Re: [Dnsmasq-discuss] Authoritative zone and no recursion replies

[Petr Mensik]

Notes below

On 3/7/19 6:09 PM, Simon Kelley wrote:
> On 15/02/2019 12:54, Petr Mensik wrote:
>> Hi everyone.
>>
>> I think it is handy to be able to delegate some suffix from internal
>> domain, lets say example.com provided by BIND or any bigger server. But
>> recursive servers do not set recursive queries on normal delegation.
>> Delegation is when I just add line into zone file:
>>
>> $ORIGIN example.com.
>> dnsmasq-private IN A 10.0.0.53
>> private IN NS dnsmasq-private
>>
>> Then query to xy.private.example.com would be forwarded to dnsmasq. It
>> is great this can be configured by dynamic update of a zone. No change
>> of configuration is necessary. It requires dnsmasq to be accessible by
>> recursive resolvers. Great for trusted network configuration.
>>
>> Unfortunately, dnsmasq does not cooperate very well with them. Recursive
>> servers use queries without recursion desired flag set. Dnsmasq tends to
>> refuse it or servfail if any forwarder is configured. For each host it
>> reads from /etc/hosts or configured from DHCP, I think it would be nice
>> to respond also without recursion to every host from hosts. The same way
>> for DHCP assigned names. AFAIK it is denied to disallow cache probing.
>> What is point to deny provided names without recursion set, when it
>> gracefully offers it when recursion is desired?
>>
>> compare when at least one server is set:
>> dig +rec mydnsmasqhost
>> dig +norec mydnsmasqhost
>>
>> where mydnsmasqhost is hostname which obtained address from dnsmasq.
>>
>> It just makes delegation from big resolvers difficult. Without auth-zone
>> with common prefix, it would not work. Is there a good reason for it? If
>> domain is set, it would be easy to create delegation without need to
>> auth-zone set.
>>
>> My example would work if --auth-zone=private.example.com would be used.
>> While it is better, why should not --domain private.example.com be
>> sufficient? It would be quite useful for VM configuration, because
>> current libvirt does not support adding auth-zone to dnsmasq
>> configuration file.
>>
>> Any comments welcome.
>>
>> Have a nice day,
>> Petr
>>
> 
> The behaviour in receiving a query without RD set changed in
> 
> http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=4139298d287eb5c57f4aa53c459cb02fc5be2495
> 
> which doesn't directly help you, but does need to be taken into account.
> 
> If I understand you correctly, you want the behaviour to change if the
> query can be answered from configured (/etc/hosts and so on) data,
> whilst keeping the same behaviour for answers which came from upstream,
> but are merely cached.
> 
> To answer the question "What is point to deny provided names without
> recursion set, when it gracefully offers it when recursion is desired?"
> The aim is to avoid a client being able to tell the difference between
> an answer coming from the dnsmasq cache, and one coming from upstream.
> If RD is set, it will get an answer, either from upstream, or from the
> cache. It can't tell the difference. The original behaviour with RD
> _unset_ was to either answer from the cache, or fail (not sending
> upstream), allowing the client to deduce the contents of the cache. That
> was changed to always SERVFAIL, and then the latest change is to always
> forward upstream. The reason given for this is to allow dig +trace to
> operate through dnsmasq.
Always forwarding upstream seems very wrong to me. If I receive query
without rd bit set, it is asking me for authoritative contents OR
direction where should I ask.

I understand dnsmasq does not really undestands zones, it cannot direct
me to NS of authoritative server. But IF queried bit IS provided by
dnsmasq, then it MUST respond with data. That is purpose of that bit,
that is reason it is in queries. I admit cache snooping could be bad,
but I am not confident it such behaviour should not be configurable. In
the first place, queries from untrusted networks should be blocked at all.

I think it is useful for admin to be able look inside cache for
remaining timeouts. I think it would be nice, if localhost queries
without rd were accepted by default and it was possible specify somehow,
who should be able to do that.
> 
> It seems that actually just ignoring the RD bit i) disallows cache
> snooping, ii) allows dig +trace to operate. Maybe that should be the
> behaviour?
No, I do not think so. I think proper delegation reply should be
generated instead. In this case, it might help, if all names NOT
provided by dnsmasq were forwarded upstream for proper delegation, but
dnsmasq served data should be answered by dnsmasq without delegation.

Cheers,
Petr

-- 
Petr Menšík
Software Engineer
Red Hat, http://www.redhat.com/
email: pemen...@redhat.com  PGP: 65C6C973

___
Dnsmasq-discuss mailing list
Dnsmasq-discuss@lists.thekelleys.org.uk
http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss

Re: [Dnsmasq-discuss] Strategies for DNS and DHCP backup

[Petr Mensik]

Never tried it myself, but if you synchronize configuration from primary
to secondary server, it might work somehow together.

Consider setting dhcp-authoritative on primary instance, but make sure
it is not there on secondary. You may want to use different dhcp-range,
so dynamically allocated hosts do not overlap.

Dns on secondary should use server=primary-ip as first server, other
servers configured after that. Use strict-order to be sure. dnsmasq
should be able to notice that server is down and use another address, so
hostnames should stay more or less synchronized.

I think proper configuration would require dhcpd from ISC, which has
some support for failover.

On 4/6/19 1:10 PM, john doe wrote:
> On 4/5/2019 10:54 PM, Chris Green wrote:
>> I run dnsmasq on a Raspberry Pi to provide DHCP and DNS services on my
>> home network.  I often spend quite long periods away from home and I'd
>> like to have a way of providing some sort of backup if the Raspberry
>> Pi dies for any reason.
>>
>> Recently the Pi has died a couple of times so I set up a second Pi
>> with the same dnsmasq configuration file but without it set to run
>> from /etc/init.d so that I could ssh into my network and start it
>> manually.  This worked OK when I had to use it recently but it does
>> require that I notice something is wrong which I may not do when I'm
>> away.
>>
>> Is there a straightforward way of having a secondary DHCP and DNS
>> server on a LAN?
>>
> 
> Thanks to Google:
> 
> https://www.reddit.com/r/pihole/comments/99xmei/two_piholes_with_dhcp_enabled_on_1_network_as/
> 
> https://github.com/jiasir/dnsmasq-ha
> 
> The above could help you getting up 'dhcp failover'.
> For DNS you would need to use zone transfer.
> 
> --
> John Doe
> 
> ___
> Dnsmasq-discuss mailing list
> Dnsmasq-discuss@lists.thekelleys.org.uk
> http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
> 

-- 
Petr Menšík
Software Engineer
Red Hat, http://www.redhat.com/
email: pemen...@redhat.com  PGP: 65C6C973

___
Dnsmasq-discuss mailing list
Dnsmasq-discuss@lists.thekelleys.org.uk
http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss

Re: [Dnsmasq-discuss] [PATCH] auth-server without interface

[Petr Mensik]

Hi Simon,

thanks, but actually, not that much. Sorry I was busy in different projects.

This change now broken my configuration, because this no longer accepts
the same combination of parameters without fatal error. Could it be made
as warning instead? It do not think it should be fatal, soa is
initialized to good enough value, contact and primary server are not
mandatory for normal operation.

Patch changing it to warning included.

On 3/7/19 6:12 PM, Simon Kelley wrote:
> On 15/02/2019 12:09, Petr Mensik wrote:
>> Hi!
>>
>> I was playing a bit with auth-vm and auth-server together with virtual
>> machine manager. I think it might be useful to omit interface in
>> auth-server at all, just change name reported by auth-vm zones on normal
>> dns port.
>>
>> Libvirt uses dnsmasq as DHCP and DNS server on each virtual network
>> configured. It listens just on one interface excluding loopback (virbr0
>> for example). If I specify its interface, it stops responding normal
>> recursive queries on it. I think there is no good reason to demand it.
>> Anyway, current manual page indicates it is optional...
>>
>> Regards,
>> Petr
>>
> 
> It was made optional in this commit.
> 
> http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=08933475abd0580cff747e3d1e0db3865207a200
> 
> 
> Does that adddress the use-case you describe?
> 
> 
> Cheers,
> 
> Simon.
> 
> 
> ___
> Dnsmasq-discuss mailing list
> Dnsmasq-discuss@lists.thekelleys.org.uk
> http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
> 

-- 
Petr Menšík
Software Engineer
Red Hat, http://www.redhat.com/
email: pemen...@redhat.com  PGP: 65C6C973
From 24ff470a21741ccea8dc5747f7d11454fb9f4851 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= 
Date: Fri, 12 Apr 2019 16:14:15 +0200
Subject: [PATCH] Accept auth-zone without auth-server

Do not fail hard if auth-zone is provided but auth-zone is not.
It is recommended and prints just warning now, but can still work
without it.
---
 src/dnsmasq.c | 25 +
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/src/dnsmasq.c b/src/dnsmasq.c
index e6140b7..704475f 100644
--- a/src/dnsmasq.c
+++ b/src/dnsmasq.c
@@ -218,11 +218,6 @@ int main (int argc, char **argv)
 die(_("asynchronous logging is not available under Android"), NULL, EC_BADCONF);
 #endif
 
-#ifndef HAVE_AUTH
-  if (daemon->auth_zones)
-die(_("authoritative DNS not available: set HAVE_AUTH in src/config.h"), NULL, EC_BADCONF);
-#endif
-
 #ifndef HAVE_LOOP
   if (option_bool(OPT_LOOP_DETECT))
 die(_("loop detection not available: set HAVE_LOOP in src/config.h"), NULL, EC_BADCONF);
@@ -233,16 +228,13 @@ int main (int argc, char **argv)
 die(_("Ubus not available: set HAVE_UBUS in src/config.h"), NULL, EC_BADCONF);
 #endif
   
-  if (daemon->max_port < daemon->min_port)
-die(_("max_port cannot be smaller than min_port"), NULL, EC_BADCONF);
-
   now = dnsmasq_time();
 
   if (daemon->auth_zones)
 {
-  if (!daemon->authserver)
-	die(_("--auth-server required when an auth zone is defined."), NULL, EC_BADCONF);
-
+#ifndef HAVE_AUTH
+  die(_("authoritative DNS not available: set HAVE_AUTH in src/config.h"), NULL, EC_BADCONF);
+#else
   /* Create a serial at startup if not configured. */
 #ifdef HAVE_BROKEN_RTC
   if (daemon->soa_sn == 0)
@@ -250,9 +242,13 @@ int main (int argc, char **argv)
 #else
   if (daemon->soa_sn == 0)
 	daemon->soa_sn = now;
+#endif
 #endif
 }
-  
+
+  if (daemon->max_port < daemon->min_port)
+die(_("max_port cannot be smaller than min_port"), NULL, EC_BADCONF);
+
 #ifdef HAVE_DHCP6
   if (daemon->dhcp6)
 {
@@ -864,6 +860,11 @@ int main (int argc, char **argv)
 }
 #endif
 
+#ifdef HAVE_AUTH
+  if (daemon->auth_zones &&!daemon->authserver)
+my_syslog(LOG_WARNING, _("--auth-server recommended when an auth zone is defined."));
+#endif
+
   if (log_err != 0)
 my_syslog(LOG_WARNING, _("warning: failed to change owner of %s: %s"), 
 	  daemon->log_file, strerror(log_err));
-- 
2.20.1

___
Dnsmasq-discuss mailing list
Dnsmasq-discuss@lists.thekelleys.org.uk
http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss

Re: [Dnsmasq-discuss] [PATCH] dnsmasq interaction with nonrecursive requests

[Petr Mensik]

I have prepared patch that allows again queries to dnsmasq without rd
bit set. It allows queries to locally defined names even without rd bit,
but stil refuses queries to cached remote records.

I think this is important issue, could it be reviewed?

On 4/12/19 11:29 AM, Petr Mensik wrote:
> Hi,
> 
> I was checking latest dnsmasq reponses to non-recursive queries. It
> seems strange, it does not work as it should. Originally, I was checking
> NXDOMAIN issue, reported on Fedora bug #1647464.
> 
> But this issue seems important, it makes difficult to use dnsmasq with
> bigger resolvers like bind or unbound. It does skip even local defined
> hosts, which I think should be responded always even without recursion
> bit set.
> 
> This was tested first on released dnsmasq 2.80 in Fedora rawhide, then
> on git compilation with version v2.80-53-g343b7b4. Both seems to be
> incorrect.
> 
> # grep -w qeos-1 /etc/hosts
> 172.16.36.1qeos-1
> 
> # dig @127.0.0.1 +norec qeos-1
> 
> ; <<>> DiG 9.11.5-P4-RedHat-9.11.5-13.P4.fc31 <<>> @127.0.0.1 +norec qeos-1
> ; (1 server found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50085
> ;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 27
> 
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 4096
> ;; QUESTION SECTION:
> ;qeos-1.  IN  A
> 
> ;; AUTHORITY SECTION:
> . 498600  IN  NS  b.root-servers.net.
> . 498600  IN  NS  m.root-servers.net.
> . 498600  IN  NS  e.root-servers.net.
> . 498600  IN  NS  f.root-servers.net.
> . 498600  IN  NS  k.root-servers.net.
> . 498600  IN  NS  l.root-servers.net.
> . 498600  IN  NS  c.root-servers.net.
> . 498600  IN  NS  d.root-servers.net.
> . 498600  IN  NS  i.root-servers.net.
> . 498600  IN  NS  g.root-servers.net.
> . 498600  IN  NS  a.root-servers.net.
> . 498600  IN  NS  h.root-servers.net.
> . 498600  IN  NS  j.root-servers.net.
> 
> ;; ADDITIONAL SECTION:
> e.root-servers.net.   153695  IN  A   192.203.230.10
> e.root-servers.net.   153695  IN  2001:500:a8::e
> h.root-servers.net.   153695  IN  A   198.97.190.53
> h.root-servers.net.   153695  IN  2001:500:1::53
> l.root-servers.net.   585734  IN  A   199.7.83.42
> l.root-servers.net.   153695  IN  2001:500:9f::42
> i.root-servers.net.   585699  IN  A   192.36.148.17
> i.root-servers.net.   153695  IN  2001:7fe::53
> a.root-servers.net.   597264  IN  A   198.41.0.4
> a.root-servers.net.   597264  IN  2001:503:ba3e::2:30
> d.root-servers.net.   153695  IN  A   199.7.91.13
> d.root-servers.net.   153695  IN  2001:500:2d::d
> c.root-servers.net.   153695  IN  A   192.33.4.12
> c.root-servers.net.   153695  IN  2001:500:2::c
> b.root-servers.net.   585695  IN  A   199.9.14.201
> b.root-servers.net.   153695  IN  2001:500:200::b
> j.root-servers.net.   153695  IN  A   192.58.128.30
> j.root-servers.net.   153695  IN  2001:503:c27::2:30
> k.root-servers.net.   586670  IN  A   193.0.14.129
> k.root-servers.net.   153695  IN  2001:7fd::1
> g.root-servers.net.   153695  IN  A   192.112.36.4
> g.root-servers.net.   153695  IN  2001:500:12::d0d
> m.root-servers.net.   153695  IN  A   202.12.27.33
> m.root-servers.net.   153695  IN  2001:dc3::35
> f.root-servers.net.   153695  IN  A   192.5.5.241
> f.root-servers.net.   153695  IN  2001:500:2f::f
> 
> # dig @127.0.0.1 +rec qeos-1
> ; <<>> DiG 9.11.5-P4-RedHat-9.11.5-13.P4.fc31 <<>> @127.0.0.1 +rec qeos-1
> ; (1 server found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50355
> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
> 
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 4096
> ;; QUESTION SECTION:
> ;qeos-1.  IN  A
> 
> ;; ANSWER SECTION:
> qeos-1.   0   IN  A   172.16.36.1
> 
> ;; Query time: 0 msec
> ;; SERVER: 127.0.0.1#53(127.0.0.1)
> ;; WHEN: Pá dub 12 05:23:57 EDT 2019
> ;; MSG SIZE  rcvd: 51
> 
> 1. https://bugzilla.redhat.com/show_bug.cgi?id=1647464
> 

-- 
Petr Menšík
Software Engineer
Red Hat, http://www.redhat.com/
email: pemen...@redhat.com  PGP: 65C6C973
From e3aa12144191713f06d341d08ab1f541e0bb6927 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= 
Date: Fri, 12 Apr 2019 15:29:00 +0200
Subject: [PATCH] Restore ability to answer non-recursive 

[Dnsmasq-discuss] Segfault during startup when using incorrect dhcp-relay values

[Knodt, Florian]

Hi,

when starting dnsmasq with a config file containing an invalid
dhcp-relay statement a segfault occurs during startup. I could observe
this with Debians bundeled 2.76-5+deb9u2 as well as manually compiled
2.76-2.80.

---snip---

/etc/dnsmasq.conf

dhcp-relay=10.10.10.1

---snip---

-- System Information:
Debian Release: 9.8
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-8-amd64 (SMP w/2 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8),
LANGUAGE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages dnsmasq depends on:
ii  dnsmasq-base 2.76-5+deb9u2
ii  init-system-helpers  1.48
ii  netbase  5.4

dnsmasq recommends no packages.

Versions of packages dnsmasq suggests:
pn  resolvconf  


--

[Logo]
Finzelberg GmbH & Co KG
Koblenzerstr. 48-56 * 56626 Andernach
Germany * Tel.: +49 2632 924-00 * Fax: +49 2632 924-040
Sitz: Andernach
Amtsgericht Koblenz HRA 10177   Komplementär:
Finzelberg Verwaltungs GmbH
Sitz: Koblenz
Amtsgericht Koblenz HRB 12325   Geschäftsführer:
Albert Ferstl
Peter Wolfgang Schmidt
Finzelberg Newsletter abonnieren 

Finzelberg Newsletter english 



smime.p7s
Description: S/MIME cryptographic signature
___
Dnsmasq-discuss mailing list
Dnsmasq-discuss@lists.thekelleys.org.uk
http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss

[Dnsmasq-discuss] dnsmasq interaction with nonrecursive requests

[Petr Mensik]

Hi,

I was checking latest dnsmasq reponses to non-recursive queries. It
seems strange, it does not work as it should. Originally, I was checking
NXDOMAIN issue, reported on Fedora bug #1647464.

But this issue seems important, it makes difficult to use dnsmasq with
bigger resolvers like bind or unbound. It does skip even local defined
hosts, which I think should be responded always even without recursion
bit set.

This was tested first on released dnsmasq 2.80 in Fedora rawhide, then
on git compilation with version v2.80-53-g343b7b4. Both seems to be
incorrect.

# grep -w qeos-1 /etc/hosts
172.16.36.1qeos-1

# dig @127.0.0.1 +norec qeos-1

; <<>> DiG 9.11.5-P4-RedHat-9.11.5-13.P4.fc31 <<>> @127.0.0.1 +norec qeos-1
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50085
;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 27

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;qeos-1.IN  A

;; AUTHORITY SECTION:
.   498600  IN  NS  b.root-servers.net.
.   498600  IN  NS  m.root-servers.net.
.   498600  IN  NS  e.root-servers.net.
.   498600  IN  NS  f.root-servers.net.
.   498600  IN  NS  k.root-servers.net.
.   498600  IN  NS  l.root-servers.net.
.   498600  IN  NS  c.root-servers.net.
.   498600  IN  NS  d.root-servers.net.
.   498600  IN  NS  i.root-servers.net.
.   498600  IN  NS  g.root-servers.net.
.   498600  IN  NS  a.root-servers.net.
.   498600  IN  NS  h.root-servers.net.
.   498600  IN  NS  j.root-servers.net.

;; ADDITIONAL SECTION:
e.root-servers.net. 153695  IN  A   192.203.230.10
e.root-servers.net. 153695  IN  2001:500:a8::e
h.root-servers.net. 153695  IN  A   198.97.190.53
h.root-servers.net. 153695  IN  2001:500:1::53
l.root-servers.net. 585734  IN  A   199.7.83.42
l.root-servers.net. 153695  IN  2001:500:9f::42
i.root-servers.net. 585699  IN  A   192.36.148.17
i.root-servers.net. 153695  IN  2001:7fe::53
a.root-servers.net. 597264  IN  A   198.41.0.4
a.root-servers.net. 597264  IN  2001:503:ba3e::2:30
d.root-servers.net. 153695  IN  A   199.7.91.13
d.root-servers.net. 153695  IN  2001:500:2d::d
c.root-servers.net. 153695  IN  A   192.33.4.12
c.root-servers.net. 153695  IN  2001:500:2::c
b.root-servers.net. 585695  IN  A   199.9.14.201
b.root-servers.net. 153695  IN  2001:500:200::b
j.root-servers.net. 153695  IN  A   192.58.128.30
j.root-servers.net. 153695  IN  2001:503:c27::2:30
k.root-servers.net. 586670  IN  A   193.0.14.129
k.root-servers.net. 153695  IN  2001:7fd::1
g.root-servers.net. 153695  IN  A   192.112.36.4
g.root-servers.net. 153695  IN  2001:500:12::d0d
m.root-servers.net. 153695  IN  A   202.12.27.33
m.root-servers.net. 153695  IN  2001:dc3::35
f.root-servers.net. 153695  IN  A   192.5.5.241
f.root-servers.net. 153695  IN  2001:500:2f::f

# dig @127.0.0.1 +rec qeos-1
; <<>> DiG 9.11.5-P4-RedHat-9.11.5-13.P4.fc31 <<>> @127.0.0.1 +rec qeos-1
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50355
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;qeos-1.IN  A

;; ANSWER SECTION:
qeos-1. 0   IN  A   172.16.36.1

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Pá dub 12 05:23:57 EDT 2019
;; MSG SIZE  rcvd: 51

1. https://bugzilla.redhat.com/show_bug.cgi?id=1647464

-- 
Petr Menšík
Software Engineer
Red Hat, http://www.redhat.com/
email: pemen...@redhat.com  PGP: 65C6C973

___
Dnsmasq-discuss mailing list
Dnsmasq-discuss@lists.thekelleys.org.uk
http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss