6-Server-Socket binden: %s"
 
 #: rfc3315.c:94
 #, c-format
 msgid "no address range available for DHCPv6 request from relay at %s"
-msgstr ""
+msgstr "Kein Adressbereich verfügbar für die DHCPv6-Anfrage vom Relay bei %s"
 
 #: rfc3315.c:103
 #, c-format
 msgid "no address range available for DHCPv6 request via %s"
-msgstr ""
+msgstr "Kein Adressbereich verfügbar für die DHCPv6-Anfrage via %s"
 
 #: rfc3315.c:206
-#, fuzzy, c-format
+#, c-format
 msgid "%u available DHCPv6 subnet: %s/%d"
-msgstr "%u verfügbare(s) DHCP-Subnetz: %s/%s"
+msgstr "%u verfügbare(s) DHCPv6-Subnetz: %s/%d"
 
 #: dhcp-common.c:138
 #, c-format
 msgid "Ignoring duplicate dhcp-option %d"
-msgstr ""
+msgstr "Ignoriere doppelt vorhandene DHCP-Option %d"
 
 #: dhcp-common.c:208
 #, c-format
@@ -1614,14 +1630,14 @@ msgid "duplicate IP address %s (%s) in dhcp-config directive"
 msgstr "doppelte IP-Adresse %s (%s) in \"dhcp-config\"-Anweisung"
 
 #: dhcp-common.c:443
-#, fuzzy, c-format
+#, c-format
 msgid "failed to join DHCPv6 multicast group: %s"
-msgstr "kann nicht an DHCP-Server-Socket binden: %s"
+msgstr "Konnte DHCPv6-Multicast-Gruppe nicht beitreten: %s"
 
 #: radv.c:76
-#, fuzzy, c-format
+#, c-format
 msgid "cannot create ICMPv6 socket: %s"
-msgstr "kann DHCP-Socket nicht erzeugen: %s"
+msgstr "Kann ICMPv6-Socket nicht erzeugen: %s"
 
 #, fuzzy
 #~ msgid "Specify path to Lua script (no default)."

src/cache.c

@@ -25,6 +25,9 @@ static int cache_inserted = 0, cache_live_freed = 0, insert_error;
 static union bigname *big_free = NULL;
 static int bignames_left, hash_size;
 static int uid = 0;
+#ifdef HAVE_DNSSEC
+static struct keydata *keyblock_free = NULL;
+#endif
 
 /* type->string mapping: this is also used by the name-hash function as a mixing table. */
 static const struct {
@@ -190,6 +193,10 @@ static void cache_free(struct crec *crecp)
       big_free = crecp->name.bname;
       crecp->flags &= ~F_BIGNAME;
     }
+#ifdef HAVE_DNSSEC
+  else if (crecp->flags & (F_DNSKEY | F_DS))
+    keydata_free(crecp->addr.key.keydata);
+#endif
 }    
 
 /* insert a new cache entry at the head of the list (youngest entry) */
@@ -233,7 +240,11 @@ static int is_outdated_cname_pointer(struct crec *crecp)
   if (!(crecp->flags & F_CNAME))
     return 0;
   
-  if (crecp->addr.cname.cache && crecp->addr.cname.uid == crecp->addr.cname.cache->uid)
+  /* NB. record may be reused as DS or DNSKEY, where uid is 
+     overloaded for something completely different */
+  if (crecp->addr.cname.cache && 
+      (crecp->addr.cname.cache->flags & (F_IPV4 | F_IPV6)) &&
+      crecp->addr.cname.uid == crecp->addr.cname.cache->uid)
     return 0;
   
   return 1;
@@ -280,7 +291,7 @@ static int cache_scan_free(char *name, struct all_addr *addr, time_t now, unsign
 	      }
 	  } 
 	else if ((crecp->flags & F_FORWARD) && 
-		 ((flags & crecp->flags & (F_IPV4 | F_IPV6)) || ((crecp->flags | flags) & F_CNAME)) &&
+		 ((flags & crecp->flags & F_TYPE) || ((crecp->flags | flags) & F_CNAME)) &&
 		 hostname_isequal(cache_get_name(crecp), name))
 	  {
 	    if (crecp->flags & (F_HOSTS | F_DHCP))
@@ -360,7 +371,9 @@ struct crec *cache_insert(char *name, struct all_addr *addr,
   int freed_all = flags & F_REVERSE;
   int free_avail = 0;
 
-  log_query(flags | F_UPSTREAM, name, addr, NULL);
+  /* Don't log keys */
+  if (flags & (F_IPV4 | F_IPV6))
+    log_query(flags | F_UPSTREAM, name, addr, NULL);
 
   /* if previous insertion failed give up now. */
   if (insert_error)
@@ -452,9 +465,7 @@ struct crec *cache_insert(char *name, struct all_addr *addr,
 
   if (addr)
     new->addr.addr = *addr;
-  else
-    new->addr.cname.cache = NULL;
-  
+
   new->ttd = now + (time_t)ttl;
   new->next = new_chain;
   new_chain = new;
@@ -1150,22 +1161,35 @@ void dump_cache(time_t now)
 		if (!is_outdated_cname_pointer(cache))
 		  a = cache_get_name(cache->addr.cname.cache);
 	      }
-#ifdef HAVE_IPV6
+#ifdef HAVE_DNSSEC
+	    else if (cache->flags & F_DNSKEY)
+	      {
+		a = daemon->addrbuff;
+		sprintf(a, "%3u %u", cache->addr.key.algo, cache->uid);
+	      }
+	    else if (cache->flags & F_DS)
+	      {
+		a = daemon->addrbuff;
+		sprintf(a, "%5u %3u %3u %u", cache->addr.key.flags_or_keyid,
+			cache->addr.key.algo, cache->addr.key.digest, cache->uid);
+	      }
+#endif
 	    else 
 	      { 
 		a = daemon->addrbuff;
 		if (cache->flags & F_IPV4)
 		  inet_ntop(AF_INET, &cache->addr.addr, a, ADDRSTRLEN);
+#ifdef HAVE_IPV6
 		else if (cache->flags & F_IPV6)
 		  inet_ntop(AF_INET6, &cache->addr.addr, a, ADDRSTRLEN);
-	      }
-#else
-            else 
-	      a = inet_ntoa(cache->addr.addr.addr.addr4);
 #endif
-	    p += sprintf(p, "%-30.30s %s%s%s%s%s%s%s%s%s%s  ", a, 
+	      }
+
+	    p += sprintf(p, "%-30.30s %s%s%s%s%s%s%s%s%s%s%s%s%s  ", a, 
 			 cache->flags & F_IPV4 ? "4" : "",
 			 cache->flags & F_IPV6 ? "6" : "",
+			 cache->flags & F_DNSKEY ? "K" : "",
+			 cache->flags & F_DS ? "S" : "",
 			 cache->flags & F_CNAME ? "C" : "",
 			 cache->flags & F_FORWARD ? "F" : " ",
 			 cache->flags & F_REVERSE ? "R" : " ",
@@ -1173,7 +1197,8 @@ void dump_cache(time_t now)
 			 cache->flags & F_DHCP ? "D" : " ",
 			 cache->flags & F_NEG ? "N" : " ",
 			 cache->flags & F_NXDOMAIN ? "X" : " ",
-			 cache->flags & F_HOSTS ? "H" : " ");
+			 cache->flags & F_HOSTS ? "H" : " ",
+			 cache->flags & F_DNSSECOK ? "V" : " ");
 #ifdef HAVE_BROKEN_RTC
 	    p += sprintf(p, "%lu", cache->flags & F_IMMORTAL ? 0: (unsigned long)(cache->ttd - now));
 #else
@@ -1287,3 +1312,50 @@ void log_query(unsigned int flags, char *name, struct all_addr *addr, char *arg)
   my_syslog(LOG_INFO, "%s %s %s %s", source, name, verb, dest);
 }
 
+#ifdef HAVE_DNSSEC
+struct keydata *keydata_alloc(char *data, size_t len)
+{
+  struct keydata *block, *ret = NULL;
+  struct keydata **prev = &ret;
+  while (len > 0)
+    {
+      if (keyblock_free)
+	{
+	  block = keyblock_free;
+	  keyblock_free = block->next;
+	}
+      else
+	block = whine_malloc(sizeof(struct keydata));
+
+      if (!block)
+	{
+	  /* failed to alloc, free partial chain */
+	  keydata_free(ret);
+	  return NULL;
+	}
+      
+      memcpy(block->key, data, len > KEYBLOCK_LEN ? KEYBLOCK_LEN : len);
+      data += KEYBLOCK_LEN;
+      len -= KEYBLOCK_LEN;
+      *prev = block;
+      prev = &block->next;
+      block->next = NULL;
+    }
+  
+  return ret;
+}
+
+void keydata_free(struct keydata *blocks)
+{
+  struct keydata *tmp;
+
+  if (blocks)
+    {
+      for (tmp = blocks; tmp->next; tmp = tmp->next);
+      tmp->next = keyblock_free;
+      keyblock_free = blocks;
+    }
+}
+#endif
+
+      

src/config.h

@@ -18,6 +18,7 @@
 #define MAX_PROCS 20 /* max no children for TCP requests */
 #define CHILD_LIFETIME 150 /* secs 'till terminated (RFC1035 suggests > 120s) */
 #define EDNS_PKTSZ 4096 /* default max EDNS.0 UDP packet from RFC5625 */
+#define KEYBLOCK_LEN 140 /* choose to mininise fragmentation when storing DNSSEC keys */
 #define TIMEOUT 10 /* drop UDP queries after TIMEOUT seconds */
 #define FORWARD_TEST 50 /* try all servers every 50 queries */
 #define FORWARD_TIME 20 /* or 20 seconds */
@@ -167,7 +168,7 @@ HAVE_SOLARIS_NETWORK
    define exactly one of these to alter interaction with kernel networking.
 
 HAVE_GETOPT_LONG
-   defined when GNU-sty;e getopt_long available. 
+   defined when GNU-style getopt_long available. 
 
 HAVE_ARC4RANDOM
    defined if arc4random() available to get better security from DNS spoofs

src/dhcp-common.c

@@ -111,6 +111,13 @@ struct dhcp_netid *option_filter(struct dhcp_netid *tags, struct dhcp_netid *con
       last_tag->next = tags;
       tagif = run_tag_if(context_tags);
       
+      /* reset stuff with tag:!<tag> which now matches. */
+      for (opt = opts; opt; opt = opt->next)
+	if (!(opt->flags & (DHOPT_ENCAPSULATE | DHOPT_VENDOR | DHOPT_RFC3925)) &&
+	    (opt->flags & DHOPT_TAGOK) &&
+	    !match_netid(opt->netid, tagif, 0))
+	  opt->flags &= ~DHOPT_TAGOK;
+
       for (opt = opts; opt; opt = opt->next)
 	if (!(opt->flags & (DHOPT_ENCAPSULATE | DHOPT_VENDOR | DHOPT_RFC3925 | DHOPT_TAGOK)) &&
 	    match_netid(opt->netid, tagif, 0))
@@ -400,10 +407,11 @@ static int join_multicast_worker(struct in6_addr *local, int prefix,
       return 1;
 
   /* weird libvirt-inspired access control */
-  for (context = daemon->dhcp6; context; context = context->next)
+  for (context = daemon->ra_contexts ? daemon->ra_contexts : daemon->dhcp6; 
+       context; context = context->next)
     if (!context->interface || strcmp(context->interface, ifrn_name) == 0)
       break;
-
+  
   if (!context)
     return 1;
   
@@ -444,6 +452,41 @@ void join_multicast(void)
 }
 #endif
 
+#ifdef HAVE_LINUX_NETWORK 
+void bindtodevice(int fd)
+{
+  /* If we are doing DHCP on exactly one interface, and running linux, do SO_BINDTODEVICE
+     to that device. This is for the use case of  (eg) OpenStack, which runs a new
+     dnsmasq instance for each VLAN interface it creates. Without the BINDTODEVICE, 
+     individual processes don't always see the packets they should.
+     SO_BINDTODEVICE is only available Linux. */
+  
+  struct irec *iface, *found;
+
+  for (found = NULL, iface = daemon->interfaces; iface; iface = iface->next)
+    if (iface->dhcp_ok)
+      {
+	if (!found)
+	  found = iface;
+	else if (strcmp(found->name, iface->name) != 0) 
+	  {
+	    /* more than one. */
+	    found = NULL;
+	    break;
+	  }
+      }
+  
+  if (found)
+	{
+	  struct ifreq ifr;
+	  strcpy(ifr.ifr_name, found->name);
+	  /* only allowed by root. */
+	  if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, (void *)&ifr, sizeof(ifr)) == -1 &&
+	      errno != EPERM)
+	    die(_("failed to set SO_BINDTODEVICE on DHCP socket: %s"), NULL, EC_BADNET);
+	}
+}
+#endif
 
 static const struct opttab_t {
   char *name;

src/dhcp.c

@@ -66,7 +66,7 @@ static int make_fd(int port)
   /* When bind-interfaces is set, there might be more than one dnmsasq
      instance binding port 67. That's OK if they serve different networks.
      Need to set REUSEADDR to make this posible, or REUSEPORT on *BSD. */
-  if (option_bool(OPT_NOWILD))
+  if (option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND))
     {
 #ifdef SO_REUSEPORT
       int rc = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &oneopt, sizeof(oneopt));

src/dhcp6-protocol.h

@@ -54,6 +54,7 @@
 #define OPTION6_RECONFIGURE_MSG 19
 #define OPTION6_RECONF_ACCEPT   20
 #define OPTION6_DNS_SERVER      23
+#define OPTION6_DOMAIN_SEARCH   24
 #define OPTION6_REMOTE_ID       37
 #define OPTION6_SUBSCRIBER_ID   38
 #define OPTION6_FQDN            39

src/dhcp6.c

@@ -33,12 +33,12 @@ void dhcp6_init(void)
 {
   int fd;
   struct sockaddr_in6 saddr;
-#if defined(IP_TOS) && defined(IPTOS_CLASS_CS6)
+#if defined(IPV6_TCLASS) && defined(IPTOS_CLASS_CS6)
   int class = IPTOS_CLASS_CS6;
 #endif
   
   if ((fd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_UDP)) == -1 ||
-#if defined(IP_TOS) && defined(IPTOS_CLASS_CS6)
+#if defined(IPV6_TCLASS) && defined(IPTOS_CLASS_CS6)
       setsockopt(fd, IPPROTO_IPV6, IPV6_TCLASS, &class, sizeof(class)) == -1 ||
 #endif
       !fix_fd(fd) ||
@@ -229,7 +229,7 @@ int address6_allocate(struct dhcp_context *context,  unsigned char *clid, int cl
   
   for (pass = 0; pass <= 1; pass++)
     for (c = context; c; c = c->current)
-      if (c->flags & (CONTEXT_STATIC | CONTEXT_RA_STATELESS))
+      if (c->flags & (CONTEXT_DEPRECATE | CONTEXT_STATIC | CONTEXT_RA_STATELESS))
 	continue;
       else if (!match_netid(c->filter, netids, pass))
 	continue;
@@ -282,9 +282,9 @@ struct dhcp_context *address6_available(struct dhcp_context *context,
       start = addr6part(&tmp->start6);
       end = addr6part(&tmp->end6);
 
-      if (!(tmp->flags & (CONTEXT_STATIC | CONTEXT_PROXY)) &&
-          is_same_net6(&context->start6, taddr, context->prefix) &&
-	  is_same_net6(&context->end6, taddr, context->prefix) &&
+      if (!(tmp->flags & (CONTEXT_STATIC | CONTEXT_RA_STATELESS)) &&
+          is_same_net6(&tmp->start6, taddr, tmp->prefix) &&
+	  is_same_net6(&tmp->end6, taddr, tmp->prefix) &&
 	  addr >= start &&
           addr <= end &&
           match_netid(tmp->filter, netids, 1))

src/dnsmasq.c

@@ -114,8 +114,16 @@ int main (int argc, char **argv)
       set_option_bool(OPT_NOWILD);
     }
 #  endif
+  
+  /* -- bind-dynamic not supported on !Linux, fall back to --bind-interfaces */
+  if (option_bool(OPT_CLEVERBIND))
+    {
+      bind_fallback = 1;
+      set_option_bool(OPT_NOWILD);
+      reset_option_bool(OPT_CLVERBIND);
+    }
 #endif
-
+  
 #ifndef HAVE_TFTP
   if (daemon->tftp_unlimited || daemon->tftp_interfaces)
     die(_("TFTP server not available: set HAVE_TFTP in src/config.h"), NULL, EC_BADCONF);
@@ -185,6 +193,9 @@ int main (int argc, char **argv)
 #ifdef HAVE_LINUX_NETWORK
   /* After lease_init */
   netlink_init();
+
+  if (option_bool(OPT_NOWILD) && option_bool(OPT_CLEVERBIND))
+    die(_("cannot set --bind-interfaces and --bind-dynamic"), NULL, EC_BADCONF);
 #endif
 
 #ifdef HAVE_DHCP6
@@ -202,13 +213,29 @@ int main (int argc, char **argv)
   if (!enumerate_interfaces())
     die(_("failed to find list of interfaces: %s"), NULL, EC_MISC);
   
-  if (option_bool(OPT_NOWILD)) 
+  if (option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND)) 
     {
       create_bound_listeners(1);
+      
+      if (!option_bool(OPT_CLEVERBIND))
+	for (if_tmp = daemon->if_names; if_tmp; if_tmp = if_tmp->next)
+	  if (if_tmp->name && !if_tmp->used)
+	    die(_("unknown interface %s"), if_tmp->name, EC_BADNET);
 
-      for (if_tmp = daemon->if_names; if_tmp; if_tmp = if_tmp->next)
-	if (if_tmp->name && !if_tmp->used)
-	  die(_("unknown interface %s"), if_tmp->name, EC_BADNET);
+#if defined(HAVE_LINUX_NETWORK) && defined(HAVE_DHCP)
+      /* after enumerate_interfaces()  */
+      if (daemon->dhcp)
+	{
+	  bindtodevice(daemon->dhcpfd);
+	  if (daemon->enable_pxe)
+	    bindtodevice(daemon->pxefd);
+	}
+#endif
+
+#if defined(HAVE_LINUX_NETWORK) && defined(HAVE_DHCP6)
+      if (daemon->dhcp6)
+	bindtodevice(daemon->dhcp6fd);
+#endif
     }
   else 
     create_wildcard_listeners();
@@ -410,8 +437,9 @@ int main (int argc, char **argv)
 #if defined(HAVE_LINUX_NETWORK)	  
 	  /* On linux, we keep CAP_NETADMIN (for ARP-injection) and
 	     CAP_NET_RAW (for icmp) if we're doing dhcp. If we have yet to bind 
-	     ports because of DAD, we need CAP_NET_BIND_SERVICE too. */
-	  if (is_dad_listeners())
+	     ports because of DAD, or we're doing it dynamically,
+	     we need CAP_NET_BIND_SERVICE too. */
+	  if (is_dad_listeners() || option_bool(OPT_CLEVERBIND))
 	    data->effective = data->permitted = data->inheritable =
 	      (1 << CAP_NET_ADMIN) | (1 << CAP_NET_RAW) | 
 	      (1 << CAP_SETUID) | (1 << CAP_NET_BIND_SERVICE);
@@ -459,7 +487,7 @@ int main (int argc, char **argv)
 	    }     
 
 #ifdef HAVE_LINUX_NETWORK
-	 if (is_dad_listeners())
+	  if (is_dad_listeners() || option_bool(OPT_CLEVERBIND))
 	   data->effective = data->permitted =
 	     (1 << CAP_NET_ADMIN) | (1 << CAP_NET_RAW) | (1 << CAP_NET_BIND_SERVICE);
 	 else
@@ -483,6 +511,34 @@ int main (int argc, char **argv)
     prctl(PR_SET_DUMPABLE, 1, 0, 0, 0);
 #endif
 
+#ifdef HAVE_TFTP
+  if (daemon->tftp_unlimited || daemon->tftp_interfaces)
+    {
+      DIR *dir;
+      struct tftp_prefix *p;
+      
+      if (daemon->tftp_prefix)
+	{
+	  if (!((dir = opendir(daemon->tftp_prefix))))
+	    {
+	      send_event(err_pipe[1], EVENT_TFTP_ERR, errno, daemon->tftp_prefix);
+	      _exit(0);
+	    }
+	  closedir(dir);
+	}
+
+      for (p = daemon->if_prefix; p; p = p->next)
+	{
+	  if (!((dir = opendir(p->prefix))))
+	   {
+	     send_event(err_pipe[1], EVENT_TFTP_ERR, errno, p->prefix);
+	     _exit(0);
+	   } 
+	  closedir(dir);
+	}
+    }
+#endif
+
   if (daemon->port == 0)
     my_syslog(LOG_INFO, _("started, version %s DNS disabled"), VERSION);
   else if (daemon->cachesize != 0)
@@ -530,7 +586,7 @@ int main (int argc, char **argv)
     my_syslog(MS_DHCP | LOG_INFO, _("IPv6 router advertisement enabled"));
 
 #ifdef HAVE_DHCP
-  if (daemon->dhcp || daemon->dhcp6)
+  if (daemon->dhcp || daemon->dhcp6 || daemon->ra_contexts)
     {
       struct dhcp_context *dhcp_tmp;
       int family = AF_INET;
@@ -543,7 +599,7 @@ int main (int argc, char **argv)
 	{
 	  void *start = &dhcp_tmp->start;
 	  void *end = &dhcp_tmp->end;
-	  
+	  	  
 #ifdef HAVE_DHCP6
 	  if (family == AF_INET6)
 	    {
@@ -551,28 +607,48 @@ int main (int argc, char **argv)
 	      end = &dhcp_tmp->end6;
 	      struct in6_addr subnet = dhcp_tmp->start6;
 	      setaddr6part(&subnet, 0);
-	      inet_ntop(AF_INET6, &subnet, daemon->dhcp_buff2, 256);
+	      inet_ntop(AF_INET6, &subnet, daemon->addrbuff, 256);
 	    }
 #endif
 	  
-	  prettyprint_time(daemon->namebuff, dhcp_tmp->lease_time);
-	  inet_ntop(family, start, daemon->dhcp_buff, 256);
-	  inet_ntop(family, end, daemon->dhcp_buff3, 256);
+	  if (family != AF_INET && (dhcp_tmp->flags & CONTEXT_DEPRECATE))
+	    strcpy(daemon->namebuff, _("prefix deprecated"));
+	  else
+	    {
+	      char *p = daemon->namebuff;
+	      p += sprintf(p, _("lease time "));
+	      prettyprint_time(p, dhcp_tmp->lease_time);
+	    }
+	  
+	  if (daemon->dhcp_buff)
+	    inet_ntop(family, start, daemon->dhcp_buff, 256);
+	  if (daemon->dhcp_buff3)
+	    inet_ntop(family, end, daemon->dhcp_buff3, 256);
 	  if ((dhcp_tmp->flags & CONTEXT_DHCP) || family == AF_INET) 
 	    my_syslog(MS_DHCP | LOG_INFO, 
-		      (dhcp_tmp->flags & CONTEXT_STATIC) ? 
-		      _("DHCP, static leases only on %.0s%s, lease time %s") :
 		      (dhcp_tmp->flags & CONTEXT_RA_STATELESS) ? 
-		      _("SLAAC and stateless DHCPv6 on %.0s%s%.0s") :
+		      _("stateless DHCPv6 on %s%.0s%.0s") :
+		      (dhcp_tmp->flags & CONTEXT_STATIC) ? 
+		      _("DHCP, static leases only on %.0s%s, %s") :
 		      (dhcp_tmp->flags & CONTEXT_PROXY) ?
 		      _("DHCP, proxy on subnet %.0s%s%.0s") :
-		      _("DHCP, IP range %s -- %s, lease time %s"),
+		      _("DHCP, IP range %s -- %s, %s"),
 		      daemon->dhcp_buff, daemon->dhcp_buff3, daemon->namebuff);
+
 	  if (dhcp_tmp->flags & CONTEXT_RA_NAME)
-	    my_syslog(MS_DHCP | LOG_INFO, _("SLAAC and DHCPv4-derived names on %s"), daemon->dhcp_buff2);
-	  if (dhcp_tmp->flags & CONTEXT_RA_ONLY)
-	    my_syslog(MS_DHCP | LOG_INFO, _("SLAAC on %s"), daemon->dhcp_buff2);
- 
+	    my_syslog(MS_DHCP | LOG_INFO, _("DHCPv4-derived IPv6 names on %s"), 
+		      daemon->addrbuff);
+	  if (dhcp_tmp->flags & (CONTEXT_RA_ONLY | CONTEXT_RA_NAME | CONTEXT_RA_STATELESS))
+	    {
+	      if (!(dhcp_tmp->flags & CONTEXT_DEPRECATE))
+		{
+		  char *p = daemon->namebuff;
+		  p += sprintf(p, _("prefix valid "));
+		  prettyprint_time(p, dhcp_tmp->lease_time > 7200 ? dhcp_tmp->lease_time : 7200);
+		}
+	      my_syslog(MS_DHCP | LOG_INFO, _("SLAAC on %s %s"), 
+			daemon->addrbuff, daemon->namebuff);
+	    }
 	}
       
 #ifdef HAVE_DHCP6
@@ -814,14 +890,11 @@ int main (int argc, char **argv)
 	}
 
 #ifdef HAVE_DHCP6
-      if (daemon->dhcp6)
-	{
-	  if (FD_ISSET(daemon->dhcp6fd, &rset))
-	    dhcp6_packet(now);
+      if (daemon->dhcp6 && FD_ISSET(daemon->dhcp6fd, &rset))
+	dhcp6_packet(now);
 
-	  if (daemon->ra_contexts && FD_ISSET(daemon->icmp6fd, &rset))
-	    icmp6_packet();
-	}
+      if (daemon->ra_contexts && FD_ISSET(daemon->icmp6fd, &rset))
+	icmp6_packet();
 #endif
 
 #  ifdef HAVE_SCRIPT
@@ -963,6 +1036,9 @@ static void fatal_event(struct event_desc *ev, char *msg)
     
     case EVENT_LUA_ERR:
       die(_("failed to load Lua script: %s"), msg, EC_MISC);
+
+    case EVENT_TFTP_ERR:
+      die(_("TFTP directory %s inaccessible: %s"), msg, EC_FILE);
     }
 }	
       
@@ -1174,13 +1250,9 @@ void clear_cache_and_reload(time_t now)
     }
 #ifdef HAVE_DHCP6
   else if (daemon->ra_contexts)
-    {
-      /* Not doing DHCP, so no lease system, manage 
-	 alarms for ra only */
-      time_t next_event = periodic_ra(now);
-      if (next_event != 0)
-	alarm((unsigned)difftime(next_event, now)); 
-    }
+    /* Not doing DHCP, so no lease system, manage 
+       alarms for ra only */
+    send_alarm(periodic_ra(now), now);
 #endif
 #endif
 }
@@ -1293,7 +1365,7 @@ static void check_dns_listeners(fd_set *set, time_t now)
 	      getsockname(confd, (struct sockaddr *)&tcp_addr, &tcp_len) == -1)
 	    continue;
 	  
-	  if (option_bool(OPT_NOWILD))
+	  if (option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND))
 	    iface = listener->iface; /* May be NULL */
 	  else
 	    {
@@ -1310,7 +1382,7 @@ static void check_dns_listeners(fd_set *set, time_t now)
 		    break;
 	    }
 	  
-	  if (!iface && !option_bool(OPT_NOWILD))
+	  if (!iface && !(option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND)))
 	    {
 	      shutdown(confd, SHUT_RDWR);
 	      close(confd);

src/dnsmasq.h

@@ -159,6 +159,7 @@ struct event_desc {
 #define EVENT_LOG_ERR   17
 #define EVENT_FORK_ERR  18
 #define EVENT_LUA_ERR   19
+#define EVENT_TFTP_ERR  20
 
 /* Exit codes. */
 #define EC_GOOD        0
@@ -217,7 +218,9 @@ struct event_desc {
 #define OPT_CONNTRACK      35
 #define OPT_FQDN_UPDATE    36
 #define OPT_RA             37
-#define OPT_LAST           38
+#define OPT_TFTP_LC        38
+#define OPT_CLEVERBIND     39
+#define OPT_LAST           40
 
 /* extra flags for my_syslog, we use a couple of facilities since they are known 
    not to occupy the same bits as priorities, no matter how syslog.h is set up. */
@@ -297,17 +300,30 @@ union bigname {
   union bigname *next; /* freelist */
 };
 
+struct keydata {
+  struct keydata *next;
+  unsigned char key[KEYBLOCK_LEN];
+};
+
 struct crec { 
   struct crec *next, *prev, *hash_next;
-  time_t ttd; /* time to die */
-  int uid; 
+  /* union is 16 bytes when doing IPv6, 8 bytes on 32 bit machines without IPv6 */
   union {
     struct all_addr addr;
     struct {
       struct crec *cache;
       int uid;
     } cname;
+    struct {
+      struct keydata *keydata;
+      unsigned char algo;
+      unsigned char digest; /* DS only */
+      unsigned short flags_or_keyid; /* flags for DNSKEY, keyid for DS */
+    } key;
   } addr;
+  time_t ttd; /* time to die */
+  /* used as keylen if F_DS or F_DNSKEY, index to source for F_HOSTS */
+  int uid; 
   unsigned short flags;
   union {
     char sname[SMALLDNAME];
@@ -328,14 +344,21 @@ struct crec {
 #define F_BIGNAME   (1u<<9)
 #define F_NXDOMAIN  (1u<<10)
 #define F_CNAME     (1u<<11)
-#define F_NOERR     (1u<<12)
+#define F_DNSKEY    (1u<<12)
 #define F_CONFIG    (1u<<13)
+#define F_DS        (1u<<14)
+#define F_DNSSECOK  (1u<<15)
+
 /* below here are only valid as args to log_query: cache
    entries are limited to 16 bits */
 #define F_UPSTREAM  (1u<<16)
 #define F_RRNAME    (1u<<17)
 #define F_SERVER    (1u<<18)
 #define F_QUERY     (1u<<19)
+#define F_NOERR     (1u<<20)
+/* composites */
+#define F_TYPE      (F_IPV4 | F_IPV6 | F_DNSKEY | F_DS) /* Only one may be set */
+
 
 
 /* struct sockaddr is not large enough to hold any address,
@@ -388,7 +411,7 @@ struct server {
 struct irec {
   union mysockaddr addr;
   struct in_addr netmask; /* only valid for IPv4 */
-  int tftp_ok, mtu, done, dad;
+  int tftp_ok, dhcp_ok, mtu, done, dad;
   char *name;
   struct irec *next;
 };
@@ -403,7 +426,7 @@ struct listener {
 struct iname {
   char *name;
   union mysockaddr addr;
-  int isloop, used;
+  int used;
   struct iname *next;
 };
 
@@ -655,6 +678,7 @@ struct dhcp_context {
 #define CONTEXT_RA_NAME       64
 #define CONTEXT_RA_STATELESS 128
 #define CONTEXT_DHCP         256
+#define CONTEXT_DEPRECATE    512
 
 struct ping_result {
   struct in_addr addr;
@@ -710,7 +734,7 @@ extern struct daemon {
   time_t last_resolv;
   struct mx_srv_record *mxnames;
   struct naptr *naptr;
-  struct txt_record *txt;
+  struct txt_record *txt, *rr;
   struct ptr_record *ptr;
   struct host_record *host_records, *host_records_tail;
   struct cname *cnames;
@@ -837,6 +861,10 @@ char *get_domain(struct in_addr addr);
 #ifdef HAVE_IPV6
 char *get_domain6(struct in6_addr *addr);
 #endif
+#ifdef HAVE_DNSSEC
+struct keydata *keydata_alloc(char *data, size_t len);
+void keydata_free(struct keydata *blocks);
+#endif
 
 /* rfc1035.c */
 unsigned int extract_request(struct dns_header *header, size_t qlen, 
@@ -904,6 +932,7 @@ char *option_string(int prot, unsigned int opt, unsigned char *val,
 		    int opt_len, char *buf, int buf_len);
 void reread_dhcp(void);
 void set_option_bool(unsigned int opt);
+void reset_option_bool(unsigned int opt);
 struct hostsfile *expand_filelist(struct hostsfile *list);
 
 /* forward.c */
@@ -915,7 +944,7 @@ void server_gone(struct server *server);
 struct frec *get_new_frec(time_t now, int *wait);
 int send_from(int fd, int nowild, char *packet, size_t len, 
 	       union mysockaddr *to, struct all_addr *source,
-	       unsigned int iface, int *errp);
+	       unsigned int iface);
 
 /* network.c */
 int indextoname(int fd, int index, char *name);
@@ -974,7 +1003,7 @@ u64 lease_find_max_addr6(struct dhcp_context *context);
 void lease_ping_reply(struct in6_addr *sender, unsigned char *packet, char *interface);
 #endif
 void lease_set_hwaddr(struct dhcp_lease *lease, unsigned char *hwaddr,
-		      unsigned char *clid, int hw_len, int hw_type, int clid_len, time_t now);
+		      unsigned char *clid, int hw_len, int hw_type, int clid_len, time_t now, int force);
 void lease_set_hostname(struct dhcp_lease *lease, char *name, int auth, char *domain, char *config_domain);
 void lease_set_expires(struct dhcp_lease *lease, unsigned int len, time_t now);
 void lease_set_interface(struct dhcp_lease *lease, int interface, time_t now);
@@ -1107,6 +1136,9 @@ u16 lookup_dhcp_opt(int prot, char *name);
 u16 lookup_dhcp_len(int prot, u16 val);
 char *option_string(int prot, unsigned int opt, unsigned char *val, 
 		    int opt_len, char *buf, int buf_len);
+#ifdef HAVE_LINUX_NETWORK
+void bindtodevice(int fd);
+#endif
 #  ifdef HAVE_DHCP6
 void display_opts6(void);
 void join_multicast(void);
@@ -1137,7 +1169,7 @@ void ra_start_unsolicted(time_t now, struct dhcp_context *context);
 /* slaac.c */ 
 #ifdef HAVE_DHCP6
 void build_subnet_map(void);
-void slaac_add_addrs(struct dhcp_lease *lease, time_t now);
+void slaac_add_addrs(struct dhcp_lease *lease, time_t now, int force);
 time_t periodic_slaac(time_t now, struct dhcp_lease *leases);
 void slaac_ping_reply(struct in6_addr *sender, unsigned char *packet, char *interface, struct dhcp_lease *leases);
 void schedule_subnet_map(void);

src/forward.c

@@ -28,7 +28,7 @@ static struct randfd *allocate_rfd(int family);
    unless nowild is true, when we just send it with the kernel default */
 int send_from(int fd, int nowild, char *packet, size_t len, 
 	      union mysockaddr *to, struct all_addr *source,
-	      unsigned int iface, int *errp)
+	      unsigned int iface)
 {
   struct msghdr msg;
   struct iovec iov[1]; 
@@ -110,10 +110,7 @@ int send_from(int fd, int nowild, char *packet, size_t len,
       if (retry_send())
 	goto retry;
       
-      if (errp)
-	*errp = errno;
-      else
-	my_syslog(LOG_ERR, _("failed to send packet: %s"), strerror(errno));
+      my_syslog(LOG_ERR, _("failed to send packet: %s"), strerror(errno));
       
       return 0;
     }
@@ -439,7 +436,7 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr,
   if (udpfd != -1)
     {
       plen = setup_reply(header, plen, addrp, flags, daemon->local_ttl);
-      send_from(udpfd, option_bool(OPT_NOWILD), (char *)header, plen, udpaddr, dst_addr, dst_iface, NULL);
+      send_from(udpfd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, plen, udpaddr, dst_addr, dst_iface);
     }
 
   return 0;
@@ -627,8 +624,8 @@ void reply_query(int fd, int family, time_t now)
 	{
 	  header->id = htons(forward->orig_id);
 	  header->hb4 |= HB4_RA; /* recursion if available */
-	  send_from(forward->fd, option_bool(OPT_NOWILD), daemon->packet, nn, 
-		    &forward->source, &forward->dest, forward->iface, NULL);
+	  send_from(forward->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn, 
+		    &forward->source, &forward->dest, forward->iface);
 	}
       free_frec(forward); /* cancel */
     }
@@ -822,8 +819,8 @@ void receive_query(struct listener *listen, time_t now)
 		      dst_addr_4, netmask, now);
   if (m >= 1)
     {
-      send_from(listen->fd, option_bool(OPT_NOWILD), (char *)header, 
-		m, &source_addr, &dst_addr, if_index, NULL);
+      send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
+		(char *)header, m, &source_addr, &dst_addr, if_index);
       daemon->local_answer++;
     }
   else if (forward_query(listen->fd, &source_addr, &dst_addr, if_index,

src/lease.c

@@ -98,7 +98,7 @@ void lease_init(time_t now)
 	      hw_type = ARPHRD_ETHER; 
 
 	    lease_set_hwaddr(lease, (unsigned char *)daemon->dhcp_buff2, (unsigned char *)daemon->packet, 
-			     hw_len, hw_type, clid_len, now);
+			     hw_len, hw_type, clid_len, now, 0);
 	    
 	    if (strcmp(daemon->dhcp_buff, "*") !=  0)
 	      lease_set_hostname(lease, daemon->dhcp_buff, 0, get_domain(lease->addr), NULL);
@@ -119,7 +119,7 @@ void lease_init(time_t now)
 	    
 	    if ((lease = lease6_allocate(&addr.addr.addr6, lease_type)))
 	      {
-		lease_set_hwaddr(lease, NULL, (unsigned char *)daemon->packet, 0, hw_type, clid_len, now);
+		lease_set_hwaddr(lease, NULL, (unsigned char *)daemon->packet, 0, hw_type, clid_len, now, 0);
 		
 		if (strcmp(daemon->dhcp_buff, "*") !=  0)
 		  lease_set_hostname(lease, daemon->dhcp_buff, 0, get_domain6((struct in6_addr *)lease->hwaddr), NULL);
@@ -310,12 +310,19 @@ void lease_update_file(time_t now)
   /* do timed RAs and determine when the next is, also pings to potential SLAAC addresses */
   if (daemon->ra_contexts)
     {
-      time_t ra_event = periodic_slaac(now, leases);
+      time_t event;
       
-      next_event = periodic_ra(now);
+      if ((event = periodic_slaac(now, leases)) != 0)
+	{
+	  if (next_event == 0 || difftime(next_event, event) > 0.0)
+	    next_event = event;
+	}
       
-      if (next_event == 0 || difftime(next_event, ra_event) > 0.0)
-	next_event = ra_event;
+      if ((event = periodic_ra(now)) != 0)
+	{
+	  if (next_event == 0 || difftime(next_event, event) > 0.0)
+	    next_event = event;
+	}
     }
 #endif
 
@@ -373,7 +380,10 @@ static int find_interface_v6(struct in6_addr *local,  int prefix,
 
 void lease_ping_reply(struct in6_addr *sender, unsigned char *packet, char *interface)
 {
-  slaac_ping_reply(sender, packet, interface, leases);
+  /* We may be doing RA but not DHCPv4, in which case the lease
+     database may not exist and we have nothing to do anyway */
+  if (daemon->dhcp)
+    slaac_ping_reply(sender, packet, interface, leases);
 }
 
 #endif
@@ -699,13 +709,16 @@ void lease_set_expires(struct dhcp_lease *lease, unsigned int len, time_t now)
 } 
 
 void lease_set_hwaddr(struct dhcp_lease *lease, unsigned char *hwaddr,
-		      unsigned char *clid, int hw_len, int hw_type, int clid_len, time_t now)
+		      unsigned char *clid, int hw_len, int hw_type, int clid_len, 
+		      time_t now, int force)
 {
 #ifdef HAVE_DHCP6
-  int change = 0;
+  int change = force;
   lease->flags |= LEASE_HAVE_HWADDR;
 #endif
 
+  (void)force;
+
   if (hw_len != lease->hwaddr_len ||
       hw_type != lease->hwaddr_type || 
       (hw_len != 0 && memcmp(lease->hwaddr, hwaddr, hw_len) != 0))
@@ -755,7 +768,7 @@ void lease_set_hwaddr(struct dhcp_lease *lease, unsigned char *hwaddr,
   
 #ifdef HAVE_DHCP6
   if (change)
-    slaac_add_addrs(lease, now);
+    slaac_add_addrs(lease, now, force);
 #endif
 }
 
@@ -883,7 +896,7 @@ void lease_set_interface(struct dhcp_lease *lease, int interface, time_t now)
   lease->flags |= LEASE_CHANGED; 
 
 #ifdef HAVE_DHCP6
-  slaac_add_addrs(lease, now);
+  slaac_add_addrs(lease, now, 0);
 #endif
 }
 

src/netlink.c

@@ -38,7 +38,7 @@
 static struct iovec iov;
 static u32 netlink_pid;
 
-static void nl_err(struct nlmsghdr *h);
+static int nl_async(struct nlmsghdr *h);
 static void nl_routechange(struct nlmsghdr *h);
 
 void netlink_init(void)
@@ -49,10 +49,13 @@ void netlink_init(void)
   addr.nl_family = AF_NETLINK;
   addr.nl_pad = 0;
   addr.nl_pid = 0; /* autobind */
-#ifdef HAVE_IPV6
-  addr.nl_groups = RTMGRP_IPV4_ROUTE | RTMGRP_IPV6_ROUTE;
-#else
   addr.nl_groups = RTMGRP_IPV4_ROUTE;
+  if (option_bool(OPT_CLEVERBIND))
+    addr.nl_groups |= RTMGRP_IPV4_IFADDR;
+#ifdef HAVE_IPV6
+  addr.nl_groups |= RTMGRP_IPV6_ROUTE;
+  if (daemon->ra_contexts || option_bool(OPT_CLEVERBIND))
+    addr.nl_groups |= RTMGRP_IPV6_IFADDR;
 #endif
   
   /* May not be able to have permission to set multicast groups don't die in that case */
@@ -136,7 +139,7 @@ int iface_enumerate(int family, void *parm, int (*callback)())
   struct nlmsghdr *h;
   ssize_t len;
   static unsigned int seq = 0;
-  int callback_ok = 1;
+  int callback_ok = 1, newaddr = 0;
 
   struct {
     struct nlmsghdr nlh;
@@ -182,12 +185,24 @@ int iface_enumerate(int family, void *parm, int (*callback)())
 	}
 
       for (h = (struct nlmsghdr *)iov.iov_base; NLMSG_OK(h, (size_t)len); h = NLMSG_NEXT(h, len))
-	if (h->nlmsg_seq != seq || h->nlmsg_pid != netlink_pid)
-	  nl_routechange(h); /* May be multicast arriving async */
-	else if (h->nlmsg_type == NLMSG_ERROR)
-	  nl_err(h);
+	if (h->nlmsg_seq != seq || h->nlmsg_pid != netlink_pid || h->nlmsg_type == NLMSG_ERROR)
+	  {
+	    /* May be multicast arriving async */
+	    if (nl_async(h) && option_bool(OPT_CLEVERBIND))
+	      newaddr = 1; 
+	  }
 	else if (h->nlmsg_type == NLMSG_DONE)
-	  return callback_ok;
+	  {
+	    /* handle async new interface address arrivals, these have to be done
+	       after we complete as we're not re-entrant */
+	    if (newaddr) 
+	      {
+		enumerate_interfaces();
+		create_bound_listeners(0);
+	      }
+	    
+	    return callback_ok;
+	  }
 	else if (h->nlmsg_type == RTM_NEWADDR && family != AF_UNSPEC && family != AF_LOCAL)
 	  {
 	    struct ifaddrmsg *ifa = NLMSG_DATA(h);  
@@ -295,7 +310,7 @@ void netlink_multicast(void)
 {
   ssize_t len;
   struct nlmsghdr *h;
-  int flags;
+  int flags, newaddr = 0;
   
   /* don't risk blocking reading netlink messages here. */
   if ((flags = fcntl(daemon->netlinkfd, F_GETFL)) == -1 ||
@@ -303,71 +318,83 @@ void netlink_multicast(void)
     return;
   
   if ((len = netlink_recv()) != -1)
-    {
-      for (h = (struct nlmsghdr *)iov.iov_base; NLMSG_OK(h, (size_t)len); h = NLMSG_NEXT(h, len))
-	if (h->nlmsg_type == NLMSG_ERROR)
-	  nl_err(h);
-	else
-	  nl_routechange(h);
-    }
-
-  /* restore non-blocking status */
-  fcntl(daemon->netlinkfd, F_SETFL, flags); 
-}
-
-static void nl_err(struct nlmsghdr *h)
-{
-  struct nlmsgerr *err = NLMSG_DATA(h);
+    for (h = (struct nlmsghdr *)iov.iov_base; NLMSG_OK(h, (size_t)len); h = NLMSG_NEXT(h, len))
+      if (nl_async(h) && option_bool(OPT_CLEVERBIND))
+	newaddr = 1;
   
-  if (err->error != 0)
-    my_syslog(LOG_ERR, _("netlink returns error: %s"), strerror(-(err->error)));
+  /* restore non-blocking status */
+  fcntl(daemon->netlinkfd, F_SETFL, flags);
+
+  if (newaddr) 
+    {
+      enumerate_interfaces();
+      create_bound_listeners(0);
+    }
 }
 
+static int nl_async(struct nlmsghdr *h)
+{
+  if (h->nlmsg_type == NLMSG_ERROR)
+    {
+      struct nlmsgerr *err = NLMSG_DATA(h);
+      my_syslog(LOG_ERR, _("netlink returns error: %s"), strerror(-(err->error)));
+      return 0;
+    }
+  else if (h->nlmsg_pid == 0 && h->nlmsg_type == RTM_NEWROUTE) 
+    {
+      nl_routechange(h);
+      return 0;
+    }
+  else if (h->nlmsg_type == RTM_NEWADDR) 
+	{
+#ifdef HAVE_DHCP6
+	  /* force RAs to sync new network and pick up new interfaces.  */
+	  if (daemon->ra_contexts)
+	    {
+	      schedule_subnet_map();
+	      ra_start_unsolicted(dnsmasq_time(), NULL);
+	      /* cause lease_update_file to run after we return, in case we were called from
+		 iface_enumerate and can't re-enter it now */
+	      send_alarm(0, 0);
+	    }
+	  return 1; /* clever bind mode - rescan */
+	}
+#endif	 
+
+  return 0;
+}
+  
 /* We arrange to receive netlink multicast messages whenever the network route is added.
    If this happens and we still have a DNS packet in the buffer, we re-send it.
    This helps on DoD links, where frequently the packet which triggers dialling is
    a DNS query, which then gets lost. By re-sending, we can avoid the lookup
-   failing. Note that we only accept these messages from the kernel (pid == 0) */ 
+   failing. */ 
 static void nl_routechange(struct nlmsghdr *h)
 {
-  if (h->nlmsg_pid == 0 && h->nlmsg_type == RTM_NEWROUTE)
+  struct rtmsg *rtm = NLMSG_DATA(h);
+  int fd;
+  
+  if (rtm->rtm_type != RTN_UNICAST || rtm->rtm_scope != RT_SCOPE_LINK)
+    return;
+  
+  /* Force re-reading resolv file right now, for luck. */
+  daemon->last_resolv = 0;
+  
+  if (daemon->srv_save)
     {
-      struct rtmsg *rtm = NLMSG_DATA(h);
-      int fd;
-
-      if (rtm->rtm_type != RTN_UNICAST || rtm->rtm_scope != RT_SCOPE_LINK)
+      if (daemon->srv_save->sfd)
+	fd = daemon->srv_save->sfd->fd;
+      else if (daemon->rfd_save && daemon->rfd_save->refcount != 0)
+	fd = daemon->rfd_save->fd;
+      else
 	return;
-
-      /* Force re-reading resolv file right now, for luck. */
-      daemon->last_resolv = 0;
       
-#ifdef HAVE_DHCP6
-      /* force RAs to sync new network and pick up new interfaces.  */
-      if (daemon->ra_contexts)
-	{
-	  schedule_subnet_map();
-	  ra_start_unsolicted(dnsmasq_time(), NULL);
-	  /* cause lease_update_file to run after we return, in case we were called from
-	     iface_enumerate and can't re-enter it now */
-	  send_alarm(0, 0);
-	}
-#endif
-
-      if (daemon->srv_save)
-	{
-	  if (daemon->srv_save->sfd)
-	    fd = daemon->srv_save->sfd->fd;
-	  else if (daemon->rfd_save && daemon->rfd_save->refcount != 0)
-	    fd = daemon->rfd_save->fd;
-	  else
-	    return;
-	  
-	  while(sendto(fd, daemon->packet, daemon->packet_len, 0,
-		       &daemon->srv_save->addr.sa, sa_len(&daemon->srv_save->addr)) == -1 && retry_send()); 
-	}
+      while(sendto(fd, daemon->packet, daemon->packet_len, 0,
+		   &daemon->srv_save->addr.sa, sa_len(&daemon->srv_save->addr)) == -1 && retry_send()); 
     }
 }
 
+
 #endif
 
       

src/network.c

@@ -162,6 +162,7 @@ static int iface_allowed(struct irec **irecp, int if_index,
   int fd, mtu = 0, loopback;
   struct ifreq ifr;
   int tftp_ok = daemon->tftp_unlimited;
+  int dhcp_ok = 1;
 #ifdef HAVE_DHCP
   struct iname *tmp;
 #endif
@@ -190,6 +191,9 @@ static int iface_allowed(struct irec **irecp, int if_index,
     }
    
   loopback = ifr.ifr_flags & IFF_LOOPBACK;
+  
+  if (loopback)
+     dhcp_ok = 0;
 
   if (ioctl(fd, SIOCGIFMTU, &ifr) != -1)
     mtu = ifr.ifr_mtu;
@@ -203,17 +207,14 @@ static int iface_allowed(struct irec **irecp, int if_index,
       struct iname *lo;
       for (lo = daemon->if_names; lo; lo = lo->next)
 	if (lo->name && strcmp(lo->name, ifr.ifr_name) == 0)
-	  {
-	    lo->isloop = 1;
-	    break;
-	  }
+	  break;
       
       if (!lo && 
 	  (lo = whine_malloc(sizeof(struct iname))) &&
 	  (lo->name = whine_malloc(strlen(ifr.ifr_name)+1)))
 	{
 	  strcpy(lo->name, ifr.ifr_name);
-	  lo->isloop = lo->used = 1;
+	  lo->used = 1;
 	  lo->next = daemon->if_names;
 	  daemon->if_names = lo;
 	}
@@ -238,7 +239,10 @@ static int iface_allowed(struct irec **irecp, int if_index,
 #ifdef HAVE_DHCP
       for (tmp = daemon->dhcp_except; tmp; tmp = tmp->next)
 	if (tmp->name && (strcmp(tmp->name, ifr.ifr_name) == 0))
-	  tftp_ok = 0;
+	  {
+	    tftp_ok = 0;
+	    dhcp_ok = 0;
+	  }
 #endif
       
 #ifdef HAVE_IPV6
@@ -254,14 +258,18 @@ static int iface_allowed(struct irec **irecp, int if_index,
       iface->addr = *addr;
       iface->netmask = netmask;
       iface->tftp_ok = tftp_ok;
+      iface->dhcp_ok = dhcp_ok;
       iface->mtu = mtu;
       iface->dad = dad;
       iface->done = 0;
       if ((iface->name = whine_malloc(strlen(ifr.ifr_name)+1)))
-	strcpy(iface->name, ifr.ifr_name);
-      iface->next = *irecp;
-      *irecp = iface;
-      return 1;
+	{
+	  strcpy(iface->name, ifr.ifr_name);
+	  iface->next = *irecp;
+	  *irecp = iface;
+	  return 1;
+	}
+      free(iface);
     }
   
   errno = ENOMEM; 
@@ -339,6 +347,7 @@ static int make_sock(union mysockaddr *addr, int type, int dienow)
   if ((fd = socket(family, type, 0)) == -1)
     {
       int port;
+      char *s;
 
       /* No error if the kernel just doesn't support this IP flavour */
       if (errno == EPROTONOSUPPORT ||
@@ -347,15 +356,15 @@ static int make_sock(union mysockaddr *addr, int type, int dienow)
 	return -1;
       
     err:
+      port = prettyprint_addr(addr, daemon->addrbuff);
+      if (!option_bool(OPT_NOWILD) && !option_bool(OPT_CLEVERBIND))
+	sprintf(daemon->addrbuff, "port %d", port);
+      s = _("failed to create listening socket for %s: %s");
+      
       if (dienow)
-	{
-	  port = prettyprint_addr(addr, daemon->namebuff);
-	  if (!option_bool(OPT_NOWILD))
-	    sprintf(daemon->namebuff, "port %d", port);
-	  die(_("failed to create listening socket for %s: %s"), 
-	      daemon->namebuff, EC_BADNET);
-	
-	}
+	die(s, daemon->addrbuff, EC_BADNET);
+      
+      my_syslog(LOG_ERR, s, daemon->addrbuff, strerror(errno));
       return -1;
     }	
 
@@ -535,7 +544,7 @@ void create_bound_listeners(int dienow)
 
   for (if_tmp = daemon->if_addrs; if_tmp; if_tmp = if_tmp->next)
     if (!if_tmp->used && 
-	(new = create_listeners(&if_tmp->addr, 1, dienow)))
+	(new = create_listeners(&if_tmp->addr, daemon->tftp_unlimited, dienow)))
       {
 	new->iface = NULL;
 	new->next = daemon->listeners;

src/option.c

@@ -117,6 +117,9 @@ struct myoption {
 #define LOPT_RA        306
 #define LOPT_DUID      307
 #define LOPT_HOST_REC  308
+#define LOPT_TFTP_LC   309
+#define LOPT_RR        310
+#define LOPT_CLVERBIND 311
 
 #ifdef HAVE_GETOPT_LONG
 static const struct option opts[] =  
@@ -180,6 +183,7 @@ static const struct myoption opts[] =
     { "srv-host", 1, 0, 'W' },
     { "localise-queries", 0, 0, 'y' },
     { "txt-record", 1, 0, 'Y' },
+    { "dns-rr", 1, 0, LOPT_RR },
     { "enable-dbus", 0, 0, '1' },
     { "bootp-dynamic", 2, 0, '3' },
     { "dhcp-mac", 1, 0, '4' },
@@ -196,6 +200,7 @@ static const struct myoption opts[] =
     { "tftp-unique-root", 0, 0, LOPT_APREF },
     { "tftp-root", 1, 0, LOPT_PREFIX },
     { "tftp-max", 1, 0, LOPT_TFTP_MAX },
+    { "tftp-lowercase", 0, 0, LOPT_TFTP_LC },
     { "ptr-record", 1, 0, LOPT_PTR },
     { "naptr-record", 1, 0, LOPT_NAPTR },
     { "bridge-interface", 1, 0 , LOPT_BRIDGE },
@@ -239,6 +244,7 @@ static const struct myoption opts[] =
     { "enable-ra", 0, 0, LOPT_RA },
     { "dhcp-duid", 1, 0, LOPT_DUID },
     { "host-record", 1, 0, LOPT_HOST_REC },
+    { "bind-dynamic", 0, 0, LOPT_CLVERBIND },
     { NULL, 0, 0, 0 }
   };
 
@@ -337,11 +343,12 @@ static struct {
   { LOPT_NO_NAMES, ARG_DUP, "[=tag:<tag>]...", gettext_noop("Ignore hostnames provided by DHCP clients."), NULL },
   { LOPT_OVERRIDE, OPT_NO_OVERRIDE, NULL, gettext_noop("Do NOT reuse filename and server fields for extra DHCP options."), NULL },
   { LOPT_TFTP, ARG_DUP, "[=<interface>]", gettext_noop("Enable integrated read-only TFTP server."), NULL },
-  { LOPT_PREFIX, ARG_ONE, "<dir>[,<iface>]", gettext_noop("Export files by TFTP only from the specified subtree."), NULL },
+  { LOPT_PREFIX, ARG_DUP, "<dir>[,<iface>]", gettext_noop("Export files by TFTP only from the specified subtree."), NULL },
   { LOPT_APREF, OPT_TFTP_APREF, NULL, gettext_noop("Add client IP address to tftp-root."), NULL },
   { LOPT_SECURE, OPT_TFTP_SECURE, NULL, gettext_noop("Allow access only to files owned by the user running dnsmasq."), NULL },
   { LOPT_TFTP_MAX, ARG_ONE, "<integer>", gettext_noop("Maximum number of conncurrent TFTP transfers (defaults to %s)."), "#" },
   { LOPT_NOBLOCK, OPT_TFTP_NOBLOCK, NULL, gettext_noop("Disable the TFTP blocksize extension."), NULL },
+  { LOPT_TFTP_LC, OPT_TFTP_LC, NULL, gettext_noop("Convert TFTP filenames to lowercase"), NULL },
   { LOPT_TFTPPORTS, ARG_ONE, "<start>,<end>", gettext_noop("Ephemeral port range for use by TFTP transfers."), NULL },
   { LOPT_LOG_OPTS, OPT_LOG_OPTS, NULL, gettext_noop("Extra logging for DHCP."), NULL },
   { LOPT_MAX_LOGS, ARG_ONE, "[=<integer>]", gettext_noop("Enable async. logging; optionally set queue length."), NULL },
@@ -368,6 +375,8 @@ static struct {
   { LOPT_RA, OPT_RA, NULL, gettext_noop("Send router-advertisements for interfaces doing DHCPv6"), NULL },
   { LOPT_DUID, ARG_ONE, "<enterprise>,<duid>", gettext_noop("Specify DUID_EN-type DHCPv6 server DUID"), NULL },
   { LOPT_HOST_REC, ARG_DUP, "<name>,<address>", gettext_noop("Specify host (A/AAAA and PTR) records"), NULL },
+  { LOPT_RR, ARG_DUP, "<name>,<RR-number>,[<data>]", gettext_noop("Specify arbitrary DNS resource record"), NULL },
+  { LOPT_CLVERBIND, OPT_CLEVERBIND, NULL, gettext_noop("Bind to interfaces in use - check for new interfaces"), NULL},
   { 0, 0, NULL, NULL, NULL }
 }; 
 
@@ -1000,6 +1009,7 @@ static char *parse_dhcp_opt(char *arg, int flags)
 	      while (arg && *arg)
 		{
 		  u16 len = strlen(arg);
+		  unhide_metas(arg);
 		  PUTSHORT(len, p);
 		  memcpy(p, arg, len);
 		  p += len; 
@@ -1013,29 +1023,40 @@ static char *parse_dhcp_opt(char *arg, int flags)
 	    }
 	  else if (comma && (opt_len & OT_RFC1035_NAME))
 	    {
-	      int i, commas = 1;
-	      unsigned char *p, *newp;
-	      
-	      for (i = 0; comma[i]; i++)
-		if (comma[i] == ',')
-		  commas++;
-	      
-	      newp = opt_malloc(strlen(comma)+(2*commas));
-	      p = newp;
+	      unsigned char *p = NULL, *newp, *end;
+	      int len = 0;
 	      arg = comma;
 	      comma = split(arg);
 	      
 	      while (arg && *arg)
 		{
-		  p = do_rfc1035_name(p, arg);
-		  *p++ = 0;
+		  char *dom = canonicalise_opt(arg);
+		  if (!dom)
+		    {
+		      problem = _("bad domain in dhcp-option");
+		      break;
+		    }
 		  
+		  newp = opt_malloc(len + strlen(dom) + 2);
+		  
+		  if (p)
+		    {
+		      memcpy(newp, p, len);
+		      free(p);
+		    }
+		  
+		  p = newp;
+		  end = do_rfc1035_name(p + len, dom);
+		  *end++ = 0;
+		  len = end - p;
+		  free(dom);
+
 		  arg = comma;
 		  comma = split(arg);
 		}
 	      
-	      new->val = newp;
-	      new->len = p - newp;
+	      new->val = p;
+	      new->len = len;
 	    }
 #endif
 	  else
@@ -1098,6 +1119,14 @@ void set_option_bool(unsigned int opt)
     daemon->options2 |= 1u << (opt - 32);
 }
 
+void reset_option_bool(unsigned int opt)
+{
+  if (opt < 32)
+    daemon->options &= ~(1u << opt);
+  else
+    daemon->options2 &= ~(1u << (opt - 32));
+}
+
 static char *one_opt(int option, char *arg, char *gen_prob, int command_line)
 {      
   int i;
@@ -1552,7 +1581,7 @@ static char *one_opt(int option, char *arg, char *gen_prob, int command_line)
 	/* new->name may be NULL if someone does
 	   "interface=" to disable all interfaces except loop. */
 	new->name = opt_string_alloc(arg);
-	new->isloop = new->used = 0;
+	new->used = 0;
 	arg = comma;
       } while (arg);
       break;
@@ -1622,7 +1651,8 @@ static char *one_opt(int option, char *arg, char *gen_prob, int command_line)
 	    option = '?'; /* error */
 	    break;
 	  }
-	
+
+	new->used = 0;
 	daemon->if_addrs = new;
 	arg = comma;
       } while (arg);
@@ -2118,6 +2148,8 @@ static char *one_opt(int option, char *arg, char *gen_prob, int command_line)
 	  {
 	    if (strcmp(a[leasepos], "infinite") == 0)
 	      new->lease_time = 0xffffffff;
+	    else if (strcmp(a[leasepos], "deprecated") == 0)
+	      new->flags |= CONTEXT_DEPRECATE;
 	    else
 	      {
 		int fac = 1;
@@ -2150,16 +2182,6 @@ static char *one_opt(int option, char *arg, char *gen_prob, int command_line)
 		  }
 	      }
 	  }
-
-#ifdef HAVE_DHCP6
-	/* lifetimes must be min 2 hrs, by RFC 2462.
-	   This gets enforced in radv.c for DHCP ranges
-	   which are legitimately less. */
-	if ((new->flags & CONTEXT_RA_ONLY) &&
-	    new->lease_time < 7200)
-	  new->lease_time = 7200;
-#endif
-	    
 	break;
       }
 
@@ -2207,6 +2229,7 @@ static char *one_opt(int option, char *arg, char *gen_prob, int command_line)
 			}
 
 		      if (len == -1)
+
 			problem = _("bad hex constant");
 		      else if ((new->clid = opt_malloc(len)))
 			{
@@ -2924,7 +2947,42 @@ static char *one_opt(int option, char *arg, char *gen_prob, int command_line)
 	  }
 	break;
       }
-       
+
+    case LOPT_RR: /* dns-rr */
+      {
+       	struct txt_record *new;
+	size_t len;
+	char *data;
+	int val;
+
+	comma = split(arg);
+	data = split(comma);
+		
+	new = opt_malloc(sizeof(struct txt_record));
+	new->next = daemon->rr;
+	daemon->rr = new;
+	
+	if (!atoi_check(comma, &val) || 
+	    !(new->name = canonicalise_opt(arg)) ||
+	    (data && (len = parse_hex(data, (unsigned char *)data, -1, NULL, NULL)) == -1U))
+	  {
+	    problem = _("bad RR record");
+	    break;
+	  }
+	
+	new->class = val;
+	new->len = 0;
+	
+	if (data)
+	  {
+	    new->txt=opt_malloc(len);
+	    new->len = len;
+	    memcpy(new->txt, data, len);
+	  }
+	
+	break;
+      }
+
     case 'Y':  /* --txt-record */
       {
 	struct txt_record *new;
@@ -3716,6 +3774,9 @@ void read_opts(int argc, char **argv, char *compile_opts)
 
   if (testmode)
     {
+      /* Can cause a call to die() */
+      check_dhcp_hosts(1);
+      
       fprintf(stderr, "dnsmasq: %s.\n", _("syntax check OK"));
       exit(0);
     }

src/radv-protocol.h

@@ -14,7 +14,7 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-#define ALL_HOSTS                 "FF02::1"
+#define ALL_NODES                 "FF02::1"
 #define ALL_ROUTERS               "FF02::2"
 
 struct ping_packet {
@@ -43,6 +43,7 @@ struct prefix_opt {
 #define ICMP6_OPT_PREFIX       3
 #define ICMP6_OPT_MTU          5
 #define ICMP6_OPT_RDNSS       25
+#define ICMP6_OPT_DNSSL       31
 
 
 

src/radv.c

@@ -29,6 +29,7 @@
 struct ra_param {
   int ind, managed, other, found_context, first;
   char *if_name;
+  struct dhcp_netid *tags;
   struct in6_addr link_local;
 };
 
@@ -50,7 +51,7 @@ void ra_init(time_t now)
 {
   struct icmp6_filter filter;
   int fd;
-#if defined(IP_TOS) && defined(IPTOS_CLASS_CS6)
+#if defined(IPV6_TCLASS) && defined(IPTOS_CLASS_CS6)
   int class = IPTOS_CLASS_CS6;
 #endif
   int val = 255; /* radvd uses this value */
@@ -72,7 +73,7 @@ void ra_init(time_t now)
   
   if ((fd = socket(PF_INET6, SOCK_RAW, IPPROTO_ICMPV6)) == -1 ||
       getsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &hop_limit, &len) ||
-#if defined(IP_TOS) && defined(IPTOS_CLASS_CS6)
+#if defined(IPV6_TCLASS) && defined(IPTOS_CLASS_CS6)
       setsockopt(fd, IPPROTO_IPV6, IPV6_TCLASS, &class, sizeof(class)) == -1 ||
 #endif
       !fix_fd(fd) ||
@@ -116,8 +117,7 @@ void icmp6_packet(void)
     char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
   } control_u;
   struct sockaddr_in6 from;
-  unsigned char *p;
-  char *mac = "";
+  unsigned char *packet;
   struct iname *tmp;
   struct dhcp_context *context;
 
@@ -132,6 +132,8 @@ void icmp6_packet(void)
   
   if ((sz = recv_dhcp_packet(daemon->icmp6fd, &msg)) == -1 || sz < 8)
     return;
+   
+  packet = (unsigned char *)daemon->outpacket.iov_base;
   
   for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
     if (cmptr->cmsg_level == IPPROTO_IPV6 && cmptr->cmsg_type == daemon->v6pktinfo)
@@ -156,40 +158,31 @@ void icmp6_packet(void)
       return;
  
   /* weird libvirt-inspired access control */
-  for (context = daemon->dhcp6; context; context = context->next)
+  for (context = daemon->ra_contexts ? daemon->ra_contexts : daemon->dhcp6; 
+       context; context = context->next)
     if (!context->interface || strcmp(context->interface, interface) == 0)
       break;
   
-  if (!context)
+  if (!context || packet[1] != 0)
     return;
 
-  p = (unsigned char *)daemon->outpacket.iov_base;
-  
-  if (p[1] != 0)
-    return;
-
-  if (p[0] == ICMP6_ECHO_REPLY)
+  if (packet[0] == ICMP6_ECHO_REPLY)
+    lease_ping_reply(&from.sin6_addr, packet, interface); 
+  else if (packet[0] == ND_ROUTER_SOLICIT)
     {
-      /* We may be doing RA but not DHCPv4, in which case the lease
-	 database may not exist and we have nothing to do anyway */
-      if (daemon->dhcp)
-	lease_ping_reply(&from.sin6_addr, p, interface);
-      return;
+      char *mac = "";
+      
+      /* look for link-layer address option for logging */
+      if (sz >= 16 && packet[8] == ICMP6_OPT_SOURCE_MAC && (packet[9] * 8) + 8 <= sz)
+	{
+	  print_mac(daemon->namebuff, &packet[10], (packet[9] * 8) - 2);
+	  mac = daemon->namebuff;
+	}
+         
+      my_syslog(MS_DHCP | LOG_INFO, "RTR-SOLICIT(%s) %s", interface, mac);
+      /* source address may not be valid in solicit request. */
+      send_ra(if_index, interface, !IN6_IS_ADDR_UNSPECIFIED(&from.sin6_addr) ? &from.sin6_addr : NULL);
     }
-
-  if (p[0] != ND_ROUTER_SOLICIT)
-    return;
-  
-  /* look for link-layer address option for logging */
-  if (sz >= 16 && p[8] == ICMP6_OPT_SOURCE_MAC && (p[9] * 8) + 8 <= sz)
-    {
-      print_mac(daemon->namebuff, &p[10], (p[9] * 8) - 2);
-      mac = daemon->namebuff;
-    }
-  
-  my_syslog(MS_DHCP | LOG_INFO, "RTR-SOLICIT(%s) %s", interface, mac);
-  
-  send_ra(if_index, interface, &from.sin6_addr);
 }
 
 static void send_ra(int iface, char *iface_name, struct in6_addr *dest)
@@ -199,7 +192,10 @@ static void send_ra(int iface, char *iface_name, struct in6_addr *dest)
   struct ifreq ifr;
   struct sockaddr_in6 addr;
   struct dhcp_context *context;
-
+  struct dhcp_netid iface_id;
+  struct dhcp_opt *opt_cfg;
+  int done_dns = 0;
+ 
   save_counter(0);
   ra = expand(sizeof(struct ra_packet));
   
@@ -218,9 +214,17 @@ static void send_ra(int iface, char *iface_name, struct in6_addr *dest)
   parm.if_name = iface_name;
   parm.first = 1;
 
-  for (context = daemon->ra_contexts; context; context = context->next)
-    context->flags &= ~CONTEXT_RA_DONE;
+  /* set tag with name == interface */
+  iface_id.net = iface_name;
+  iface_id.next = NULL;
+  parm.tags = &iface_id; 
   
+  for (context = daemon->ra_contexts; context; context = context->next)
+    {
+      context->flags &= ~CONTEXT_RA_DONE;
+      context->netid.next = &context->netid;
+    }
+
   if (!iface_enumerate(AF_INET6, &parm, add_prefixes) ||
       !parm.found_context)
     return;
@@ -236,14 +240,63 @@ static void send_ra(int iface, char *iface_name, struct in6_addr *dest)
     }
      
   iface_enumerate(AF_LOCAL, &iface, add_lla);
+ 
+  /* RDNSS, RFC 6106, use relevant DHCP6 options */
+  (void)option_filter(parm.tags, NULL, daemon->dhcp_opts6);
   
-  /* RDNSS, RFC 6106 */
-  put_opt6_char(ICMP6_OPT_RDNSS);
-  put_opt6_char(3);
-  put_opt6_short(0);
-  put_opt6_long(1800); /* lifetime - twice RA retransmit */
-  put_opt6(&parm.link_local, IN6ADDRSZ);
+  for (opt_cfg = daemon->dhcp_opts6; opt_cfg; opt_cfg = opt_cfg->next)
+    {
+      int i;
+      
+      /* netids match and not encapsulated? */
+      if (!(opt_cfg->flags & DHOPT_TAGOK))
+        continue;
+      
+      if (opt_cfg->opt == OPTION6_DNS_SERVER)
+        {
+	  struct in6_addr *a = (struct in6_addr *)opt_cfg->val;
 
+	  done_dns = 1;
+          if (opt_cfg->len == 0)
+            continue;
+	  
+	  put_opt6_char(ICMP6_OPT_RDNSS);
+	  put_opt6_char((opt_cfg->len/8) + 1);
+	  put_opt6_short(0);
+	  put_opt6_long(1800); /* lifetime - twice RA retransmit */
+	  /* zero means "self" */
+	  for (i = 0; i < opt_cfg->len; i += IN6ADDRSZ, a++)
+	    if (IN6_IS_ADDR_UNSPECIFIED(a))
+	      put_opt6(&parm.link_local, IN6ADDRSZ);
+	    else
+	      put_opt6(a, IN6ADDRSZ);
+	}
+      
+      if (opt_cfg->opt == OPTION6_DOMAIN_SEARCH && opt_cfg->len != 0)
+	{
+	  int len = ((opt_cfg->len+7)/8);
+	  
+	  put_opt6_char(ICMP6_OPT_DNSSL);
+	  put_opt6_char(len + 1);
+	  put_opt6_short(0);
+	  put_opt6_long(1800); /* lifetime - twice RA retransmit */
+	  put_opt6(opt_cfg->val, opt_cfg->len);
+	  
+	  /* pad */
+	  for (i = opt_cfg->len; i < len * 8; i++)
+	    put_opt6_char(0);
+	}
+    }
+	
+  if (!done_dns)
+    {
+      /* default == us. */
+      put_opt6_char(ICMP6_OPT_RDNSS);
+      put_opt6_char(3);
+      put_opt6_short(0);
+      put_opt6_long(1800); /* lifetime - twice RA retransmit */
+      put_opt6(&parm.link_local, IN6ADDRSZ);
+    }
 
   /* set managed bits unless we're providing only RA on this link */
   if (parm.managed)
@@ -266,19 +319,17 @@ static void send_ra(int iface, char *iface_name, struct in6_addr *dest)
 	addr.sin6_scope_id = iface;
     }
   else
-    inet_pton(AF_INET6, ALL_HOSTS, &addr.sin6_addr); 
+    inet_pton(AF_INET6, ALL_NODES, &addr.sin6_addr); 
   
   send_from(daemon->icmp6fd, 0, daemon->outpacket.iov_base, save_counter(0),
-	    (union mysockaddr *)&addr, (struct all_addr *)&parm.link_local, iface, NULL); 
+	    (union mysockaddr *)&addr, (struct all_addr *)&parm.link_local, iface); 
   
 }
 
 static int add_prefixes(struct in6_addr *local,  int prefix,
 			int scope, int if_index, int dad, void *vparam)
 {
-  struct dhcp_context *context, *tmp;
   struct ra_param *param = vparam;
-  struct prefix_opt *opt;
 
   (void)scope; /* warning */
   (void)dad;
@@ -291,19 +342,27 @@ static int add_prefixes(struct in6_addr *local,  int prefix,
 	       !IN6_IS_ADDR_LINKLOCAL(local) &&
 	       !IN6_IS_ADDR_MULTICAST(local))
 	{
+	  int do_prefix = 0;
+	  int do_slaac = 0;
+	  int deprecate  = 0;
+	  unsigned int time = 0xffffffff;
+	  struct dhcp_context *context;
+	  
 	  for (context = daemon->ra_contexts; context; context = context->next)
 	    if (prefix == context->prefix &&
 		is_same_net6(local, &context->start6, prefix) &&
 		is_same_net6(local, &context->end6, prefix))
 	      {
-		int do_slaac = 0;
-
 		if ((context->flags & 
 		     (CONTEXT_RA_ONLY | CONTEXT_RA_NAME | CONTEXT_RA_STATELESS)))
 		  {
 		    do_slaac = 1;
-		    if (context->flags & CONTEXT_RA_STATELESS)
-		      param->other = 1; 
+		    if (context->flags & CONTEXT_DHCP)
+		      {
+			param->other = 1; 
+			if (!(context->flags & CONTEXT_RA_STATELESS))
+			  param->managed = 1;
+		      }
 		  }
 		else
 		  {
@@ -314,68 +373,63 @@ static int add_prefixes(struct in6_addr *local,  int prefix,
 		    param->other = 1;
 		  }
 
-		if (context->flags & CONTEXT_RA_DONE)
-		  continue;
+		/* find floor time */
+		if (time > context->lease_time)
+		  time = context->lease_time;
 		
-		/* subsequent prefixes on the same interface don't need timers */
-		if (!param->first)
-		  context->ra_time = 0;
-		param->first = 0;
-		param->found_context = 1;
-		context->flags |= CONTEXT_RA_DONE;
+		if (context->flags & CONTEXT_DEPRECATE)
+		  deprecate = 1;
 
-		/* mark this subnet and duplicates: as done. */
-		for (tmp = context->next; tmp; tmp = tmp->next)
-		  if (tmp->prefix == prefix &&
-		      is_same_net6(local, &tmp->start6, prefix) &&
-		      is_same_net6(local, &tmp->end6, prefix))
-		    {
-		      tmp->flags |= CONTEXT_RA_DONE;
-		      context->ra_time = 0;
-		      /* if any dhcp-range with ra-only on this subnet
-			 set the "do_slaac" bit */
-		      if (tmp->flags & 
-			  (CONTEXT_RA_ONLY | CONTEXT_RA_NAME | CONTEXT_RA_STATELESS))
-			{
-			  do_slaac = 1;
-			  if (context->flags & CONTEXT_RA_STATELESS)
-			    param->other = 1; 
-			}
-		      else
-			{
-			  /* don't do RA for non-ra-only unless --enable-ra is set */
-			  if (!option_bool(OPT_RA))
-			    continue;
-			  param->managed = 1;
-			  param->other = 1;
-			}
-		    }
-		
-		if ((opt = expand(sizeof(struct prefix_opt))))
+		/* collect dhcp-range tags */
+		if (context->netid.next == &context->netid && context->netid.net)
 		  {
-		    u64 addrpart = addr6part(&context->start6);
-		    u64 mask = (prefix == 64) ? (u64)-1LL : (1LLU << (128 - prefix)) - 1LLU;
-		    unsigned int time = context->lease_time;
-
-		    /* lifetimes must be min 2 hrs, by RFC 2462 */
-		    if (time < 7200)
-		      time = 7200;
-
-		    opt->type = ICMP6_OPT_PREFIX;
-		    opt->len = 4;
-		    opt->prefix_len = prefix;
-		    /* autonomous only is we're not doing dhcp */
-		    opt->flags = do_slaac ? 0x40 : 0x00;
-		    opt->valid_lifetime = opt->preferred_lifetime = htonl(time);
-		    opt->reserved = 0;
-		    
-		    opt->prefix = context->start6;
-		    setaddr6part(&opt->prefix, addrpart & ~mask);
-		    
-		    inet_ntop(AF_INET6, &opt->prefix, daemon->addrbuff, ADDRSTRLEN);
-		    my_syslog(MS_DHCP | LOG_INFO, "RTR-ADVERT(%s) %s", param->if_name, daemon->addrbuff); 		    
+		    context->netid.next = param->tags;
+		    param->tags = &context->netid;
 		  }
+		  
+		/* subsequent prefixes on the same interface 
+		   and subsequent instances of this prefix don't need timers.
+		   Be careful not to find the same prefix twice with different
+		   addresses. */
+		if (!(context->flags & CONTEXT_RA_DONE))
+		  {
+		    if (!param->first)
+		      context->ra_time = 0;
+		    context->flags |= CONTEXT_RA_DONE;
+		    do_prefix = 1;
+		  }
+
+		param->first = 0;	
+		param->found_context = 1;
 	      }
+	  
+	  if (do_prefix)
+	    {
+	      struct prefix_opt *opt;
+	     	      
+	      if ((opt = expand(sizeof(struct prefix_opt))))
+		{
+		  /* zero net part of address */
+		  setaddr6part(local, addr6part(local) & ~((prefix == 64) ? (u64)-1LL : (1LLU << (128 - prefix)) - 1LLU));
+		  
+		  /* lifetimes must be min 2 hrs, by RFC 2462 */
+		  if (time < 7200)
+		    time = 7200;
+		  
+		  opt->type = ICMP6_OPT_PREFIX;
+		  opt->len = 4;
+		  opt->prefix_len = prefix;
+		  /* autonomous only if we're not doing dhcp */
+		  opt->flags = do_slaac ? 0x40 : 0x00;
+		  opt->valid_lifetime = htonl(time);
+		  opt->preferred_lifetime = htonl(deprecate ? 0 : time);
+		  opt->reserved = 0; 
+		  opt->prefix = *local;
+		  
+		  inet_ntop(AF_INET6, local, daemon->addrbuff, ADDRSTRLEN);
+		  my_syslog(MS_DHCP | LOG_INFO, "RTR-ADVERT(%s) %s", param->if_name, daemon->addrbuff); 		    
+		}
+	    }
 	}
     }          
   return 1;

src/rfc1035.c

@@ -699,15 +699,17 @@ static unsigned char *do_doctor(unsigned char *p, int count, struct dns_header *
 	      unsigned char *p2 = p1;
 	      /* make counted string zero-term  and sanitise */
 	      for (i = 0; i < len; i++)
-		if (isprint(*(p2+1)))
-		  {
-		    *p2 = *(p2+1);
-		    p2++;
-		  }
+		{
+		  if (!isprint((int)*(p2+1)))
+		    break;
+		  
+		  *p2 = *(p2+1);
+		  p2++;
+		}
 	      *p2 = 0;
 	      my_syslog(LOG_INFO, "reply %s is %s", name, p1);
 	      /* restore */
-	      memmove(p1 + 1, p1, len);
+	      memmove(p1 + 1, p1, i);
 	      *p1 = len;
 	      p1 += len+1;
 	    }
@@ -936,10 +938,14 @@ int extract_addresses(struct dns_header *header, size_t qlen, char *name, time_t
 			  if (!cname_count--)
 			    return 0; /* looped CNAMES */
 			  newc = cache_insert(name, NULL, now, attl, F_CNAME | F_FORWARD);
-			  if (newc && cpp)
+			  if (newc)
 			    {
-			      cpp->addr.cname.cache = newc;
-			      cpp->addr.cname.uid = newc->uid;
+			      newc->addr.cname.cache = NULL;
+			      if (cpp)
+				{
+				  cpp->addr.cname.cache = newc;
+				  cpp->addr.cname.uid = newc->uid;
+				}
 			    }
 
 			  cpp = newc;
@@ -1003,10 +1009,16 @@ int extract_addresses(struct dns_header *header, size_t qlen, char *name, time_t
 	}
     }
   
-  /* Don't put stuff from a truncated packet into the cache,
-     also don't cache replies where DNSSEC validation was turned off, either
-     the upstream server told us so, or the original query specified it. */
-  if (!(header->hb3 & HB3_TC) && !(header->hb4 & HB4_CD) && !checking_disabled)
+  /* Don't put stuff from a truncated packet into the cache.
+     Don't cache replies where DNSSEC validation was turned off, either
+     the upstream server told us so, or the original query specified it. 
+     Don't cache replies from non-recursive nameservers, since we may get a 
+     reply containing a CNAME but not its target, even though the target 
+     does exist. */
+  if (!(header->hb3 & HB3_TC) && 
+      !(header->hb4 & HB4_CD) &&
+      (header->hb4 & HB4_RA) &&
+      !checking_disabled)
     cache_end_insert();
 
   return 0;
@@ -1238,7 +1250,8 @@ static int add_resource_record(struct dns_header *header, char *limit, int *trun
       case 't':
 	usval = va_arg(ap, int);
 	sval = va_arg(ap, char *);
-	memcpy(p, sval, usval);
+	if (usval != 0)
+	  memcpy(p, sval, usval);
 	p += usval;
 	break;
 
@@ -1381,6 +1394,22 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
 
       if (qclass == C_IN)
 	{
+	  struct txt_record *t;
+
+	  for (t = daemon->rr; t; t = t->next)
+	    if ((t->class == qtype || qtype == T_ANY) && hostname_isequal(name, t->name))
+	      {
+		ans = 1;
+		if (!dryrun)
+		  {
+		    log_query(F_CONFIG | F_RRNAME, name, NULL, "<RR>");
+		    if (add_resource_record(header, limit, &trunc, nameoffset, &ansp, 
+					    daemon->local_ttl, NULL,
+					    t->class, C_IN, "t", t->len, t->txt))
+		      anscount ++;
+		  }
+	      }
+		
 	  if (qtype == T_PTR || qtype == T_ANY)
 	    {
 	      /* see if it's w.z.y.z.in-addr.arpa format */
@@ -1633,6 +1662,23 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
 		    } while ((crecp = cache_find_by_name(crecp, name, now, flag | F_CNAME)));
 		}
 	    }
+
+	  if (qtype == T_CNAME || qtype == T_ANY)
+	    {
+	      if ((crecp = cache_find_by_name(NULL, name, now, F_CNAME)) &&
+		  (qtype == T_CNAME || (crecp->flags & (F_HOSTS | F_DHCP))))
+		{
+		  ans = 1;
+		  if (!dryrun)
+		    {
+		      log_query(crecp->flags, name, NULL, record_source(crecp->uid));
+		      if (add_resource_record(header, limit, &trunc, nameoffset, &ansp, 
+					      crec_ttl(crecp, now), &nameoffset,
+					      T_CNAME, C_IN, "d", cache_get_name(crecp->addr.cname.cache)))
+			anscount++;
+		    }
+		}
+	    }
 	  
 	  if (qtype == T_MX || qtype == T_ANY)
 	    {

src/rfc2131.c

@@ -483,7 +483,7 @@ size_t dhcp_reply(struct dhcp_context *context, char *iface_name, int int_index,
 	    {
 	      logaddr = &mess->yiaddr;
 		
-	      lease_set_hwaddr(lease, mess->chaddr, NULL, mess->hlen, mess->htype, 0, now);
+	      lease_set_hwaddr(lease, mess->chaddr, NULL, mess->hlen, mess->htype, 0, now, 1);
 	      if (hostname)
 		lease_set_hostname(lease, hostname, 1, get_domain(lease->addr), domain); 
 	      /* infinite lease unless nailed in dhcp-host line. */
@@ -1222,51 +1222,56 @@ size_t dhcp_reply(struct dhcp_context *context, char *iface_name, int int_index,
 
 	  log_tags(tagif_netid, ntohl(mess->xid));
 	  
-#ifdef HAVE_SCRIPT
-	  if (do_classes && daemon->lease_change_command)
+	  if (do_classes)
 	    {
-	      struct dhcp_netid *n;
-	      
-	      if (mess->giaddr.s_addr)
-		lease->giaddr = mess->giaddr;
-	      
+	      /* pick up INIT-REBOOT events. */
 	      lease->flags |= LEASE_CHANGED;
-	      free(lease->extradata);
-	      lease->extradata = NULL;
-	      lease->extradata_size = lease->extradata_len = 0;
-	      
-	      add_extradata_opt(lease, option_find(mess, sz, OPTION_VENDOR_ID, 1));
-	      add_extradata_opt(lease, option_find(mess, sz, OPTION_HOSTNAME, 1));
-	      add_extradata_opt(lease, oui);
-	      add_extradata_opt(lease, serial);
-	      add_extradata_opt(lease, class);
-	      
-	      /* space-concat tag set */
-	      if (!tagif_netid)
-		add_extradata_opt(lease, NULL);
-	      else
-		for (n = tagif_netid; n; n = n->next)
-		  {
-		    struct dhcp_netid *n1;
-		    /* kill dupes */
-		    for (n1 = n->next; n1; n1 = n1->next)
-		      if (strcmp(n->net, n1->net) == 0)
-			break;
-		    if (!n1)
-		      lease_add_extradata(lease, (unsigned char *)n->net, strlen(n->net), n->next ? ' ' : 0); 
-		  }
 
-	      if ((opt = option_find(mess, sz, OPTION_USER_CLASS, 1)))
+#ifdef HAVE_SCRIPT
+	      if (daemon->lease_change_command)
 		{
-		  int len = option_len(opt);
-		  unsigned char *ucp = option_ptr(opt, 0);
-		  /* If the user-class option started as counted strings, the first byte will be zero. */
-		  if (len != 0 && ucp[0] == 0)
-		    ucp++, len--;
-		  lease_add_extradata(lease, ucp, len, 0);
+		  struct dhcp_netid *n;
+		  
+		  if (mess->giaddr.s_addr)
+		    lease->giaddr = mess->giaddr;
+		  
+		  free(lease->extradata);
+		  lease->extradata = NULL;
+		  lease->extradata_size = lease->extradata_len = 0;
+		  
+		  add_extradata_opt(lease, option_find(mess, sz, OPTION_VENDOR_ID, 1));
+		  add_extradata_opt(lease, option_find(mess, sz, OPTION_HOSTNAME, 1));
+		  add_extradata_opt(lease, oui);
+		  add_extradata_opt(lease, serial);
+		  add_extradata_opt(lease, class);
+		  
+		  /* space-concat tag set */
+		  if (!tagif_netid)
+		    add_extradata_opt(lease, NULL);
+		  else
+		    for (n = tagif_netid; n; n = n->next)
+		      {
+			struct dhcp_netid *n1;
+			/* kill dupes */
+			for (n1 = n->next; n1; n1 = n1->next)
+			  if (strcmp(n->net, n1->net) == 0)
+			    break;
+			if (!n1)
+			  lease_add_extradata(lease, (unsigned char *)n->net, strlen(n->net), n->next ? ' ' : 0); 
+		      }
+		  
+		  if ((opt = option_find(mess, sz, OPTION_USER_CLASS, 1)))
+		    {
+		      int len = option_len(opt);
+		      unsigned char *ucp = option_ptr(opt, 0);
+		      /* If the user-class option started as counted strings, the first byte will be zero. */
+		      if (len != 0 && ucp[0] == 0)
+			ucp++, len--;
+		      lease_add_extradata(lease, ucp, len, 0);
+		    }
 		}
-	    }
 #endif
+	    }
 	  
 	  if (!hostname_auth && (client_hostname = host_from_dns(mess->yiaddr)))
 	    {
@@ -1276,7 +1281,7 @@ size_t dhcp_reply(struct dhcp_context *context, char *iface_name, int int_index,
 	    }
 	  
 	  time = calc_time(context, config, option_find(mess, sz, OPTION_LEASE_TIME, 4));
-	  lease_set_hwaddr(lease, mess->chaddr, clid, mess->hlen, mess->htype, clid_len, now);
+	  lease_set_hwaddr(lease, mess->chaddr, clid, mess->hlen, mess->htype, clid_len, now, do_classes);
 	  
 	  /* if all the netids in the ignore_name list are present, ignore client-supplied name */
 	  if (!hostname_auth)

src/rfc3315.c

@@ -349,28 +349,28 @@ static int dhcp6_no_relay(int msg_type, struct in6_addr *link_address, struct dh
 
        if (len != 0 && len < 255)
 	 {
-	  unsigned char *pp, *op = opt6_ptr(opt, 1);
-	  char *pq = daemon->dhcp_buff;
-	  
-	  pp = op;
-	  while (*op != 0 && ((op + (*op) + 1) - pp) < len)
-	    {
-            memcpy(pq, op+1, *op);
-            pq += *op;
-            op += (*op)+1;
-            *(pq++) = '.';
-	    }
-	  
-	  if (pq != daemon->dhcp_buff)
-	    pq--;
-	  *pq = 0;
-
-	  if (legal_hostname(daemon->dhcp_buff))
-	    {
-	      client_hostname = daemon->dhcp_buff;
-	      if (option_bool(OPT_LOG_OPTS))
-		my_syslog(MS_DHCP | LOG_INFO, _("%u client provides name: %s"), xid, client_hostname); 
-	    }
+	   unsigned char *pp, *op = opt6_ptr(opt, 1);
+	   char *pq = daemon->dhcp_buff;
+	   
+	   pp = op;
+	   while (*op != 0 && ((op + (*op)) - pp) < len)
+	     {
+	       memcpy(pq, op+1, *op);
+	       pq += *op;
+	       op += (*op)+1;
+	       *(pq++) = '.';
+	     }
+	   
+	   if (pq != daemon->dhcp_buff)
+	     pq--;
+	   *pq = 0;
+	   
+	   if (legal_hostname(daemon->dhcp_buff))
+	     {
+	       client_hostname = daemon->dhcp_buff;
+	       if (option_bool(OPT_LOG_OPTS))
+		 my_syslog(MS_DHCP | LOG_INFO, _("%u client provides name: %s"), xid, client_hostname); 
+	     }
 	 }
     }	 
   
@@ -513,13 +513,13 @@ static int dhcp6_no_relay(int msg_type, struct in6_addr *link_address, struct dh
 	    while (1)
 	      {
 		struct in6_addr alloced_addr, *addrp = NULL;
-		u32 preferred_time = 0;
+		u32 requested_time = 0;
 		struct dhcp_lease *lease = NULL;
 		
 		if (ia_option)
 		  {
 		    struct in6_addr *req_addr = opt6_ptr(ia_option, 0);
-		    preferred_time = opt6_uint(ia_option, 16, 4);
+		    requested_time = opt6_uint(ia_option, 16, 4);
 		    
 		    if (!address6_available(context, req_addr, tags) &&
 			(!have_config(config, CONFIG_ADDR6) || memcmp(&config->addr6, req_addr, IN6ADDRSZ) != 0))
@@ -621,10 +621,10 @@ static int dhcp6_no_relay(int msg_type, struct in6_addr *link_address, struct dh
 			
 			if (ia_option)
 			  {
-			    if (preferred_time < 120u )
-			      preferred_time = 120u; /* sanity */
-			    if (lease_time == 0xffffffff || (preferred_time != 0xffffffff && preferred_time < lease_time))
-			      lease_time = preferred_time;
+			    if (requested_time < 120u )
+			      requested_time = 120u; /* sanity */
+			    if (lease_time == 0xffffffff || (requested_time != 0xffffffff && requested_time < lease_time))
+			      lease_time = requested_time;
 			  }
 			  
 			if (lease_time < min_time)
@@ -637,7 +637,7 @@ static int dhcp6_no_relay(int msg_type, struct in6_addr *link_address, struct dh
 			if (lease)
 			  {
 			    lease_set_expires(lease, lease_time, now);
-			    lease_set_hwaddr(lease, NULL, clid, 0, iaid, clid_len, now);
+			    lease_set_hwaddr(lease, NULL, clid, 0, iaid, clid_len, now, 0);
 			    lease_set_interface(lease, interface, now);
 			    if (hostname && ia_type == OPTION6_IA_NA)
 			      {
@@ -730,8 +730,9 @@ static int dhcp6_no_relay(int msg_type, struct in6_addr *link_address, struct dh
 			  {
 			    o1 =  new_opt6(OPTION6_IAADDR);
 			    put_opt6(addrp, sizeof(*addrp));
-			    put_opt6_long(lease_time);
-			    put_opt6_long(lease_time);
+			    /* preferred lifetime */
+			    put_opt6_long(this_context && (this_context->flags & CONTEXT_DEPRECATE) ? 0 : lease_time);
+			    put_opt6_long(lease_time); /* valid lifetime */
 			    end_opt6(o1);
 
 			    log6_packet( make_lease ? "DHCPREPLY" : "DHCPADVERTISE", 
@@ -842,7 +843,7 @@ static int dhcp6_no_relay(int msg_type, struct in6_addr *link_address, struct dh
 	      {
 		struct dhcp_lease *lease = NULL;
 		struct in6_addr *req_addr = opt6_ptr(ia_option, 0);
-		u32 preferred_time = opt6_uint(ia_option, 16, 4);
+		u32 requested_time = opt6_uint(ia_option, 16, 4);
 		unsigned int lease_time;
 		struct dhcp_context *this_context;
 		struct dhcp_config *valid_config = config;
@@ -873,7 +874,10 @@ static int dhcp6_no_relay(int msg_type, struct in6_addr *link_address, struct dh
 		
 		if (!address6_available(context, req_addr, tagif) || 
 		    !(this_context = narrow_context6(context, req_addr, tagif)))
-		  lease_time = 0;
+		  {
+		    lease_time = 0;
+		    this_context = NULL;
+		  }
 		else
 		  {
 		    /* get tags from context if we've not used it before */
@@ -895,10 +899,10 @@ static int dhcp6_no_relay(int msg_type, struct in6_addr *link_address, struct dh
 		    
 		    lease_time = have_config(valid_config, CONFIG_TIME) ? valid_config->lease_time : this_context->lease_time;
 		    
-		    if (preferred_time < 120u )
-		      preferred_time = 120u; /* sanity */
-		    if (lease_time == 0xffffffff || (preferred_time != 0xffffffff && preferred_time < lease_time))
-		      lease_time = preferred_time;
+		    if (requested_time < 120u )
+		      requested_time = 120u; /* sanity */
+		    if (lease_time == 0xffffffff || (requested_time != 0xffffffff && requested_time < lease_time))
+		      lease_time = requested_time;
 		    
 		    lease_set_expires(lease, lease_time, now);
 		    if (ia_type == OPTION6_IA_NA && hostname)
@@ -917,8 +921,9 @@ static int dhcp6_no_relay(int msg_type, struct in6_addr *link_address, struct dh
 		
 		o1 =  new_opt6(OPTION6_IAADDR);
 		put_opt6(req_addr, sizeof(*req_addr));
-		put_opt6_long(lease_time);
-		put_opt6_long(lease_time);
+		/* preferred lifetime */
+		put_opt6_long(this_context && (this_context->flags & CONTEXT_DEPRECATE) ? 0 : lease_time);
+		put_opt6_long(lease_time); /* valid lifetime */
 		end_opt6(o1);
 	      }
 	    

src/slaac.c

@@ -23,12 +23,14 @@
 static int map_rebuild = 0;
 static int ping_id = 0;
 
-void slaac_add_addrs(struct dhcp_lease *lease, time_t now)
+void slaac_add_addrs(struct dhcp_lease *lease, time_t now, int force)
 {
   struct slaac_address *slaac, *old, **up;
   struct dhcp_context *context;
+  int dns_dirty = 0;
   
   if (!(lease->flags & LEASE_HAVE_HWADDR) || 
+      (lease->flags & (LEASE_TA | LEASE_NA)) ||
       lease->last_interface == 0 ||
       !lease->hostname)
     return ;
@@ -72,6 +74,13 @@ void slaac_add_addrs(struct dhcp_lease *lease, time_t now)
 	    if (IN6_ARE_ADDR_EQUAL(&addr, &slaac->addr))
 	      {
 		*up = slaac->next;
+		/* recheck when DHCPv4 goes through init-reboot */
+		if (force)
+		  {
+		    slaac->ping_time = now;
+		    slaac->backoff = 1;
+		    dns_dirty = 1;
+		  }
 		break;
 	      }
 	    up = &slaac->next;
@@ -95,6 +104,9 @@ void slaac_add_addrs(struct dhcp_lease *lease, time_t now)
 	  }
       }
   
+  if (old || dns_dirty)
+    lease_update_dns(1);
+  
   /* Free any no reused */
   for (; old; old = slaac)
     {
@@ -108,8 +120,8 @@ time_t periodic_slaac(time_t now, struct dhcp_lease *leases)
 {
   struct dhcp_context *context;
   struct dhcp_lease *lease;
-   struct slaac_address *slaac;
-   time_t next_event = 0;
+  struct slaac_address *slaac;
+  time_t next_event = 0;
   
   for (context = daemon->ra_contexts; context; context = context->next)
     if ((context->flags & CONTEXT_RA_NAME))
@@ -139,8 +151,7 @@ time_t periodic_slaac(time_t now, struct dhcp_lease *leases)
 	  {
 	    struct ping_packet *ping;
 	    struct sockaddr_in6 addr;
-	    int err;
-	    
+ 
 	    save_counter(0);
 	    ping = expand(sizeof(struct ping_packet));
 	    ping->type = ICMP6_ECHO_REQUEST;
@@ -156,9 +167,11 @@ time_t periodic_slaac(time_t now, struct dhcp_lease *leases)
 	    addr.sin6_port = htons(IPPROTO_ICMPV6);
 	    addr.sin6_addr = slaac->addr;
 	    
-	    if (send_from(daemon->icmp6fd, 0, daemon->outpacket.iov_base, save_counter(0),
-			  (union mysockaddr *)&addr, (struct all_addr *)&slaac->local, 
-			  lease->last_interface, &err)) 
+	    if (sendto(daemon->icmp6fd, daemon->outpacket.iov_base, save_counter(0), 0,
+		       (struct sockaddr *)&addr,  sizeof(addr)) == -1 &&
+		errno == EHOSTUNREACH)
+	      slaac->ping_time = 0; /* Give up */ 
+	    else
 	      {
 		slaac->ping_time += (1 << (slaac->backoff - 1)) + (rand16()/21785); /* 0 - 3 */
 		if (slaac->backoff > 4)
@@ -166,8 +179,6 @@ time_t periodic_slaac(time_t now, struct dhcp_lease *leases)
 		if (slaac->backoff < 12)
 		  slaac->backoff++;
 	      }
-	    else if (err == EHOSTUNREACH)
-	      slaac->ping_time = 0; /* Give up */
 	  }
 	
 	if (slaac->ping_time != 0 &&

src/tftp.c

@@ -24,6 +24,7 @@ static ssize_t tftp_err(int err, char *packet, char *mess, char *file);
 static ssize_t tftp_err_oops(char *packet, char *file);
 static ssize_t get_block(char *packet, struct tftp_transfer *transfer);
 static char *next(char **p, char *end);
+static void sanitise(char *buf);
 
 #define OP_RRQ  1
 #define OP_WRQ  2
@@ -311,7 +312,10 @@ void tftp_request(struct listener *listen, time_t now)
       !(filename = next(&p, end)) ||
       !(mode = next(&p, end)) ||
       (strcasecmp(mode, "octet") != 0 && strcasecmp(mode, "netascii") != 0))
-    len = tftp_err(ERR_ILL, packet, _("unsupported request from %s"), daemon->addrbuff);
+    {
+      len = tftp_err(ERR_ILL, packet, _("unsupported request from %s"), daemon->addrbuff);
+      is_err = 1;
+    }
   else
     {
       if (strcasecmp(mode, "netascii") == 0)
@@ -344,9 +348,12 @@ void tftp_request(struct listener *listen, time_t now)
 	}
 
       /* cope with backslashes from windows boxen. */
-      while ((p = strchr(filename, '\\')))
-	*p = '/';
-
+      for (p = filename; *p; p++)
+	if (*p == '\\')
+	  *p = '/';
+	else if (option_bool(OPT_TFTP_LC))
+	  *p = tolower(*p);
+		
       strcpy(daemon->namebuff, "/");
       if (prefix)
 	{
@@ -393,7 +400,7 @@ void tftp_request(struct listener *listen, time_t now)
     }
   
   while (sendto(transfer->sockfd, packet, len, 0, 
-		(struct sockaddr *)&peer, sizeof(peer)) == -1 && errno == EINTR);
+		(struct sockaddr *)&peer, sa_len(&peer)) == -1 && errno == EINTR);
   
   if (is_err)
     free_transfer(transfer);
@@ -501,12 +508,12 @@ void check_tftp_listeners(fd_set *rset, time_t now)
     {
       tmp = transfer->next;
       
+      prettyprint_addr(&transfer->peer, daemon->addrbuff);
+     
       if (FD_ISSET(transfer->sockfd, rset))
 	{
 	  /* we overwrote the buffer... */
 	  daemon->srv_save = NULL;
-	   
-	  prettyprint_addr(&transfer->peer, daemon->addrbuff);
 	  
 	  if ((len = recv(transfer->sockfd, daemon->packet, daemon->packet_buff_sz, 0)) >= (ssize_t)sizeof(struct ack))
 	    {
@@ -528,14 +535,8 @@ void check_tftp_listeners(fd_set *rset, time_t now)
 		  if (!err)
 		    err = "";
 		  else
-		    {
-		      unsigned char *q, *r;
-		      for (q = r = (unsigned char *)err; *r; r++)
-			if (isprint(*r))
-			  *(q++) = *r;
-		      *q = 0;
-		    }
-
+		    sanitise(err);
+		  
 		  my_syslog(MS_TFTP | LOG_ERR, _("error %d %s received from %s"),
 			    (int)ntohs(mess->block), err, 
 			    daemon->addrbuff);	
@@ -562,32 +563,33 @@ void check_tftp_listeners(fd_set *rset, time_t now)
 	      len = tftp_err_oops(daemon->packet, transfer->file->filename);
 	      endcon = 1;
 	    }
-	  else if (++transfer->backoff > 5)
+	  /* don't complain about timeout when we're awaiting the last
+	     ACK, some clients never send it */
+	  else if (++transfer->backoff > 5 && len != 0)
 	    {
-	      /* don't complain about timeout when we're awaiting the last
-		 ACK, some clients never send it */
-	      if (len != 0)
-		{
-		  my_syslog(MS_TFTP | LOG_ERR, _("failed sending %s to %s"), 
-			    transfer->file->filename, daemon->addrbuff);
-		  len = 0;
-		  endcon = 1;
-		}
+	      endcon = 1;
+	      len = 0;
 	    }
-	  
+
 	  if (len != 0)
 	    while(sendto(transfer->sockfd, daemon->packet, len, 0, 
-			 (struct sockaddr *)&transfer->peer, sizeof(transfer->peer)) == -1 && errno == EINTR);
+			 (struct sockaddr *)&transfer->peer, sa_len(&transfer->peer)) == -1 && errno == EINTR);
 	  
 	  if (endcon || len == 0)
 	    {
-	      if (!endcon)
-		my_syslog(MS_TFTP | LOG_INFO, _("sent %s to %s"), transfer->file->filename, daemon->addrbuff);
+	      strcpy(daemon->namebuff, transfer->file->filename);
+	      sanitise(daemon->namebuff);
+	      my_syslog(MS_TFTP | LOG_INFO, endcon ? _("failed sending %s to %s") : _("sent %s to %s"), daemon->namebuff, daemon->addrbuff);
 	      /* unlink */
 	      *up = tmp;
-	      /* put on queue to be sent to script and deleted */
-	      transfer->next = daemon->tftp_done_trans;
-	      daemon->tftp_done_trans = transfer;
+	      if (endcon)
+		free_transfer(transfer);
+	      else
+		{
+		  /* put on queue to be sent to script and deleted */
+		  transfer->next = daemon->tftp_done_trans;
+		  daemon->tftp_done_trans = transfer;
+		}
 	      continue;
 	    }
 	}
@@ -621,6 +623,16 @@ static char *next(char **p, char *end)
   return ret;
 }
 
+static void sanitise(char *buf)
+{
+  unsigned char *q, *r;
+  for (q = r = (unsigned char *)buf; *r; r++)
+    if (isprint((int)*r))
+      *(q++) = *r;
+  *q = 0;
+
+}
+
 static ssize_t tftp_err(int err, char *packet, char *message, char *file)
 {
   struct errmess {
@@ -629,7 +641,9 @@ static ssize_t tftp_err(int err, char *packet, char *message, char *file)
   } *mess = (struct errmess *)packet;
   ssize_t ret = 4;
   char *errstr = strerror(errno);
- 
+  
+  sanitise(file);
+
   mess->op = htons(OP_ERR);
   mess->err = htons(err);
   ret += (snprintf(mess->message, 500,  message, file, errstr) + 1);
@@ -640,7 +654,9 @@ static ssize_t tftp_err(int err, char *packet, char *message, char *file)
 
 static ssize_t tftp_err_oops(char *packet, char *file)
 {
-  return tftp_err(ERR_NOTDEF, packet, _("cannot read %s: %s"), file);
+  /* May have >1 refs to file, so potentially mangle a copy of the name */
+  strcpy(daemon->namebuff, file);
+  return tftp_err(ERR_NOTDEF, packet, _("cannot read %s: %s"), daemon->namebuff);
 }
 
 /* return -1 for error, zero for done. */

src/util.c

@@ -330,7 +330,7 @@ int is_same_net6(struct in6_addr *a, struct in6_addr *b, int prefixlen)
     return 0;
 
   if (pfbits == 0 ||
-      (a->s6_addr[pfbytes] >> (8 - pfbits) != b->s6_addr[pfbytes] >> (8 - pfbits)))
+      (a->s6_addr[pfbytes] >> (8 - pfbits) == b->s6_addr[pfbytes] >> (8 - pfbits)))
     return 1;
 
   return 0;
@@ -426,7 +426,7 @@ int parse_hex(char *in, unsigned char *out, int maxlen,
   
   while (maxlen == -1 || i < maxlen)
     {
-      for (r = in; *r != 0 && *r != ':' && *r != '-'; r++)
+      for (r = in; *r != 0 && *r != ':' && *r != '-' && *r != ' '; r++)
 	if (*r != '*' && !isxdigit((unsigned char)*r))
 	  return -1;
       
@@ -444,12 +444,29 @@ int parse_hex(char *in, unsigned char *out, int maxlen,
 	  else
 	    {
 	      *r = 0;
-	      mask = mask << 1;
 	      if (strcmp(in, "*") == 0)
-		mask |= 1;
+		{
+		  mask = (mask << 1) | 1;
+		  i++;
+		}
 	      else
-		out[i] = strtol(in, NULL, 16);
-	      i++;
+		{
+		  int j, bytes = (1 + (r - in))/2;
+		  for (j = 0; j < bytes; j++)
+		    { 
+		      char sav;
+		      if (j < bytes - 1)
+			{
+			  sav = in[(j+1)*2];
+			  in[(j+1)*2] = 0;
+			}
+		      out[i] = strtol(&in[j*2], NULL, 16);
+		      mask = mask << 1;
+		      i++;
+		      if (j < bytes - 1)
+			in[(j+1)*2] = sav;
+		    }
+		}
 	    }
 	}
       in = r+1;