gnu/packages/dns.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
   3 ;;; Copyright © 2016 Mark H Weaver <mhw@netris.org>
   4 ;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
   5 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2016 John Darrington <jmd@gnu.org>
   7 ;;; Copyright © 2016 Nikita <nikita@n0.is>
   8 ;;; Copyright © 2016, 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
   9 ;;; Copyright © 2016, 2020 Marius Bakke <mbakke@fastmail.com>
  10 ;;; Copyright © 2017 Vasile Dumitrascu <va511e@yahoo.com>
  11 ;;; Copyright © 2017 Gregor Giesen <giesen@zaehlwerk.net>
  12 ;;; Copyright © 2018 Oleg Pykhalov <go.wigust@gmail.com>
  13 ;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
  14 ;;; Copyright © 2019 Chris Marusich <cmmarusich@gmail.com>
  15 ;;; Copyright © 2019 Rutger Helling <rhelling@mykolab.com>
  16 ;;; Copyright © 2020 Pierre Langlois <pierre.langlois@gmx.com>
  17 ;;; Copyright © 2020 Arun Isaac <arunisaac@systemreboot.net>
  18 ;;; Copyright © 2020 Leo Famulari <leo@famulari.name>
  19 ;;;
  20 ;;; This file is part of GNU Guix.
  21 ;;;
  22 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  23 ;;; under the terms of the GNU General Public License as published by
  24 ;;; the Free Software Foundation; either version 3 of the License, or (at
  25 ;;; your option) any later version.
  26 ;;;
  27 ;;; GNU Guix is distributed in the hope that it will be useful, but
  28 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  29 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  30 ;;; GNU General Public License for more details.
  31 ;;;
  32 ;;; You should have received a copy of the GNU General Public License
  33 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  34
  35 (define-module (gnu packages dns)
  36   #:use-module (gnu packages admin)
  37   #:use-module (gnu packages autotools)
  38   #:use-module (gnu packages base)
  39   #:use-module (gnu packages bash)
  40   #:use-module (gnu packages check)
  41   #:use-module (gnu packages databases)
  42   #:use-module (gnu packages documentation)
  43   #:use-module (gnu packages compression)
  44   #:use-module (gnu packages crypto)
  45   #:use-module (gnu packages datastructures)
  46   #:use-module (gnu packages flex)
  47   #:use-module (gnu packages gcc)
  48   #:use-module (gnu packages glib)
  49   #:use-module (gnu packages groff)
  50   #:use-module (gnu packages groff)
  51   #:use-module (gnu packages libedit)
  52   #:use-module (gnu packages libevent)
  53   #:use-module (gnu packages libidn)
  54   #:use-module (gnu packages linux)
  55   #:use-module (gnu packages lua)
  56   #:use-module (gnu packages ncurses)
  57   #:use-module (gnu packages nettle)
  58   #:use-module (gnu packages networking)
  59   #:use-module (gnu packages perl)
  60   #:use-module (gnu packages pkg-config)
  61   #:use-module (gnu packages protobuf)
  62   #:use-module (gnu packages python)
  63   #:use-module (gnu packages python-xyz)
  64   #:use-module (gnu packages sphinx)
  65   #:use-module (gnu packages swig)
  66   #:use-module (gnu packages tls)
  67   #:use-module (gnu packages web)
  68   #:use-module (gnu packages xml)
  69   #:use-module (gnu packages)
  70   #:use-module ((guix licenses) #:prefix license:)
  71   #:use-module (guix packages)
  72   #:use-module (guix download)
  73   #:use-module (guix git-download)
  74   #:use-module (guix utils)
  75   #:use-module (guix build-system gnu)
  76   #:use-module (guix build-system meson)
  77   #:use-module (guix build-system trivial))
  78
  79 (define-public dnsmasq
  80   (package
  81     (name "dnsmasq")
  82     (version "2.81")
  83     (source (origin
  84               (method url-fetch)
  85               (uri (string-append
  86                     "http://www.thekelleys.org.uk/dnsmasq/dnsmasq-"
  87                     version ".tar.xz"))
  88               (sha256
  89                (base32
  90                 "1yzq6anwgr5rlnwydpszb51cyhp2vjq29b24ck19flbwac1sk73l"))))
  91     (build-system gnu-build-system)
  92     (native-inputs
  93      `(("pkg-config" ,pkg-config)))
  94     (inputs
  95      `(("dbus" ,dbus)))
  96     (arguments
  97      `(#:phases
  98        (modify-phases %standard-phases (delete 'configure))
  99        #:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 100                           "CC=gcc"
 101                           "COPTS=\"-DHAVE_DBUS\"")
 102        #:tests? #f))                    ; no ‘check’ target
 103     (home-page "http://www.thekelleys.org.uk/dnsmasq/doc.html")
 104     (synopsis "Small caching DNS proxy and DHCP/TFTP server")
 105     (description
 106      "Dnsmasq is a light-weight DNS forwarder and DHCP server.  It is designed
 107 to provide DNS and, optionally, DHCP to a small network.  It can serve the
 108 names of local machines which are not in the global DNS.  The DHCP server
 109 integrates with the DNS server and allows machines with DHCP-allocated
 110 addresses to appear in the DNS with names configured either on each host or in
 111 a central configuration file.  Dnsmasq supports static and dynamic DHCP leases
 112 and BOOTP/TFTP for network booting of diskless machines.")
 113     ;; Source files only say GPL2 and GPL3 are allowed.
 114     (license (list license:gpl2 license:gpl3))))
 115
 116 ;; 'bind' is the name of a built-in Guile procedure, which is why we choose a
 117 ;; different name here.
 118 (define-public isc-bind
 119   (package
 120     (name "bind")
 121     (version "9.16.2")
 122     (source (origin
 123               (method url-fetch)
 124               (uri (string-append
 125                     "https://ftp.isc.org/isc/bind9/" version
 126                     "/bind-" version ".tar.xz"))
 127               (sha256
 128                (base32
 129                 "0gwr4p14zy5jqq050n762rfc33km51qwipcwy6bsvk55ziybgrfr"))))
 130     (build-system gnu-build-system)
 131     (outputs `("out" "utils"))
 132     (inputs
 133      ;; It would be nice to add GeoIP and gssapi once there are packages.
 134      `(("libcap" ,libcap)
 135        ("libuv" ,libuv)
 136        ("libxml2" ,libxml2)
 137        ("openssl" ,openssl)
 138        ("p11-kit" ,p11-kit)
 139        ("python" ,python)
 140        ("python-ply" ,python-ply)))
 141     (native-inputs
 142      `(("perl" ,perl)
 143        ("pkg-config" ,pkg-config)))
 144     (arguments
 145      `(#:configure-flags
 146        (list (string-append "--with-pkcs11="
 147                             (assoc-ref %build-inputs "p11-kit")))
 148        #:phases
 149        (modify-phases %standard-phases
 150          (add-after 'strip 'move-to-utils
 151            (lambda _
 152              (for-each
 153               (lambda (file)
 154                 (let ((target  (string-append (assoc-ref %outputs "utils") file))
 155                       (src  (string-append (assoc-ref %outputs "out") file)))
 156                   (mkdir-p (dirname target))
 157                   (link src target)
 158                   (delete-file src)))
 159               '("/bin/dig" "/bin/delv" "/bin/nslookup" "/bin/host" "/bin/nsupdate"
 160                 "/share/man/man1/dig.1"
 161                 "/share/man/man1/host.1"
 162                 "/share/man/man1/nslookup.1"
 163                 "/share/man/man1/nsupdate.1"))
 164              #t))
 165          ;; When and if guix provides user namespaces for the build process,
 166          ;; then the following can be uncommented and the subsequent "force-test"
 167          ;; will not be necessary.
 168          ;;
 169          ;;   (add-before 'check 'set-up-loopback
 170          ;;     (lambda _
 171          ;;          (system "bin/tests/system/ifconfig.sh up")))
 172          (replace 'check
 173            (lambda _
 174              ;; XXX Even ‘make force-test’ tries to create network interfaces
 175              ;; and fails.  The only working target is the (trivial) fuzz test.
 176              (with-directory-excursion "fuzz"
 177                (invoke "make" "check"))
 178              #t)))))
 179     (synopsis "An implementation of the Domain Name System")
 180     (description "BIND is an implementation of the @dfn{Domain Name System}
 181 (DNS) protocols for the Internet.  It is a reference implementation of those
 182 protocols, but it is also production-grade software, suitable for use in
 183 high-volume and high-reliability applications. The name BIND stands for
 184 \"Berkeley Internet Name Domain\", because the software originated in the early
 185 1980s at the University of California at Berkeley.")
 186     (home-page "https://www.isc.org/downloads/bind")
 187     (license (list license:mpl2.0))))
 188
 189 (define-public dnscrypt-proxy
 190   (package
 191     (name "dnscrypt-proxy")
 192     (version "1.9.5")
 193     (source (origin
 194               (method url-fetch)
 195               (uri (string-append
 196                     "https://download.dnscrypt.org/dnscrypt-proxy/"
 197                     "dnscrypt-proxy-" version ".tar.bz2"))
 198               (sha256
 199                (base32
 200                 "1dhvklr4dg2vlw108n11xbamacaryyg3dbrg629b76lp7685p7z8"))
 201               (modules '((guix build utils)))
 202               (snippet
 203                ;; Delete bundled libltdl. XXX: This package also bundles
 204                ;; a modified libevent that cannot currently be removed.
 205                '(begin
 206                   (delete-file-recursively "libltdl")
 207                   #t))))
 208     (build-system gnu-build-system)
 209     (arguments
 210      `(#:phases
 211        (modify-phases %standard-phases
 212          (add-after 'unpack 'autoreconf
 213            (lambda _
 214              ;; Re-generate build files due to unbundling ltdl.
 215              ;; TODO: Prevent generating new libltdl and building it.
 216              ;; The system version is still favored and referenced.
 217              (invoke "autoreconf" "-vif"))))))
 218     (native-inputs
 219      `(("pkg-config" ,pkg-config)
 220        ("automake" ,automake)
 221        ("autoconf" ,autoconf)
 222        ("libtool" ,libtool)))
 223     (inputs
 224      `(("libltdl" ,libltdl)
 225        ("libsodium" ,libsodium)))
 226     (home-page "https://www.dnscrypt.org/")
 227     (synopsis "Securely send DNS requests to a remote server")
 228     (description
 229      "@command{dnscrypt-proxy} is a tool for securing communications
 230 between a client and a DNS resolver.  It verifies that responses you get
 231 from a DNS provider was actually sent by that provider, and haven't been
 232 tampered with.  For optimal performance it is recommended to use this as
 233 a forwarder for a caching DNS resolver such as @command{dnsmasq}, but it
 234 can also be used as a normal DNS \"server\".  A list of public dnscrypt
 235 servers is included, and an up-to-date version is available at
 236 @url{https://download.dnscrypt.org/dnscrypt-proxy/dnscrypt-resolvers.csv}.")
 237     (license (list license:isc
 238                    ;; Libevent and src/ext/queue.h is 3-clause BSD.
 239                    license:bsd-3))))
 240
 241 (define-public dnscrypt-wrapper
 242   (package
 243     (name "dnscrypt-wrapper")
 244     (version "0.2.2")
 245     (source (origin
 246               (method url-fetch)
 247               (uri (string-append
 248                     "https://github.com/cofyc/dnscrypt-wrapper/releases"
 249                     "/download/v" version "/" name "-v" version ".tar.bz2"))
 250               (sha256
 251                (base32
 252                 "1vhg4g0r687f51wcdn7z9w1hxapazx6vyh5rsr8wa48sljzd583g"))))
 253     (build-system gnu-build-system)
 254     (arguments
 255      `(#:make-flags '("CC=gcc")
 256        ;; TODO: Tests require ruby-cucumber and ruby-aruba.
 257        #:tests? #f
 258        #:phases
 259        (modify-phases %standard-phases
 260          (add-after 'unpack 'create-configure
 261            (lambda _
 262              (invoke "make" "configure"))))))
 263     (native-inputs
 264      `(("autoconf" ,autoconf)))
 265     (inputs
 266      `(("libevent" ,libevent)
 267        ("libsodium" ,libsodium)))
 268     (home-page "https://github.com/Cofyc/dnscrypt-wrapper")
 269     (synopsis "Server-side dnscrypt proxy")
 270     (description
 271      "@command{dnscrypt-wrapper} is a tool to expose a name server over
 272 the @code{dnscrypt} protocol.  It can be used as an endpoint for the
 273 @command{dnscrypt-proxy} client to securely tunnel DNS requests between
 274 the two.")
 275     (license (list license:isc
 276                    ;; Bundled argparse is MIT. TODO: package and unbundle.
 277                    license:expat
 278                    ;; dns-protocol.h and rfc1035.{c,h} is gpl2 or gpl3 (either).
 279                    license:gpl2
 280                    license:gpl3))))
 281
 282 (define-public libasr
 283   (package
 284     (name "libasr")
 285     (version "1.0.4")
 286     (source
 287      (origin
 288        (method url-fetch)
 289        (uri (string-append "https://www.opensmtpd.org/archives/"
 290                            "libasr-" version ".tar.gz"))
 291        (sha256
 292         (base32 "1d6s8njqhvayx2gp47409sp1fn8m608ws26hr1srfp6i23nnpyqr"))))
 293     (build-system gnu-build-system)
 294     (arguments
 295      `(#:phases
 296        (modify-phases %standard-phases
 297          (add-after 'install 'install-documentation
 298            (lambda* (#:key outputs #:allow-other-keys)
 299              (let ((out (assoc-ref outputs "out")))
 300                (install-file "src/asr_run.3"
 301                              (string-append out "/share/man/man3"))
 302                #t))))))
 303     (native-inputs
 304      `(("autoconf" ,autoconf)
 305        ("automake" ,automake)
 306        ("libtool" ,libtool)
 307        ("pkg-config" ,pkg-config)))
 308     (home-page "https://www.opensmtpd.org")
 309     (synopsis "Asynchronous resolver library by the OpenBSD project")
 310     (description
 311      "libasr is a free, simple and portable asynchronous resolver library.
 312 It runs DNS queries and performs hostname resolution in a fully
 313 asynchronous fashion.")
 314     (license (list license:isc
 315                    license:bsd-2 ; last part of getrrsetbyname_async.c
 316                    license:bsd-3
 317                    (license:non-copyleft "file://LICENSE") ; includes.h
 318                    license:openssl))))
 319
 320 (define-public nsd
 321   (package
 322     (name "nsd")
 323     (version "4.2.4")
 324     (source
 325      (origin
 326        (method url-fetch)
 327        (uri (string-append "https://www.nlnetlabs.nl/downloads/nsd/nsd-"
 328                            version ".tar.gz"))
 329        (sha256
 330         (base32 "0z7j3vwqqj0hh8n5irb2yqwzl45k4sn2wczbq1b1lqv5cxv6vgcy"))))
 331     (build-system gnu-build-system)
 332     (arguments
 333      `(#:configure-flags
 334        (list "--enable-pie"             ; fully benefit from ASLR
 335              "--enable-ratelimit"
 336              "--enable-recvmmsg"
 337              "--enable-relro-now"       ; protect GOT and .dtor areas
 338              "--disable-radix-tree"
 339              (string-append "--with-libevent="
 340                             (assoc-ref %build-inputs "libevent"))
 341              (string-append "--with-ssl="
 342                             (assoc-ref %build-inputs "openssl"))
 343              "--with-configdir=/etc"
 344              "--with-nsd_conf_file=/etc/nsd/nsd.conf"
 345              "--with-logfile=/var/log/nsd.log"
 346              "--with-pidfile=/var/db/nsd/nsd.pid"
 347              "--with-dbfile=/var/db/nsd/nsd.db"
 348              "--with-zonesdir=/etc/nsd"
 349              "--with-xfrdfile=/var/db/nsd/xfrd.state"
 350              "--with-zonelistfile=/var/db/nsd/zone.list")
 351        #:phases
 352        (modify-phases %standard-phases
 353          (add-before 'configure 'patch-installation-paths
 354            (lambda* (#:key outputs #:allow-other-keys)
 355              (let* ((out (assoc-ref outputs "out"))
 356                     (doc (string-append out "/share/doc/" ,name "-" ,version)))
 357                ;; The ‘make install’ target tries to create the parent
 358                ;; directories of run-time things like ‘pidfile’ above, and
 359                ;; useless empty directories like 'configdir'.  Remove such
 360                ;; '$(INSTALL)' lines and install the example configuration file
 361                ;; in an appropriate location.
 362                (substitute* "Makefile.in"
 363                  ((".*INSTALL.*\\$\\((config|pid|xfr|db)dir" command)
 364                   (string-append "#" command))
 365                  (("\\$\\(nsdconfigfile\\)\\.sample" file-name)
 366                   (string-append doc "/examples/" file-name)))
 367                #t))))
 368        #:tests? #f))                    ; no tests
 369     (inputs
 370      `(("libevent" ,libevent)
 371        ("openssl" ,openssl)))
 372     (home-page "https://www.nlnetlabs.nl/projects/nsd/about/")
 373     (synopsis "Authoritative DNS name server")
 374     (description "@dfn{NSD}, short for Name Server Daemon, is an authoritative
 375 name server for the Domain Name System (@dfn{DNS}).  It aims to be a fast and
 376 RFC-compliant nameserver.
 377
 378 NSD uses zone information compiled via @command{zonec} into a binary database
 379 file (@file{nsd.db}).  This allows fast startup of the name service daemon and
 380 allows syntax-structural errors in zone files to be flagged at compile time,
 381 before being made available to NSD service itself.  However, most traditional
 382 BIND-style zone files can be directly imported into NSD without modification.
 383
 384 The collection of programs and processes that make up NSD are designed so that
 385 the daemon itself runs as a non-privileged user and can be easily configured to
 386 run in a @code{chroot} jail, thus making any security flaws in NSD less likely
 387 to result in system-wide compromise.")
 388     (license (list license:bsd-3))))
 389
 390 (define-public unbound
 391   (package
 392     (name "unbound")
 393     (version "1.10.0")
 394     (source
 395      (origin
 396        (method url-fetch)
 397        (uri (string-append "https://www.unbound.net/downloads/unbound-"
 398                            version ".tar.gz"))
 399        (sha256
 400         (base32 "0mg9divpysr42sp0m693a70693dp8025v6c9dv1yabr4g1jlhbqm"))))
 401     (build-system gnu-build-system)
 402     (outputs '("out" "python"))
 403     (native-inputs
 404      `(("flex" ,flex)
 405        ("swig" ,swig)))
 406     (inputs
 407      `(("expat" ,expat)
 408        ("libevent" ,libevent)
 409        ("protobuf" ,protobuf)
 410        ("python-wrapper" ,python-wrapper)
 411        ("openssl" ,openssl)))
 412     (arguments
 413      `(#:configure-flags
 414        (list "--disable-static" ; save space and non-determinism in libunbound.a
 415              (string-append
 416               "--with-ssl=" (assoc-ref %build-inputs "openssl"))
 417              (string-append
 418               "--with-libevent=" (assoc-ref %build-inputs "libevent"))
 419              (string-append
 420               "--with-libexpat=" (assoc-ref %build-inputs "expat"))
 421              "--with-pythonmodule" "--with-pyunbound")
 422        #:phases
 423        (modify-phases %standard-phases
 424          (add-after 'configure 'fix-python-site-package-path
 425            ;; Move python modules into their own output.
 426            (lambda* (#:key outputs #:allow-other-keys)
 427              (let ((pyout (assoc-ref outputs "python"))
 428                    (ver ,(version-major+minor (package-version python))))
 429                (substitute* "Makefile"
 430                  (("^PYTHON_SITE_PKG=.*$")
 431                   (string-append
 432                    "PYTHON_SITE_PKG="
 433                    pyout "/lib/python-" ver "/site-packages\n"))))
 434              #t))
 435          (add-before 'check 'fix-missing-nss-for-tests
 436            ;; Unfortunately, the package's unittests involve some checks
 437            ;; looking up protocols and services which are not provided
 438            ;; by the minimalistic build environment, in particular,
 439            ;; /etc/protocols and /etc/services are missing.
 440            ;; Also, after plain substitution of protocol and service names
 441            ;; in the test data, the tests still fail because the
 442            ;; corresponding Resource Records have been signed by
 443            ;; RRSIG records.
 444            ;; The following LD_PRELOAD library overwrites the glibc
 445            ;; functions ‘get{proto,serv}byname’, ‘getprotobynumber’ and
 446            ;; ‘getservbyport’ providing the few records required for the
 447            ;; unit tests to pass.
 448            (lambda* (#:key inputs outputs #:allow-other-keys)
 449              (let* ((source (assoc-ref %build-inputs "source"))
 450                     (gcc (assoc-ref %build-inputs "gcc")))
 451                (call-with-output-file "/tmp/nss_preload.c"
 452                  (lambda (port)
 453                    (display "#include <stdlib.h>
 454 #include <string.h>
 455 #include <strings.h>
 456
 457 #include <netdb.h>
 458
 459 struct protoent *getprotobyname(const char *name) {
 460   struct protoent *p = malloc(sizeof(struct protoent));
 461   p->p_aliases = malloc(sizeof(char*));
 462   if (strcasecmp(name, \"tcp\") == 0) {
 463     p->p_name = \"tcp\";
 464     p->p_proto = 6;
 465     p->p_aliases[0] = \"TCP\";
 466   } else if (strcasecmp(name, \"udp\") == 0) {
 467     p->p_name = \"udp\";
 468     p->p_proto = 17;
 469     p->p_aliases[0] = \"UDP\";
 470   } else
 471     p = NULL;
 472   return p;
 473 }
 474
 475 struct protoent *getprotobynumber(int proto) {
 476   struct protoent *p = malloc(sizeof(struct protoent));
 477   p->p_aliases = malloc(sizeof(char*));
 478   switch(proto) {
 479   case 6:
 480     p->p_name = \"tcp\";
 481     p->p_proto = 6;
 482     p->p_aliases[0] = \"TCP\";
 483     break;
 484   case 17:
 485     p->p_name = \"udp\";
 486     p->p_proto = 17;
 487     p->p_aliases[0] = \"UDP\";
 488     break;
 489   default:
 490     p = NULL;
 491     break;
 492   }
 493   return p;
 494 }
 495
 496 struct servent *getservbyname(const char *name, const char *proto) {
 497   struct servent *s = malloc(sizeof(struct servent));
 498   char* buf = malloc((strlen(proto)+1)*sizeof(char));
 499   strcpy(buf, proto);
 500   s->s_aliases = malloc(sizeof(char*));
 501   s->s_aliases[0] = NULL;
 502   if (strcasecmp(name, \"domain\") == 0) {
 503     s->s_name = \"domain\";
 504     s->s_port = htons(53);
 505     s->s_proto = buf;
 506   } else
 507     s = NULL;
 508   return s;
 509 }
 510
 511 struct servent *getservbyport(int port, const char *proto) {
 512   char buf[32];
 513   struct servent *s = malloc(sizeof(struct servent));
 514   strcpy(buf, proto);
 515   s->s_aliases = malloc(sizeof(char*));
 516   s->s_aliases[0] = NULL;
 517   switch(port) {
 518   case 53:
 519     s->s_name = \"domain\";
 520     s->s_port = 53;
 521     s->s_proto = \"udp\";
 522     break;
 523   default:
 524     s = NULL;
 525     break;
 526   }
 527   return s;
 528 }" port)))
 529                (invoke (string-append gcc "/bin/gcc")
 530                        "-shared" "-fPIC" "-o" "/tmp/nss_preload.so"
 531                        "/tmp/nss_preload.c")
 532                ;; The preload library only affects the unittests.
 533                (substitute* "Makefile"
 534                  (("./unittest")
 535                   "LD_PRELOAD=/tmp/nss_preload.so ./unittest")))
 536              #t)))))
 537     (home-page "https://www.unbound.net")
 538     (synopsis "Validating, recursive, and caching DNS resolver")
 539     (description
 540      "Unbound is a recursive-only caching DNS server which can perform DNSSEC
 541 validation of results.  It implements only a minimal amount of authoritative
 542 service to prevent leakage to the root nameservers: forward lookups for
 543 localhost, reverse for @code{127.0.0.1} and @code{::1}, and NXDOMAIN for zones
 544 served by AS112.  Stub and forward zones are supported.")
 545     (license license:bsd-4)))
 546
 547 (define-public yadifa
 548   (package
 549     (name "yadifa")
 550     (version "2.3.9")
 551     (source
 552      (let ((build "8497"))
 553        (origin
 554          (method url-fetch)
 555          (uri
 556           (string-append "http://cdn.yadifa.eu/sites/default/files/releases/"
 557                          "yadifa-" version "-" build ".tar.gz"))
 558          (sha256
 559           (base32 "0xvyr91sfgzkpw6g3h893ldbwnki3w2472n56rr18w67qghs1sa5")))))
 560     (build-system gnu-build-system)
 561     (native-inputs
 562      `(("which" ,which)))
 563     (inputs
 564      `(("openssl" ,openssl)))
 565     (arguments
 566      `(#:phases
 567        (modify-phases %standard-phases
 568          (add-before 'configure 'omit-example-configurations
 569            (lambda _
 570              (substitute* "Makefile.in"
 571                ((" (etc|var)") ""))
 572              #t)))
 573        #:configure-flags
 574        (list "--sysconfdir=/etc"
 575              "--localstatedir=/var"
 576              "--disable-build-timestamp" ; build reproducibly
 577              "--enable-shared"
 578              "--disable-static"
 579              "--enable-acl"
 580              "--enable-caching"
 581              "--enable-ctrl"            ; enable remote control
 582              "--enable-nsec"
 583              "--enable-nsec3"
 584              "--enable-tsig")))
 585     (home-page "https://www.yadifa.eu/")
 586     (synopsis "Authoritative DNS name server")
 587     (description "YADIFA is an authoritative name server for the @dfn{Domain
 588 Name System} (DNS).  It aims for both higher performance and a smaller memory
 589 footprint than other implementations, while remaining fully RFC-compliant.
 590 YADIFA supports dynamic record updates and the @dfn{Domain Name System Security
 591 Extensions} (DNSSEC).")
 592     (license license:bsd-3)))
 593
 594 (define-public knot
 595   (package
 596     (name "knot")
 597     (version "2.9.3")
 598     (source
 599      (origin
 600        (method url-fetch)
 601        (uri (string-append "https://secure.nic.cz/files/knot-dns/"
 602                            "knot-" version ".tar.xz"))
 603        (sha256
 604         (base32 "0zm0642hkb16sqkqpa84f89f3s0bw44m837r1nia8m89swvz3bgj"))
 605        (modules '((guix build utils)))
 606        (snippet
 607         '(begin
 608            ;; Delete bundled libraries.
 609            (with-directory-excursion "src/contrib"
 610              (delete-file-recursively "lmdb"))
 611            #t))))
 612     (build-system gnu-build-system)
 613     (native-inputs
 614      `(("pkg-config" ,pkg-config)))
 615     (inputs
 616      `(("fstrm" ,fstrm)
 617        ("gnutls" ,gnutls)
 618        ("jansson" ,jansson)
 619        ("libcap-ng" ,libcap-ng)
 620        ("libedit" ,libedit)
 621        ("libidn" ,libidn)
 622        ("liburcu" ,liburcu)
 623        ("lmdb" ,lmdb)
 624        ("ncurses" ,ncurses)
 625        ("protobuf-c" ,protobuf-c)))
 626     (arguments
 627      `(#:phases
 628        (modify-phases %standard-phases
 629          (add-before 'configure 'disable-directory-pre-creation
 630            (lambda _
 631              ;; Don't install empty directories like ‘/etc’ outside the store.
 632              ;; This is needed even when using ‘make config_dir=... install’.
 633              (substitute* "src/Makefile.in" (("\\$\\(INSTALL\\) -d") "true"))
 634              #t))
 635          (replace 'install
 636            (lambda* (#:key outputs #:allow-other-keys)
 637              (let* ((out (assoc-ref outputs "out"))
 638                     (doc (string-append out "/share/doc/" ,name "-" ,version))
 639                     (etc (string-append doc "/examples/etc")))
 640                (invoke "make"
 641                        (string-append "config_dir=" etc)
 642                        "install")))))
 643        #:configure-flags
 644        (list "--sysconfdir=/etc"
 645              "--localstatedir=/var"
 646              "--enable-dnstap"          ; let tools read/write capture files
 647              "--with-module-dnstap=yes" ; detailed query capturing & logging
 648              (string-append "--with-bash-completions="
 649                             (assoc-ref %outputs "out")
 650                             "/etc/bash_completion.d"))))
 651     (home-page "https://www.knot-dns.cz/")
 652     (synopsis "Authoritative DNS name server")
 653     (description "Knot DNS is an authoritative name server for the @dfn{Domain
 654 Name System} (DNS), designed to meet the needs of root and @dfn{top-level
 655 domain} (TLD) name servers.  It is implemented as a threaded daemon and uses a
 656 number of programming techniques to improve speed.  For example, the responder
 657 is completely lock-free, resulting in a very high response rate.  Other features
 658 include automatic @dfn{DNS Security Extensions} (DNSSEC) signing, dynamic record
 659 synthesis, and on-the-fly re-configuration.")
 660     (license
 661      (list
 662       ;; src/contrib/{hat-trie,murmurhash3,openbsd},
 663       ;; src/dnssec/contrib/vpool.[ch], and parts of libtap/ are ‘MIT’ (expat).
 664       license:expat
 665       license:lgpl2.0+              ; parts of scr/contrib/ucw
 666       license:public-domain         ; src/contrib/fnv and possibly murmurhash3
 667       license:gpl3+))))             ; everything else
 668
 669 (define-public knot-resolver
 670   (package
 671     (name "knot-resolver")
 672     (version "4.3.0")
 673     (source (origin
 674               (method url-fetch)
 675               (uri (string-append "https://secure.nic.cz/files/knot-resolver/"
 676                                   "knot-resolver-" version ".tar.xz"))
 677               (sha256
 678                (base32
 679                 "09ffmqx79lv5psr433x4n946njgsn071b9b7161pcb9bmrqz380c"))))
 680     (build-system meson-build-system)
 681     (arguments
 682      '(#:configure-flags '("-Ddoc=enabled")
 683        #:phases
 684        (modify-phases %standard-phases
 685          (add-before 'configure 'disable-default-ta
 686            (lambda _
 687              ;;  Disable the default managed root TA, since we don't have
 688              ;;  write access to the keyfile and its directory in store.
 689              (substitute* "daemon/lua/sandbox.lua.in"
 690                (("^trust_anchors\\.add_file.*") ""))
 691              #t))
 692          (add-after 'build 'build-doc
 693            (lambda _
 694              (invoke "ninja" "doc")))
 695          (add-after 'install 'wrap-binary
 696            (lambda* (#:key inputs outputs #:allow-other-keys)
 697              (let* ((out (assoc-ref outputs "out"))
 698                     (lua-* (map cdr (filter
 699                                      (lambda (input)
 700                                        (string-prefix? "lua-" (car input)))
 701                                      inputs)))
 702                     (lua-path (lambda (p)
 703                                 (string-append p "/share/lua/5.1/?.lua")))
 704                     (lua-cpath (lambda (p)
 705                                  (string-append p "/lib/lua/5.1/?.so"))))
 706                (wrap-program (string-append out "/sbin/kresd")
 707                  `("LUA_PATH" ";" prefix ,(map lua-path lua-*))
 708                  `("LUA_CPATH" ";" prefix ,(map lua-cpath lua-*)))
 709                #t))))))
 710     (native-inputs
 711      `(("cmocka" ,cmocka)               ; for unit tests
 712        ("doxygen" ,doxygen)
 713        ("protobuf-c" ,protobuf-c)
 714        ("pkg-config" ,pkg-config)
 715        ("python-breathe" ,python-breathe)
 716        ("python-sphinx" ,python-sphinx)
 717        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)))
 718     (inputs
 719      `(("fstrm" ,fstrm)
 720        ("gnutls" ,gnutls)
 721        ("knot" ,knot)
 722        ("libuv" ,libuv)
 723        ("lmdb" ,lmdb)
 724        ("luajit" ,luajit)
 725        ;; TODO: Add optional lua modules: basexx, cqueues and psl.
 726        ("lua-bitop" ,lua5.1-bitop)
 727        ("lua-filesystem" ,lua5.1-filesystem)
 728        ("lua-sec" ,lua5.1-sec)
 729        ("lua-socket" ,lua5.1-socket)))
 730     (home-page "https://www.knot-resolver.cz/")
 731     (synopsis "Caching validating DNS resolver")
 732     (description
 733      "Knot Resolver is a caching full resolver implementation written in C and
 734 LuaJIT, both a resolver library and a daemon.")
 735     (license (list license:gpl3+
 736                    ;; Some 'contrib' files are under MIT, CC0 and LGPL2.
 737                    license:expat
 738                    license:cc0
 739                    license:lgpl2.0))))
 740
 741 (define-public ddclient
 742   (package
 743     (name "ddclient")
 744     (version "3.9.1")
 745     (source
 746      (origin
 747        (method git-fetch)
 748        (uri (git-reference
 749              (url "https://github.com/ddclient/ddclient.git")
 750              (commit (string-append "v" version))))
 751        (file-name (git-file-name name version))
 752        (sha256
 753         (base32 "0hf377g4j9r9sac75xp17nk2h58mazswz4vkg4g2gl2yyhvzq91w"))))
 754     (build-system trivial-build-system) ; no Makefile.PL
 755     (native-inputs
 756      `(("bash" ,bash)
 757        ("perl" ,perl)))
 758     (inputs
 759      `(("inetutils" ,inetutils)         ; logger
 760        ("net-tools" ,net-tools)
 761        ("perl-data-validate-ip" ,perl-data-validate-ip)
 762        ("perl-digest-sha1" ,perl-digest-sha1)
 763        ("perl-io-socket-ssl" ,perl-io-socket-ssl)))
 764     (arguments
 765      `(#:modules ((guix build utils)
 766                   (ice-9 match)
 767                   (srfi srfi-26))
 768        #:builder
 769        (begin
 770          (use-modules (guix build utils)
 771                       (ice-9 match)
 772                       (srfi srfi-26))
 773          (setenv "PATH" (string-append
 774                          (assoc-ref %build-inputs "bash") "/bin" ":"
 775                          (assoc-ref %build-inputs "perl") "/bin"))
 776
 777          ;; Copy the (read-only) source into the (writable) build directory.
 778          (copy-recursively (assoc-ref %build-inputs "source") ".")
 779
 780          ;; Install.
 781          (let* ((out (assoc-ref %outputs "out"))
 782                 (bin (string-append out "/bin")))
 783            (let ((file "ddclient"))
 784              (substitute* file
 785                (("/usr/bin/perl") (which "perl"))
 786                ;; Strictly use ‘/etc/ddclient/ddclient.conf’.
 787                (("\\$\\{program\\}\\.conf") "/etc/ddclient/ddclient.conf")
 788                (("\\$etc\\$program.conf") "/etc/ddclient/ddclient.conf")
 789                ;; Strictly use ‘/var/cache/ddclient/ddclient.cache’
 790                (("\\$cachedir\\$program\\.cache")
 791                 "/var/cache/ddclient/ddclient.cache"))
 792              (install-file file bin)
 793              (wrap-program (string-append bin "/" file)
 794                `("PATH" ":" =
 795                  ("$PATH"
 796                   ,@(map (lambda (input)
 797                            (match input
 798                                   ((name . store)
 799                                    (string-append store "/bin"))))
 800                          %build-inputs)))
 801                `("PERL5LIB" ":" =
 802                  ,(delete
 803                    ""
 804                    (map (match-lambda
 805                          (((? (cut string-prefix? "perl-" <>) name) . dir)
 806                           (string-append dir "/lib/perl5/site_perl"))
 807                          (_ ""))
 808                         %build-inputs)))))
 809            (for-each (cut install-file <> (string-append out
 810                                                          "/share/ddclient"))
 811                      (find-files "." "sample.*$"))))))
 812     (home-page "https://ddclient.net/")
 813     (synopsis "Address updating utility for dynamic DNS services")
 814     (description "This package provides a client to update dynamic IP
 815 addresses with several dynamic DNS service providers, such as
 816 @uref{https://www.dyndns.com/account/login.html,DynDNS.com}.
 817
 818 This makes it possible to use a fixed hostname (such as myhost.dyndns.org) to
 819 access a machine with a dynamic IP address.
 820
 821 The client supports both dynamic and (near) static services, as well as MX
 822 record and alternative name management.  It caches the address, and only
 823 attempts the update when it has changed.")
 824     (license license:gpl2+)))
 825
 826 (define-public hnsd
 827   ;; There have been no releases yet, hence this commit.
 828   (let ((revision "0")
 829         (commit "895d89c25d316d18df9d374fe78aae3902bc89fb"))
 830    (package
 831      (name "hnsd")
 832      (version (git-version "0.0" revision commit))
 833      (source (origin
 834                (method git-fetch)
 835                (uri (git-reference
 836                      (url "https://github.com/handshake-org/hnsd")
 837                      (commit commit)))
 838                (sha256
 839                 (base32
 840                  "0704y73sddn24jga9csw4gxyfb3pnrfnk0vdcph84n1h38490l16"))
 841                (file-name (git-file-name name version))
 842                (modules '((guix build utils)))
 843                (snippet
 844                 '(begin
 845                    ;; Delete the bundled copy of libuv.
 846                    (delete-file-recursively "uv")
 847                    (substitute* "configure.ac"
 848                      (("AC_CONFIG_SUBDIRS\\(\\[uv\\]\\)") ""))
 849                    (substitute* "Makefile.am"
 850                      (("SUBDIRS = uv") "\n")
 851                      (("\\$\\(top_builddir\\)/uv/libuv.la") "-luv")
 852
 853                      ;; Make sure the 'hnsd' binary is installed and
 854                      ;; dynamically-linked.
 855                      (("noinst_PROGRAMS") "bin_PROGRAMS")
 856                      (("hnsd_LDFLAGS = -static") ""))
 857
 858                    ;; This script tries to chdir to "uv" and doesn't do more
 859                    ;; than "autoreconf" so remove it.
 860                    (delete-file "autogen.sh")
 861                    #t))))
 862      (build-system gnu-build-system)
 863      (arguments
 864       '(#:configure-flags '("--disable-static"))) ;no need for libhsk.a
 865      (native-inputs
 866       `(("autoconf" ,autoconf)
 867         ("automake" ,automake)
 868         ("libtool" ,libtool)))
 869      (inputs
 870       `(("unbound" ,unbound)
 871         ("libuv" ,libuv)))
 872      (home-page "https://www.handshake.org/")
 873      (synopsis "Resolver daemon for the Handshake naming protocol")
 874      (description
 875       "@command{hnsd} is a @dfn{host name resolver} for the Handshake Naming
 876 System (HNS) peer-to-peer network.")
 877      (license license:expat))))
 878
 879 (define-public libmicrodns
 880   (package
 881     (name "libmicrodns")
 882     (version "0.1.2")
 883     (source (origin
 884               (method url-fetch)
 885               (uri (string-append "https://github.com/videolabs/libmicrodns/"
 886                                   "releases/download/" version "/microdns-"
 887                                   version ".tar.xz"))
 888               (sha256
 889                (base32
 890                 "0p4va18zxgmzcdwhlbg2mmjwswlbgqy4ay5vaxrw7cxmhsflnv36"))))
 891     (build-system meson-build-system)
 892     (home-page "https://github.com/videolabs/libmicrodns")
 893     (synopsis "Minimal mDNS resolver library")
 894     (description "@code{libmicrodns} provides a minimal implementation of a
 895 mDNS resolver as well as an announcer.  mDNS (Multicast Domain Name System) is
 896 a zero-config service that allows one to resolve host names to IP addresses in
 897 local networks.")
 898     (license license:lgpl2.1)))
 899
 900 (define-public public-suffix-list
 901   ;; Mozilla releases the official list here:
 902   ;;
 903   ;;   https://publicsuffix.org/list/public_suffix_list.dat
 904   ;;
 905   ;; However, Mozilla syncs that file from the GitHub repository periodically,
 906   ;; so its contents will change over time.  If you update this commit, please
 907   ;; make sure that the new commit refers to a list which is identical to the
 908   ;; officially published list available from the URL above.
 909   (let ((commit "9375b697baddb0827a5995c81bd3c75877a0b35d"))
 910     (package
 911       (name "public-suffix-list")
 912       (version (git-version "0" "1" commit))
 913       (source (origin
 914                 (method git-fetch)
 915                 (uri (git-reference
 916                       (url "https://github.com/publicsuffix/list.git")
 917                       (commit commit)))
 918                 (file-name (git-file-name name version))
 919                 (sha256
 920                  (base32
 921                   "1sm7pni01rnl4ldzi8z8nc4cbgq8nxda9gwc68v0s3ij7jd1jmik"))))
 922       (build-system trivial-build-system)
 923       (arguments
 924        `(#:modules ((guix build utils))
 925          #:builder
 926          (begin
 927            (use-modules (guix build utils))
 928            (let* ((out (assoc-ref %outputs "out"))
 929                   ;; Install to /share because that is where "read-only
 930                   ;; architecture-independent data files" should go (see:
 931                   ;; (standards) Directory Variables).  Include the version in
 932                   ;; the directory name so that if multiple versions are ever
 933                   ;; installed in the same profile, they will not conflict.
 934                   (destination (string-append
 935                                 out "/share/public-suffix-list-" ,version))
 936                   (source (assoc-ref %build-inputs "source")))
 937              (with-directory-excursion source
 938              (install-file "public_suffix_list.dat" destination)
 939              (install-file "LICENSE" destination))
 940              #t))))
 941       (home-page "https://publicsuffix.org/")
 942       (synopsis "Database of current and historical DNS suffixes")
 943       (description "This is the Public Suffix List maintained by Mozilla.  A
 944 \"public suffix\" is one under which Internet users can (or historically
 945 could) directly register names in the Domain Name System (DNS).  Some examples
 946 of public suffixes are .com, .co.uk and pvt.k12.ma.us.  This is a list of all
 947 known public suffixes.")
 948       (license license:mpl2.0))))
 949
 950 (define-public maradns
 951   (package
 952     (name "maradns")
 953     (version "3.5.0004")
 954     (source
 955      (origin
 956        (method url-fetch)
 957        (uri (string-append "https://maradns.samiam.org/download/"
 958                            (version-major+minor version) "/"
 959                            version "/maradns-" version ".tar.xz"))
 960        (sha256
 961         (base32
 962          "1zv0i6m4m05ay5zlhwq1h88hgjq2d81cjanpnb3gyhr0xhmjwk6a"))))
 963     (build-system gnu-build-system)
 964     (arguments
 965      `(#:tests? #f ; need to be root to run tests
 966        #:make-flags
 967        (list
 968         (string-append "CC="
 969                        (if ,(%current-target-system)
 970                            (string-append (assoc-ref %build-inputs "cross-gcc")
 971                                           "/bin/" ,(%current-target-system) "-gcc")
 972                            "gcc"))
 973         (string-append "PREFIX=" %output)
 974         (string-append "RPM_BUILD_ROOT=" %output))
 975        #:phases
 976        (modify-phases %standard-phases
 977          (replace 'configure
 978            (lambda* (#:key native-inputs target #:allow-other-keys)
 979              ;; make_32bit_tables generates a header file that is used during
 980              ;; compilation. Hence, during cross compilation, it should be
 981              ;; built for the host system.
 982              (when target
 983                (substitute* "rng/Makefile"
 984                  (("\\$\\(CC\\) -o make_32bit_tables")
 985                   (string-append (assoc-ref native-inputs "gcc")
 986                                  "/bin/gcc -o make_32bit_tables"))))
 987              (invoke "./configure")))
 988          (add-before 'install 'create-install-directories
 989            (lambda* (#:key outputs #:allow-other-keys)
 990              (let ((out (assoc-ref outputs "out")))
 991                (for-each (lambda (dir)
 992                            (mkdir-p (string-append out dir)))
 993                          (list "/bin" "/sbin" "/etc"
 994                                "/share/man/man1"
 995                                "/share/man/man5"
 996                                "/share/man/man8"))
 997                #t))))))
 998     (home-page "https://maradns.samiam.org")
 999     (synopsis "Small lightweight DNS server")
1000     (description "MaraDNS is a small and lightweight DNS server.  MaraDNS
1001 consists of a UDP-only authoritative DNS server for hosting domains, and a UDP
1002 and TCP-capable recursive DNS server for finding domains on the internet.")
1003     (license license:bsd-2)))