From: Simon Kelley Date: Mon, 14 Feb 2011 20:19:14 +0000 (+0000) Subject: import of dnsmasq-2.56.tar.gz X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=28866e9567f1ef1cb12d19e78e0e5d5a0335c059;p=people%2Fms%2Fdnsmasq.git import of dnsmasq-2.56.tar.gz --- diff --git a/CHANGELOG b/CHANGELOG index 3739541..f2e4977 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,17 +1,141 @@ +version 2.56 + Add a patch to allow dnsmasq to get interface names right in a + Solaris zone. Thanks to Dj Padzensky for this. + + Improve data-type parsing heuristics so that + --dhcp-option=option:domain-search,. + treats the value as a string and not an IP address. + Thanks to Clemens Fischer for spotting that. + + Add IPv6 support to the TFTP server. Many thanks to Jan + 'RedBully' Seiffert for the patches. + + Log DNS queries at level LOG_INFO, rather then + LOG_DEBUG. This makes things consistent with DHCP + logging. Thanks to Adam Pribyl for spotting the problem. + + Ensure that dnsmasq terminates cleanly when using + --syslog-async even if it cannot make a connection to the + syslogd. + + Add --add-mac option. This is to support currently + experimental DNS filtering facilities. Thanks to Benjamin + Petrin for the orignal patch. + + Fix bug which meant that tags were ignored in dhcp-range + configuration specifying PXE-proxy service. Thanks to + Cristiano Cumer for spotting this. + + Raise an error if there is extra junk, not part of an + option, on the command line. + + Flag a couple of log messages in cache.c as coming from + the DHCP subsystem. Thanks to Olaf Westrik for the patch. + + Omit timestamps from logs when a) logging to stderr and + b) --keep-in-forground is set. The logging facility on the + other end of stderr can be assumned to supply them. Thanks + to John Hallam for the patch. + + Don't complain about strings longer than 255 characters in + --txt-record, just split the long strings into 255 + character chunks instead. + + Fix crash on double-free. This bug can only happen when + dhcp-script is in use and then only in rare circumstances + triggered by high DHCP transaction rate and a slow + script. Thanks to Ferenc Wagner for finding the problem. + + Only log that a file has been sent by TFTP after the + transfer has completed succesfully. + + A good suggestion from Ferenc Wagner: extend + the --domain option to allow this sort of thing: + --domain=thekelleys.org.uk,192.168.0.0/24,local + which automatically creates + --local=/thekelleys.org.uk/ + --local=/0.168.192.in-addr.arpa/ + + Tighten up syntax checking of hex contants in the config + file. Thanks to Fred Damen for spotting this. + + Add dnsmasq logo/icon, contributed by Justin Swift. Many + thanks for that. + + Never cache DNS replies which have the 'cd' bit set, or + which result from queries forwarded with the 'cd' bit + set. The 'cd' bit instructs a DNSSEC validating server + upstream to ignore signature failures and return replies + anyway. Without this change it's possible to pollute the + dnsmasq cache with bad data by making a query with the + 'cd' bit set and subsequent queries would return this data + without its being marked as suspect. Thanks to Anders + Kaseorg for pointing out this problem. + + Add --proxy-dnssec flag, for compliance with RFC + 4035. Dnsmasq will now clear the 'ad' bit in answers returned + from upstream validating nameservers unless this option is + set. + + Allow a filename of "-" for --conf-file to read + stdin. Suggestion from Timothy Redaelli. + + Rotate the order of SRV records in replies, to provide + round-robin load balancing when all the priorities are + equal. Thanks to Peter McKinney for the suggestion. + + Edit + contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist + so that it doesn't log all queries to a file by + default. Thanks again to Peter McKinney. + + By default, setting an IPv4 address for a domain but not + an IPv6 address causes dnsmasq to return + an NODATA reply for IPv6 (or vice-versa). So + --address=/google.com/1.2.3.4 stops IPv6 queries for + *google.com from being forwarded. Make it possible to + override this behaviour by defining the sematics if the + same domain appears in both --server and --address. + In that case, the --address has priority for the address + family in which is appears, but the --server has priority + of the address family which doesn't appear in --adddress + So: + --address=/google.com/1.2.3.4 + --server=/google.com/# + will return 1.2.3.4 for IPv4 queries for *.google.com but + forward IPv6 queries to the normal upstream nameserver. + Similarly when setting an IPv6 address + only this will allow forwarding of IPv4 queries. Thanks to + William for pointing out the need for this. + + Allow more than one --dhcp-optsfile and --dhcp-hostsfile + and make them understand directories as arguments in the + same way as --addn-hosts. Suggestion from John Hanks. + + Ignore rebinding requests for leases we don't know + about. Rebind is broadcast, so we might get to overhear a + request meant for another DHCP server. NAKing this is + wrong. Thanks to Brad D'Hondt for assistance with this. + + Fix cosmetic bug which produced strange output when + dumping cache statistics with some configurations. Thanks + to Fedor Kozhevnikov for spotting this. + + version 2.55 - Fix crash when /etc/ethers is in use. Thanks to - Gianluigi Tiesi for finding this. + Fix crash when /etc/ethers is in use. Thanks to + Gianluigi Tiesi for finding this. - Fix crash in netlink_multicast(). Thanks to Arno Wald for - finding this one. + Fix crash in netlink_multicast(). Thanks to Arno Wald for + finding this one. - Allow the empty domain "." in dhcp domain-search (119) - options. + Allow the empty domain "." in dhcp domain-search (119) + options. version 2.54 - There is no version 2.54 to avoid confusion with 2.53, - which incorrectly identifies itself as 2.54. + There is no version 2.54 to avoid confusion with 2.53, + which incorrectly identifies itself as 2.54. version 2.53 diff --git a/FAQ b/FAQ index d7df80c..a930516 100644 --- a/FAQ +++ b/FAQ @@ -354,7 +354,7 @@ A: Yes, from version-2.21. The support is only available running under If a physical interface has more than one IP address or aliases with extra IP addresses, then any dhcp-ranges corresponding to these addresses can be used for address allocation. So if an - interface has addresses 192.168.1.0/24 and 192.68.2.0/24 and there + interface has addresses 192.168.1.0/24 and 192.168.2.0/24 and there are DHCP ranges 192.168.1.100-192.168.1.200 and 192.168.2.100-192.168.2.200 then both ranges would be used for host connected to the physical interface. A more typical use might be to @@ -413,10 +413,11 @@ A: Change your kernel configuration: either deselect CONFIG_SECURITY _or_ select CONFIG_SECURITY_CAPABILITIES. Alternatively, you can remove the need to set capabilities by running dnsmasq as root. -Q: Where can I get .rpms Suitable for Suse? -A: Dnsmasq is in Suse itself, and the latest releases are also - available at ftp://ftp.suse.com/pub/people/ug/ +Q: Where can I get .rpms Suitable for openSUSE/SLES? + +A: Dnsmasq is in openSUSE itself, and the latest releases are also + available at http://download.opensuse.org/repositories/network/ Q: Can I run dnsmasq in a Linux vserver? diff --git a/contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist b/contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist index fa99176..87725b1 100644 --- a/contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist +++ b/contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist @@ -8,8 +8,6 @@ /usr/local/sbin/dnsmasq --keep-in-foreground - --log-queries - --log-facility=/var/log/dnsmasq.log RunAtLoad diff --git a/dnsmasq.conf.example b/dnsmasq.conf.example index fd634bc..f7ea58b 100644 --- a/dnsmasq.conf.example +++ b/dnsmasq.conf.example @@ -7,8 +7,8 @@ # The following two options make you a better netizen, since they # tell dnsmasq to filter out queries which the public DNS cannot # answer, and which load the servers (especially the root servers) -# uneccessarily. If you have a dial-on-demand link they also stop -# these requests from bringing up the link uneccessarily. +# necessarily. If you have a dial-on-demand link they also stop +# these requests from bringing up the link necessarily. # Never forward plain names (without a dot or domain part) #domain-needed @@ -48,7 +48,7 @@ # non-public domains. #server=/localnet/192.168.0.1 -# Example of routing PTR queries to nameservers: this will send all +# Example of routing PTR queries to nameservers: this will send all # address->name queries for 192.168.3/24 to nameserver 10.1.2.3 #server=/3.168.192.in-addr.arpa/10.1.2.3 @@ -57,14 +57,14 @@ #local=/localnet/ # Add domains which you want to force to an IP address here. -# The example below send any host in doubleclick.net to a local -# webserver. -#address=/doubleclick.net/127.0.0.1 +# The example below send any host in double-click.net to a local +# web-server. +#address=/double-click.net/127.0.0.1 # --address (and --server) work with IPv6 addresses too. #address=/www.thekelleys.org.uk/fe80::20d:60ff:fe36:f83 -# You can control how dnsmasq talks to a server: this forces +# You can control how dnsmasq talks to a server: this forces # queries to 10.1.2.3 to be routed via eth1 # server=10.1.2.3@eth1 @@ -90,7 +90,7 @@ #listen-address= # If you want dnsmasq to provide only DNS service on an interface, # configure it as shown above, and then use the following line to -# disable DHCP on it. +# disable DHCP and TFTP on it. #no-dhcp-interface= # On systems which support it, dnsmasq binds the wildcard address, @@ -145,7 +145,7 @@ # some DHCP options may be set only for this network. #dhcp-range=set:red,192.168.0.50,192.168.0.150 -# Use this DHCP range only when the tag "green" is set. +# Use this DHCP range only when the tag "green" is set. #dhcp-range=tag:green,192.168.0.50,192.168.0.150,12h # Specify a subnet which can't be used for dynamic address allocation, @@ -153,17 +153,17 @@ # dhcp-host declarations will be ignored unless there is a dhcp-range # of some type for the subnet in question. # In this case the netmask is implied (it comes from the network -# configuration on the machine running dnsmasq) it is possible to give -# an explict netmask instead. +# configuration on the machine running dnsmasq) it is possible to give +# an explicit netmask instead. #dhcp-range=192.168.0.0,static - + # Supply parameters for specified hosts using DHCP. There are lots # of valid alternatives, so we will give examples of each. Note that # IP addresses DO NOT have to be in the range given above, they just # need to be on the same network. The order of the parameters in these -# do not matter, it's permissble to give name,adddress and MAC in any order +# do not matter, it's permissible to give name,address and MAC in any order -# Always allocate the host with ethernet address 11:22:33:44:55:66 +# Always allocate the host with Ethernet address 11:22:33:44:55:66 # The IP address 192.168.0.60 #dhcp-host=11:22:33:44:55:66,192.168.0.60 @@ -171,13 +171,13 @@ # 11:22:33:44:55:66 to be "fred" #dhcp-host=11:22:33:44:55:66,fred -# Always give the host with ethernet address 11:22:33:44:55:66 +# Always give the host with Ethernet address 11:22:33:44:55:66 # the name fred and IP address 192.168.0.60 and lease time 45 minutes #dhcp-host=11:22:33:44:55:66,fred,192.168.0.60,45m -# Give a host with ethernet address 11:22:33:44:55:66 or +# Give a host with Ethernet address 11:22:33:44:55:66 or # 12:34:56:78:90:12 the IP address 192.168.0.60. Dnsmasq will assume -# that these two ethernet interfaces will never be in use at the same +# that these two Ethernet interfaces will never be in use at the same # time, and give the IP address to the second, even if it is already # in use by the first. Useful for laptops with wired and wireless # addresses. @@ -200,27 +200,27 @@ # it asks for a DHCP lease. #dhcp-host=judge -# Never offer DHCP service to a machine whose ethernet +# Never offer DHCP service to a machine whose Ethernet # address is 11:22:33:44:55:66 #dhcp-host=11:22:33:44:55:66,ignore -# Ignore any client-id presented by the machine with ethernet +# Ignore any client-id presented by the machine with Ethernet # address 11:22:33:44:55:66. This is useful to prevent a machine # being treated differently when running under different OS's or # between PXE boot and OS boot. #dhcp-host=11:22:33:44:55:66,id:* # Send extra options which are tagged as "red" to -# the machine with ethernet address 11:22:33:44:55:66 +# the machine with Ethernet address 11:22:33:44:55:66 #dhcp-host=11:22:33:44:55:66,set:red # Send extra options which are tagged as "red" to -# any machine with ethernet address starting 11:22:33: +# any machine with Ethernet address starting 11:22:33: #dhcp-host=11:22:33:*:*:*,set:red # Ignore any clients which are specified in dhcp-host lines -# or /etc/ethers. Equivalent to ISC "deny unkown-clients". -# This relies on the special "known" tag which is set when +# or /etc/ethers. Equivalent to ISC "deny unknown-clients". +# This relies on the special "known" tag which is set when # a host is matched. #dhcp-ignore=tag:!known @@ -244,11 +244,11 @@ # Send options to hosts which ask for a DHCP lease. # See RFC 2132 for details of available options. -# Common options can be given to dnsmasq by name: +# Common options can be given to dnsmasq by name: # run "dnsmasq --help dhcp" to get a list. # Note that all the common settings, such as netmask and # broadcast address, DNS server and default route, are given -# sane defaults by dnsmasq. You very likely will not need +# sane defaults by dnsmasq. You very likely will not need # any dhcp-options. If you use Windows clients and Samba, there # are some options which are recommended, they are detailed at the # end of this section. @@ -262,7 +262,7 @@ # Override the default route supplied by dnsmasq and send no default # route at all. Note that this only works for the options sent by -# default (1, 3, 6, 12, 28) the same line will send a zero-length option +# default (1, 3, 6, 12, 28) the same line will send a zero-length option # for all other option numbers. #dhcp-option=3 @@ -296,7 +296,7 @@ # http://www.samba.org/samba/ftp/docs/textdocs/DHCP-Server-Configuration.txt # adapted for a typical dnsmasq installation where the host running # dnsmasq is also the host running samba. -# you may want to uncomment some or all of them if you use +# you may want to uncomment some or all of them if you use # Windows clients and Samba. #dhcp-option=19,0 # option ip-forwarding off #dhcp-option=44,0.0.0.0 # set netbios-over-TCP/IP nameserver(s) aka WINS server(s) @@ -310,10 +310,10 @@ # Send RFC-3442 classless static routes (note the netmask encoding) #dhcp-option=121,192.168.1.0/24,1.2.3.4,10.0.0.0/8,5.6.7.8 -# Send vendor-class specific options encapsulated in DHCP option 43. +# Send vendor-class specific options encapsulated in DHCP option 43. # The meaning of the options is defined by the vendor-class so # options are sent only when the client supplied vendor class -# matches the class given here. (A substring match is OK, so "MSFT" +# matches the class given here. (A substring match is OK, so "MSFT" # matches "MSFT" and "MSFT 5.0"). This example sets the # mtftp address to 0.0.0.0 for PXEClients. #dhcp-option=vendor:PXEClient,1,0.0.0.0 @@ -330,7 +330,7 @@ # Send options to PXELinux. Note that we need to send the options even # though they don't appear in the parameter request list, so we need -# to use dhcp-option-force here. +# to use dhcp-option-force here. # See http://syslinux.zytor.com/pxe.php#special for details. # Magic number - needed before anything else is recognised #dhcp-option-force=208,f1:00:74:7e @@ -341,7 +341,7 @@ # Reboot time. (Note 'i' to send 32-bit value) #dhcp-option-force=211,30i -# Set the boot filename for netboot/PXE. You will only need +# Set the boot filename for netboot/PXE. You will only need # this is you want to boot machines over the network and you will need # a TFTP server; either dnsmasq's built in TFTP server or an # external one. (See below for how to enable the TFTP server.) @@ -353,12 +353,12 @@ #dhcp-match=set:gpxe,175 # gPXE sends a 175 option. #dhcp-boot=tag:!gpxe,undionly.kpxe #dhcp-boot=mybootimage - + # Encapsulated options for Etherboot gPXE. All the options are # encapsulated within option 175 #dhcp-option=encap:175, 1, 5b # priority code -#dhcp-option=encap:175, 176, 1b # no-proxydhcp -#dhcp-option=encap:175, 177, string # bus-id +#dhcp-option=encap:175, 176, 1b # no-proxydhcp +#dhcp-option=encap:175, 177, string # bus-id #dhcp-option=encap:175, 189, 1b # BIOS drive code #dhcp-option=encap:175, 190, user # iSCSI username #dhcp-option=encap:175, 191, pass # iSCSI password @@ -368,7 +368,7 @@ #dhcp-match=peecees, option:client-arch, 0 #x86-32 #dhcp-match=itanics, option:client-arch, 2 #IA64 #dhcp-match=hammers, option:client-arch, 6 #x86-64 -#dhcp-match=mactels, option:client-arch, 7 #EFI x86-64 +#dhcp-match=mactels, option:client-arch, 7 #EFI x86-64 # Do real PXE, rather than just booting a single file, this is an # alternative to dhcp-boot. @@ -380,11 +380,11 @@ #pxe-service=x86PC, "Boot from local disk" # Loads /pxelinux.0 from dnsmasq TFTP server. -#pxe-service=x86PC, "Install Linux", pxelinux +#pxe-service=x86PC, "Install Linux", pxelinux # Loads /pxelinux.0 from TFTP server at 1.2.3.4. # Beware this fails on old PXE ROMS. -#pxe-service=x86PC, "Install Linux", pxelinux, 1.2.3.4 +#pxe-service=x86PC, "Install Linux", pxelinux, 1.2.3.4 # Use bootserver on network, found my multicast or broadcast. #pxe-service=x86PC, "Install windows from RIS server", 1 @@ -395,20 +395,20 @@ # If you have multicast-FTP available, # information for that can be passed in a similar way using options 1 # to 5. See page 19 of -# http://download.intel.com/design/archives/wfm/downloads/pxespec.pdf +# http://download.intel.com/design/archives/wfm/downloads/pxespec.pdf + - # Enable dnsmasq's built-in TFTP server #enable-tftp -# Set the root directory for files availble via FTP. +# Set the root directory for files available via FTP. #tftp-root=/var/ftpd # Make the TFTP server more secure: with this set, only files owned by # the user dnsmasq is running as will be send over the net. #tftp-secure -# This option stops dnsmasq from negotiating a larger blocksize for TFTP +# This option stops dnsmasq from negotiating a larger blocksize for TFTP # transfers. It will slow things down, but may rescue some broken TFTP # clients. #tftp-no-blocksize @@ -433,16 +433,16 @@ # and take over the lease for any client which broadcasts on the network, # whether it has a record of the lease or not. This avoids long timeouts # when a machine wakes up on a new network. DO NOT enable this if there's -# the slighest chance that you might end up accidentally configuring a DHCP +# the slightest chance that you might end up accidentally configuring a DHCP # server for your campus/company accidentally. The ISC server uses # the same option, and this URL provides more information: -# http://www.isc.org/index.pl?/sw/dhcp/authoritative.php +# http://www.isc.org/files/auth.html #dhcp-authoritative # Run an executable when a DHCP lease is created or destroyed. -# The arguments sent to the script are "add" or "del", +# The arguments sent to the script are "add" or "del", # then the MAC address, the IP address and finally the hostname -# if there is one. +# if there is one. #dhcp-script=/bin/echo # Set the cachesize here. diff --git a/doc.html b/doc.html index 18a4b24..0a73083 100644 --- a/doc.html +++ b/doc.html @@ -1,9 +1,17 @@ Dnsmasq - a DNS forwarder for NAT firewalls. + -

Dnsmasq

+ + + + + +

Dnsmasq

+ Dnsmasq is a lightweight, easy to configure DNS forwarder and DHCP server. It is designed to provide DNS and, optionally, DHCP, to a small network. It can serve the names of local machines which are diff --git a/logo/README b/logo/README new file mode 100644 index 0000000..05a8250 --- /dev/null +++ b/logo/README @@ -0,0 +1,12 @@ +Dnsmasq logo, contributed by Justin Clift. + +The source format is Inkscape SVG vector format, which is scalable and +easy to export to other formats. For convenience I've included a 56x31 +png export and a 16x16 ico suitable for use as a web favicon. + +Simon Kelley, 22/10/2010 + + + + + diff --git a/logo/favicon.ico b/logo/favicon.ico new file mode 100644 index 0000000..1c7e8f8 Binary files /dev/null and b/logo/favicon.ico differ diff --git a/logo/icon.png b/logo/icon.png new file mode 100644 index 0000000..cf48461 Binary files /dev/null and b/logo/icon.png differ diff --git a/logo/icon.svg b/logo/icon.svg new file mode 100644 index 0000000..a2f7521 --- /dev/null +++ b/logo/icon.svg @@ -0,0 +1,157 @@ + +image/svg+xml + + + + + + + + + + + + \ No newline at end of file diff --git a/man/dnsmasq.8 b/man/dnsmasq.8 index 80d0120..511f57f 100644 --- a/man/dnsmasq.8 +++ b/man/dnsmasq.8 @@ -23,7 +23,7 @@ options. It includes a secure, read-only, TFTP server to allow net/PXE boot of DHCP hosts and also supports BOOTP. .PP Dnsmasq -supports IPv6 for DNS, but not DHCP. +supports IPv6 for DNS and TFTP, but not DHCP. .SH OPTIONS Note that in general missing parameters are allowed and switch off functions, for instance "--pid-file" disables writing a PID file. On @@ -415,7 +415,9 @@ all that match are returned. .TP .B \-Y, --txt-record=[[,],] Return a TXT DNS record. The value of TXT record is a set of strings, -so any number may be included, split by commas. +so any number may be included, delimited by commas; use quotes to put +commas into a string. Note that the maximum length of a single string +is 255 characters, longer strings are split into 255 character chunks. .TP .B --ptr-record=[,] Return a PTR DNS record. @@ -442,6 +444,15 @@ the name. More than one name may be associated with an interface address by repeating the flag; in that case the first instance is used for the reverse address-to-name mapping. .TP +.B --add-mac +Add the MAC address of the requestor to DNS queries which are +forwarded upstream. This may be used to DNS filtering by the upstream +server. The MAC address can only be added if the requestor is on the same +subnet as the dnsmasq server. Note that the mechanism used to achieve this (an EDNS0 option) +is not yet standardised, so this should be considered +experimental. Also note that exposing MAC addresses in this way may +have security and privacy implications. +.TP .B \-c, --cache-size= Set the size of dnsmasq's cache. The default is 150 names. Setting the cache size to zero disables caching. .TP @@ -456,6 +467,20 @@ Set the maximum number of concurrent DNS queries. The default value is where this needs to be increased is when using web-server log file resolvers, which can generate large numbers of concurrent queries. .TP +.B --proxy-dnssec +A resolver on a client machine can do DNSSEC validation in two ways: it +can perform the cryptograhic operations on the reply it receives, or +it can rely on the upstream recursive nameserver to do the validation +and set a bit in the reply if it succeeds. Dnsmasq is not a DNSSEC +validator, so it cannot perform the validation role of the recursive nameserver, +but it can pass through the validation results from its own upstream +nameservers. This option enables this behaviour. You should only do +this if you trust all the configured upstream nameservers +.I and the network between you and them. +If you use the first DNSSEC mode, validating resolvers in clients, +this option is not required. Dnsmasq always returns all the data +needed for a client to do validation itself. +.TP .B \-F, --dhcp-range=[interface:,][tag:[,tag:],][set:,[,[,]][,] Enable the DHCP server. Addresses will be given out from the range to and from statically defined addresses given @@ -588,15 +613,17 @@ time and there is no way for dnsmasq to enforce this. It is, for instance, useful to allocate a stable IP address to a laptop which has both wired and wireless interfaces. .TP -.B --dhcp-hostsfile= -Read DHCP host information from the specified file. The file contains +.B --dhcp-hostsfile= +Read DHCP host information from the specified file. If a directory +is given, then read all the files contained in that directory. The file contains information about one host per line. The format of a line is the same as text to the right of '=' in --dhcp-host. The advantage of storing DHCP host information in this file is that it can be changed without re-starting dnsmasq: the file will be re-read when dnsmasq receives SIGHUP. .TP -.B --dhcp-optsfile= -Read DHCP option information from the specified file. The advantage of +.B --dhcp-optsfile= +Read DHCP option information from the specified file. If a directory +is given, then read all the files contained in that directory. The advantage of using this option is the same as for --dhcp-hostsfile: the dhcp-optsfile will be re-read when dnsmasq receives SIGHUP. Note that it is possible to encode the information in a @@ -946,7 +973,8 @@ all of the following variables added. DNSMASQ_CLIENT_ID if the host provided a client-id. DNSMASQ_DOMAIN if the fully-qualified domain name of the host is -known, this is set to the domain part. +known, this is set to the domain part. (Note that the hostname passed +to the script as an argument is never fully-qualified.) If the client provides vendor-class, hostname or user-class, these are provided in DNSMASQ_VENDOR_CLASS @@ -1020,7 +1048,7 @@ as if they had arrived at . This option is necessary when using "old style" bridging on BSD platforms, since packets arrive at tap interfaces which don't have an IP address. .TP -.B \-s, --domain=[,
] +.B \-s, --domain=[,
[,local]] Specifies DNS domains for the DHCP server. Domains may be be given unconditionally (without the IP range) or for limited IP ranges. This has two effects; firstly it causes the DHCP server to return the domain to any hosts @@ -1039,11 +1067,22 @@ and have a machine whose DHCP hostname is "laptop". The IP address for that mach .B dnsmasq both as "laptop" and "laptop.thekelleys.org.uk". If the domain is given as "#" then the domain is read from the first "search" directive -in /etc/resolv.conf (or equivalent). The address range can be of the form +in /etc/resolv.conf (or equivalent). + +The address range can be of the form , or / or just a single . See .B --dhcp-fqdn which can change the behaviour of dnsmasq with domains. + +If the address range is given as ip-address/network-size, then a +additional flag "local" may be supplied which has the effect of adding +--local declarations for forward and reverse DNS queries. Eg. +.B --domain=thekelleys.org.uk,192.168.0.0/24,local +is identical to +.B --domain=thekelleys.org.uk,192.168.0.0/24 +--local=/thekelleys.org.uk/ --local=/0.168.192.in-addr.arpa/ +The network size must be 8, 16 or 24 for this to be legal. .TP .B --dhcp-fqdn In the default mode, dnsmasq inserts the unqualified names of @@ -1123,7 +1162,8 @@ of concurrent TFTP connections is limited by the size of the port range. .TP .B \-C, --conf-file= Specify a different configuration file. The conf-file option is also allowed in -configuration files, to include multiple configuration files. +configuration files, to include multiple configuration files. A +filename of "-" causes dnsmasq to read configuration from stdin. .TP .B \-7, --conf-dir=[,......] Read all the files in the given directory as configuration @@ -1445,6 +1485,9 @@ assume that it is the system default. .IR /usr/local/etc/dnsmasq.conf .IR /etc/resolv.conf +.IR /var/run/dnsmasq/resolv.conf +.IR /etc/ppp/resolv.conf +.IR /etc/dhcpc/resolv.conf .IR /etc/hosts diff --git a/man/fr/dnsmasq.8 b/man/fr/dnsmasq.8 index 631f141..44c301b 100644 --- a/man/fr/dnsmasq.8 +++ b/man/fr/dnsmasq.8 @@ -22,7 +22,7 @@ peut être configuré pour envoyer n'importe quel option DHCP. Il inclut un serveur TFTP sécurisé en lecture seule permettant le démarrage via le réseau/PXE de clients DHCP et supporte également le protocole BOOTP. .PP -Dnsmasq supporte IPv6 pour le DNS mais pas pour le DHCP. +Dnsmasq supporte IPv6 pour le DNS et TFTP mais pas pour le DHCP. .SH OPTIONS Notes : Il est possible d'utiliser des options sans leur donner de paramètre. Dans ce cas, la fonction correspondante sera désactivée. Par exemple @@ -491,7 +491,10 @@ retournés dans la réponse. .B \-Y, --txt-record=[[,],] Définit un enregistrement DNS de type TXT. La valeur de l'enregistrement TXT est un ensemble de chaînes de caractères, donc un nombre variable de chaînes de -caractères peuvent être spécifiées, séparées par des virgules. +caractères peuvent être spécifiées, séparées par des virgules. Utilisez des +guillemets pour mettre une virgule dans une chaîne de caractères. Notez que la +longueur maximale pour une chaîne est de 255 caractères, les chaînes plus +longues étant découpées en morceaux de 255 caractères de longs. .TP .B --ptr-record=[,] Définit un enregistrement DNS de type PTR. @@ -519,6 +522,16 @@ Plus d'un nom peut être associé à une interface donnée en répétant cette o plusieurs fois; dans ce cas, l'enregistrement inverse pointe vers le nom fourni dans la première instance de cette option. .TP +.B --add-mac +Ajoute l'adresse MAC du requêteur aux requêtes DNS transmises aux serveurs +amonts. Cela peut être utilisé dans un but de filtrage DNS par les serveurs +amonts. L'adresse MAC peut uniquement être ajoutée si le requêteur est sur le +même sous-réseau que le serveur dnsmasq. Veuillez noter que le mécanisme +utilisé pour effectuer cela (une option EDNS0) n'est pas encore standardisée, +aussi cette fonctionalité doit être considérée comme expérimentale. Notez +également qu'exposer les adresses MAC de la sorte peut avoir des implications +en termes de sécurité et de vie privée. +.TP .B \-c, --cache-size= Définit la taille du cache de Dnsmasq. La valeur par défaut est de 150 noms. Définir une valeur de zéro désactive le cache. @@ -537,6 +550,21 @@ lorsqu'un serveur web a la résolution de nom activée pour l'enregistrement de son journal des requêtes, ce qui peut générer un nombre important de requêtes simultanées. .TP +.B --proxy-dnssec +Un resolveur sur une machine cliente peut effectuer la validation DNSSEC de +deux façons : il peut effectuer lui-même les opérations de chiffrements sur +la réponse reçue, ou il peut laisser le serveur récursif amont faire la +validation et positionner un drapeau dans la réponse au cas où celle-ci est +correcte. Dnsmasq n'est pas un validateur DNSSEC, aussi il ne peut effectuer +la validation comme un serveur de nom récursif, cependant il peut retransmettre +les résultats de validation de ses serveurs amonts. Cette option permet +l'activation de cette fonctionalité. Vous ne devriez utiliser cela que si vous +faites confiance aux serveurs amonts +.I ainsi que le réseau entre vous et eux. +Si vous utilisez le premier mode DNSSEC, la validation par le resolveur des +clients, cette option n'est pas requise. Dnsmasq retourne toujours toutes les +données nécessaires par un client pour effectuer la validation lui-même. +.TP .B \-F, --dhcp-range=[interface:,][tag: