Merge branch 'master' into dnssec

Conflicts:
	src/dnsmasq.h
	src/forward.c
	src/option.c

diff --cc Makefile
index ab9c179430733f677fab14229ac73944b14b6799,be809d5e5c89fa188ce7b612695b6f68c5d742a2..61c22c90beee63315c71a3a22af06655705727a9
--- 1/Makefile
--- 2/Makefile
+++ b/Makefile
@@@ -76,14 -73,18 +76,18 @@@ hdrs = dnsmasq.h config.h dhcp-protocol
  all : $(BUILDDIR)
        @cd $(BUILDDIR) && $(MAKE) \
   top="$(top)" \
 - build_cflags="$(version) $(dbus_cflags) $(idn_cflags) $(ct_cflags) $(lua_cflags)" \
 - build_libs="$(dbus_libs) $(idn_libs) $(ct_libs) $(lua_libs) $(sunos_libs)" \
 + build_cflags="$(version) $(dbus_cflags) $(idn_cflags) $(ct_cflags) $(lua_cflags) $(ssl_cflags)" \
 + build_libs="$(dbus_libs) $(idn_libs) $(ct_libs) $(lua_libs) $(sunos_libs) $(ssl_libs)" \
   -f $(top)/Makefile dnsmasq 
  
- clean :
-       rm -f *~ $(BUILDDIR)/*.mo contrib/*/*~ */*~ $(BUILDDIR)/*.pot 
+ mostly_clean :
+       rm -f $(BUILDDIR)/*.mo $(BUILDDIR)/*.pot 
        rm -f $(BUILDDIR)/.configured $(BUILDDIR)/*.o $(BUILDDIR)/dnsmasq.a $(BUILDDIR)/dnsmasq 
-       rm -rf core */core
+ 
+ clean : mostly_clean
+       rm -f $(BUILDDIR)/dnsmasq_baseline
+       rm -f core */core
+       rm -f *~ contrib/*/*~ */*~
  
  install : all install-common
  

diff --cc src/cache.c
Simple merge

diff --cc src/config.h
Simple merge

diff --cc src/dns-protocol.h
Simple merge

diff --cc src/dnsmasq.c
Simple merge

diff --cc src/dnsmasq.h
index 429e95f5467ffd9e0f2bf98a40b3729f45d9242c,4d368c5d23765a0eff278e640cb5d82cd95f1dc4..90173acfcd622b6ec22ea7f58f21d8d6baa062a3
--- 1/src/dnsmasq.h
--- 2/src/dnsmasq.h
+++ b/src/dnsmasq.h
@@@ -224,9 -221,11 +224,12 @@@ struct event_desc 
  #define OPT_TFTP_LC        38
  #define OPT_CLEVERBIND     39
  #define OPT_TFTP           40
- #define OPT_FAST_RA        41
- #define OPT_DNSSEC_VALIDATE 42
- #define OPT_LAST           43
+ #define OPT_CLIENT_SUBNET  41
+ #define OPT_QUIET_DHCP     42
+ #define OPT_QUIET_DHCP6    43
+ #define OPT_QUIET_RA     44
 -#define OPT_LAST           45
++#define OPT_DNSSEC_VALIDATE 45
++#define OPT_LAST           46
  
  /* extra flags for my_syslog, we use a couple of facilities since they are known 
     not to occupy the same bits as priorities, no matter how syslog.h is set up. */
@@@ -971,12 -992,11 +1001,14 @@@ int private_net(struct in_addr addr, in
  
  /* auth.c */
  #ifdef HAVE_AUTH
- size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t now, union mysockaddr *peer_addr);
+ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, 
+                  time_t now, union mysockaddr *peer_addr, int local_query);
+ int in_zone(struct auth_zone *zone, char *name, char **cut);
  #endif
  
 +/* dnssec.c */
 +int dnssec_validate(struct dns_header *header, size_t plen);
 +
  /* util.c */
  void rand_init(void);
  unsigned short rand16(void);

diff --cc src/forward.c
index f93cc545cfc9cb8443840a35ad7449e077da8d77,7ed88801b40ff8f23c7cc75b1e4c33fcd40aeba6..1c66acf875809ef7ebae62ca65413b1ede9447a7
--- 1/src/forward.c
--- 2/src/forward.c
+++ b/src/forward.c
@@@ -465,19 -476,29 +476,29 @@@ static size_t process_reply(struct dns_
       than we allow, trim it so that we don't get overlarge
       requests for the client. We can't do this for signed packets. */
  
-   if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign)) && !is_sign)
+   if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign)))
      {
-       unsigned short udpsz;
-       unsigned char *psave = sizep;
+       if (!is_sign)
+       {
+         unsigned short udpsz;
+         unsigned char *psave = sizep;
+         
+         GETSHORT(udpsz, sizep);
+         if (udpsz > daemon->edns_pktsz)
+           PUTSHORT(daemon->edns_pktsz, psave);
+       }
        
-       GETSHORT(udpsz, sizep);
-       if (udpsz > daemon->edns_pktsz)
-       PUTSHORT(daemon->edns_pktsz, psave);
+       if (check_subnet && !check_source(header, plen, pheader, query_source))
+       {
+         my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch"));
+         return 0;
+       }
      }
+       
  
    /* RFC 4035 sect 4.6 para 3 */
 -  if (!is_sign && !option_bool(OPT_DNSSEC))
 -    header->hb4 &= ~HB4_AD;
 +  if (!is_sign && !option_bool(OPT_DNSSEC_PROXY))
 +     header->hb4 &= ~HB4_AD;
  
    if (OPCODE(header) != QUERY || (RCODE(header) != NOERROR && RCODE(header) != NXDOMAIN))
      return n;

diff --cc src/option.c
index bcc72f6da2de0ca04c5fcb76d6b8b140fd73527d,0ba266436ba581edb5316ecc3ba9e2d6c3a179b3..defe014474f406da567ecb9612af6566e4491867
--- 1/src/option.c
--- 2/src/option.c
+++ b/src/option.c
@@@ -64,76 -64,80 +64,81 @@@ struct myoption 
  #define OPTSTRING "951yZDNLERKzowefnbvhdkqr:m:p:c:l:s:i:t:u:g:a:x:S:C:A:T:H:Q:I:B:F:G:O:M:X:V:U:j:P:J:W:Y:2:4:6:7:8:0:3:"
  
  /* options which don't have a one-char version */
- #define LOPT_RELOAD    256
- #define LOPT_NO_NAMES  257
- #define LOPT_TFTP      258
- #define LOPT_SECURE    259
- #define LOPT_PREFIX    260
- #define LOPT_PTR       261
- #define LOPT_BRIDGE    262
- #define LOPT_TFTP_MAX  263
- #define LOPT_FORCE     264
- #define LOPT_NOBLOCK   265
- #define LOPT_LOG_OPTS  266
- #define LOPT_MAX_LOGS  267
- #define LOPT_CIRCUIT   268
- #define LOPT_REMOTE    269
- #define LOPT_SUBSCR    270
- #define LOPT_INTNAME   271
- #define LOPT_BANK      272
- #define LOPT_DHCP_HOST 273
- #define LOPT_APREF     274
- #define LOPT_OVERRIDE  275
- #define LOPT_TFTPPORTS 276
- #define LOPT_REBIND    277
- #define LOPT_NOLAST    278
- #define LOPT_OPTS      279
- #define LOPT_DHCP_OPTS 280
- #define LOPT_MATCH     281
- #define LOPT_BROADCAST 282
- #define LOPT_NEGTTL    283
- #define LOPT_ALTPORT   284
- #define LOPT_SCRIPTUSR 285
- #define LOPT_LOCAL     286
- #define LOPT_NAPTR     287
- #define LOPT_MINPORT   288
- #define LOPT_DHCP_FQDN 289
- #define LOPT_CNAME     290
- #define LOPT_PXE_PROMT 291
- #define LOPT_PXE_SERV  292
- #define LOPT_TEST      293
- #define LOPT_TAG_IF    294
- #define LOPT_PROXY     295
- #define LOPT_GEN_NAMES 296
- #define LOPT_MAXTTL    297
- #define LOPT_NO_REBIND 298
- #define LOPT_LOC_REBND 299
- #define LOPT_ADD_MAC   300
- #define LOPT_SEC_PROXY 301
- #define LOPT_INCR_ADDR 302
- #define LOPT_CONNTRACK 303
- #define LOPT_FQDN      304
- #define LOPT_LUASCRIPT 305
- #define LOPT_RA        306
- #define LOPT_DUID      307
- #define LOPT_HOST_REC  308
- #define LOPT_TFTP_LC   309
- #define LOPT_RR        310
- #define LOPT_CLVERBIND 311
- #define LOPT_MAXCTTL   312
- #define LOPT_AUTHZONE  313
- #define LOPT_AUTHSERV  314
- #define LOPT_AUTHTTL   315
- #define LOPT_AUTHSOA   316
- #define LOPT_AUTHSFS   317
- #define LOPT_AUTHPEER  318
- #define LOPT_IPSET     319
- #define LOPT_SYNTH     320
- #define LOPT_SEC_VALID 321
+ #define LOPT_RELOAD       256
+ #define LOPT_NO_NAMES     257
+ #define LOPT_TFTP         258
+ #define LOPT_SECURE       259
+ #define LOPT_PREFIX       260
+ #define LOPT_PTR          261
+ #define LOPT_BRIDGE       262
+ #define LOPT_TFTP_MAX     263
+ #define LOPT_FORCE        264
+ #define LOPT_NOBLOCK      265
+ #define LOPT_LOG_OPTS     266
+ #define LOPT_MAX_LOGS     267
+ #define LOPT_CIRCUIT      268
+ #define LOPT_REMOTE       269
+ #define LOPT_SUBSCR       270
+ #define LOPT_INTNAME      271
+ #define LOPT_BANK         272
+ #define LOPT_DHCP_HOST    273
+ #define LOPT_APREF        274
+ #define LOPT_OVERRIDE     275
+ #define LOPT_TFTPPORTS    276
+ #define LOPT_REBIND       277
+ #define LOPT_NOLAST       278
+ #define LOPT_OPTS         279
+ #define LOPT_DHCP_OPTS    280
+ #define LOPT_MATCH        281
+ #define LOPT_BROADCAST    282
+ #define LOPT_NEGTTL       283
+ #define LOPT_ALTPORT      284
+ #define LOPT_SCRIPTUSR    285
+ #define LOPT_LOCAL        286
+ #define LOPT_NAPTR        287
+ #define LOPT_MINPORT      288
+ #define LOPT_DHCP_FQDN    289
+ #define LOPT_CNAME        290
+ #define LOPT_PXE_PROMT    291
+ #define LOPT_PXE_SERV     292
+ #define LOPT_TEST         293
+ #define LOPT_TAG_IF       294
+ #define LOPT_PROXY        295
+ #define LOPT_GEN_NAMES    296
+ #define LOPT_MAXTTL       297
+ #define LOPT_NO_REBIND    298
+ #define LOPT_LOC_REBND    299
+ #define LOPT_ADD_MAC      300
+ #define LOPT_DNSSEC       301
+ #define LOPT_INCR_ADDR    302
+ #define LOPT_CONNTRACK    303
+ #define LOPT_FQDN         304
+ #define LOPT_LUASCRIPT    305
+ #define LOPT_RA           306
+ #define LOPT_DUID         307
+ #define LOPT_HOST_REC     308
+ #define LOPT_TFTP_LC      309
+ #define LOPT_RR           310
+ #define LOPT_CLVERBIND    311
+ #define LOPT_MAXCTTL      312
+ #define LOPT_AUTHZONE     313
+ #define LOPT_AUTHSERV     314
+ #define LOPT_AUTHTTL      315
+ #define LOPT_AUTHSOA      316
+ #define LOPT_AUTHSFS      317
+ #define LOPT_AUTHPEER     318
+ #define LOPT_IPSET        319
+ #define LOPT_SYNTH        320
  #ifdef OPTION6_PREFIX_CLASS 
- #define LOPT_PREF_CLSS 322
+ #define LOPT_PREF_CLSS    321
  #endif
- #define LOPT_FAST_RA   322
+ #define LOPT_RELAY        323
+ #define LOPT_RA_PARAM     324
+ #define LOPT_ADD_SBNET    325
+ #define LOPT_QUIET_DHCP   326
+ #define LOPT_QUIET_DHCP6  327
+ #define LOPT_QUIET_RA     328
++#define LOPT_SEC_VALID    329
  
  
  #ifdef HAVE_GETOPT_LONG
@@@ -397,7 -406,8 +408,8 @@@ static struct 
    { LOPT_PXE_SERV, ARG_DUP, "<service>", gettext_noop("Boot service for PXE menu."), NULL },
    { LOPT_TEST, 0, NULL, gettext_noop("Check configuration syntax."), NULL },
    { LOPT_ADD_MAC, OPT_ADD_MAC, NULL, gettext_noop("Add requestor's MAC address to forwarded DNS queries."), NULL },
-   { LOPT_SEC_PROXY, OPT_DNSSEC_PROXY, NULL, gettext_noop("Proxy DNSSEC validation results from upstream nameservers."), NULL },
+   { LOPT_ADD_SBNET, ARG_ONE, "<v4 pref>[,<v6 pref>]", gettext_noop("Add requestor's IP subnet to forwarded DNS queries."), NULL },
 -  { LOPT_DNSSEC, OPT_DNSSEC, NULL, gettext_noop("Proxy DNSSEC validation results from upstream nameservers."), NULL },
++  { LOPT_DNSSEC, OPT_DNSSEC_PROXY, NULL, gettext_noop("Proxy DNSSEC validation results from upstream nameservers."), NULL },
    { LOPT_INCR_ADDR, OPT_CONSEC_ADDR, NULL, gettext_noop("Attempt to allocate sequential IP addresses to DHCP clients."), NULL },
    { LOPT_CONNTRACK, OPT_CONNTRACK, NULL, gettext_noop("Copy connection-track mark from queries to upstream connections."), NULL },
    { LOPT_FQDN, OPT_FQDN_UPDATE, NULL, gettext_noop("Allow DHCP clients to do their own DDNS updates."), NULL },
@@@ -414,10 -423,7 +425,10 @@@
    { LOPT_AUTHSFS, ARG_DUP, "<NS>[,<NS>...]", gettext_noop("Secondary authoritative nameservers for forward domains"), NULL },
    { LOPT_AUTHPEER, ARG_DUP, "<ipaddr>[,<ipaddr>...]", gettext_noop("Peers which are allowed to do zone transfer"), NULL },
    { LOPT_IPSET, ARG_DUP, "/<domain>/<ipset>[,<ipset>...]", gettext_noop("Specify ipsets to which matching domains should be added"), NULL },
-   { LOPT_SYNTH, ARG_DUP, "<domain>,<range>,[<prefix>]", gettext_noop("Specify a domain and address range for sythesised names"), NULL },
+   { LOPT_SYNTH, ARG_DUP, "<domain>,<range>,[<prefix>]", gettext_noop("Specify a domain and address range for synthesised names"), NULL },
 +#ifdef HAVE_DNSSEC
 +  { LOPT_SEC_VALID, OPT_DNSSEC_VALIDATE, NULL, gettext_noop("Activate DNSSEC validation"), NULL },
 +#endif
  #ifdef OPTION6_PREFIX_CLASS 
    { LOPT_PREF_CLSS, ARG_DUP, "set:tag,<class>", gettext_noop("Specify DHCPv6 prefix class"), NULL },
  #endif

diff --cc src/rfc1035.c
Simple merge