gnu/packages/dns.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
   3 ;;; Copyright © 2016 Mark H Weaver <mhw@netris.org>
   4 ;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
   5 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2016 John Darrington <jmd@gnu.org>
   7 ;;; Copyright © 2016 ng0 <ng0@n0.is>
   8 ;;; Copyright © 2016, 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
   9 ;;; Copyright © 2016, 2020 Marius Bakke <mbakke@fastmail.com>
  10 ;;; Copyright © 2017 Vasile Dumitrascu <va511e@yahoo.com>
  11 ;;; Copyright © 2017 Gregor Giesen <giesen@zaehlwerk.net>
  12 ;;; Copyright © 2018 Oleg Pykhalov <go.wigust@gmail.com>
  13 ;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
  14 ;;; Copyright © 2019 Chris Marusich <cmmarusich@gmail.com>
  15 ;;; Copyright © 2019 Rutger Helling <rhelling@mykolab.com>
  16 ;;;
  17 ;;; This file is part of GNU Guix.
  18 ;;;
  19 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  20 ;;; under the terms of the GNU General Public License as published by
  21 ;;; the Free Software Foundation; either version 3 of the License, or (at
  22 ;;; your option) any later version.
  23 ;;;
  24 ;;; GNU Guix is distributed in the hope that it will be useful, but
  25 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  26 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27 ;;; GNU General Public License for more details.
  28 ;;;
  29 ;;; You should have received a copy of the GNU General Public License
  30 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  31
  32 (define-module (gnu packages dns)
  33   #:use-module (gnu packages admin)
  34   #:use-module (gnu packages autotools)
  35   #:use-module (gnu packages base)
  36   #:use-module (gnu packages bash)
  37   #:use-module (gnu packages check)
  38   #:use-module (gnu packages databases)
  39   #:use-module (gnu packages documentation)
  40   #:use-module (gnu packages compression)
  41   #:use-module (gnu packages crypto)
  42   #:use-module (gnu packages datastructures)
  43   #:use-module (gnu packages flex)
  44   #:use-module (gnu packages glib)
  45   #:use-module (gnu packages groff)
  46   #:use-module (gnu packages groff)
  47   #:use-module (gnu packages libedit)
  48   #:use-module (gnu packages libevent)
  49   #:use-module (gnu packages libidn)
  50   #:use-module (gnu packages linux)
  51   #:use-module (gnu packages lua)
  52   #:use-module (gnu packages ncurses)
  53   #:use-module (gnu packages nettle)
  54   #:use-module (gnu packages networking)
  55   #:use-module (gnu packages perl)
  56   #:use-module (gnu packages pkg-config)
  57   #:use-module (gnu packages protobuf)
  58   #:use-module (gnu packages python)
  59   #:use-module (gnu packages python-xyz)
  60   #:use-module (gnu packages sphinx)
  61   #:use-module (gnu packages swig)
  62   #:use-module (gnu packages tls)
  63   #:use-module (gnu packages web)
  64   #:use-module (gnu packages xml)
  65   #:use-module (gnu packages)
  66   #:use-module ((guix licenses) #:prefix license:)
  67   #:use-module (guix packages)
  68   #:use-module (guix download)
  69   #:use-module (guix git-download)
  70   #:use-module (guix utils)
  71   #:use-module (guix build-system gnu)
  72   #:use-module (guix build-system meson)
  73   #:use-module (guix build-system trivial))
  74
  75 (define-public dnsmasq
  76   (package
  77     (name "dnsmasq")
  78     (version "2.80")
  79     (source (origin
  80               (method url-fetch)
  81               (uri (string-append
  82                     "http://www.thekelleys.org.uk/dnsmasq/dnsmasq-"
  83                     version ".tar.xz"))
  84               (sha256
  85                (base32
  86                 "1fv3g8vikj3sn37x1j6qsywn09w1jipvlv34j3q5qrljbrwa5ayd"))
  87               (modules '((guix build utils)))
  88               (snippet
  89                '(begin
  90                   ;; The SIOCGSTAMP ioctl is defined in <linux/sockios.h> instead
  91                   ;; of <asm/sockios.h> starting with linux-libre-headers 5.2.
  92                   ;; Remove this for dnsmasq versions > 2.80.
  93                   (substitute* "src/dnsmasq.h"
  94                     (("#if defined\\(HAVE_LINUX_NETWORK\\)" all)
  95                      (string-append all "\n#include <linux/sockios.h>")))
  96                   #t))))
  97     (build-system gnu-build-system)
  98     (native-inputs
  99      `(("pkg-config" ,pkg-config)))
 100     (inputs
 101      `(("dbus" ,dbus)))
 102     (arguments
 103      `(#:phases
 104        (modify-phases %standard-phases (delete 'configure))
 105        #:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 106                           "CC=gcc"
 107                           "COPTS=\"-DHAVE_DBUS\"")
 108        #:tests? #f))                    ; no ‘check’ target
 109     (home-page "http://www.thekelleys.org.uk/dnsmasq/doc.html")
 110     (synopsis "Small caching DNS proxy and DHCP/TFTP server")
 111     (description
 112      "Dnsmasq is a light-weight DNS forwarder and DHCP server.  It is designed
 113 to provide DNS and, optionally, DHCP to a small network.  It can serve the
 114 names of local machines which are not in the global DNS.  The DHCP server
 115 integrates with the DNS server and allows machines with DHCP-allocated
 116 addresses to appear in the DNS with names configured either on each host or in
 117 a central configuration file.  Dnsmasq supports static and dynamic DHCP leases
 118 and BOOTP/TFTP for network booting of diskless machines.")
 119     ;; Source files only say GPL2 and GPL3 are allowed.
 120     (license (list license:gpl2 license:gpl3))))
 121
 122 ;; 'bind' is the name of a built-in Guile procedure, which is why we choose a
 123 ;; different name here.
 124 (define-public isc-bind
 125   (package
 126     (name "bind")
 127     (version "9.16.0")
 128     (source (origin
 129               (method url-fetch)
 130               (uri (string-append
 131                     "https://ftp.isc.org/isc/bind9/" version
 132                     "/bind-" version ".tar.xz"))
 133               (sha256
 134                (base32
 135                 "0a1f1wrlbnmq79q6s15fny36ip81malg6wlr8acp7amimsyxjjxg"))))
 136     (build-system gnu-build-system)
 137     (outputs `("out" "utils"))
 138     (inputs
 139      ;; It would be nice to add GeoIP and gssapi once there are packages.
 140      `(("libcap" ,libcap)
 141        ("libuv" ,libuv)
 142        ("libxml2" ,libxml2)
 143        ("openssl" ,openssl)
 144        ("p11-kit" ,p11-kit)
 145        ("python" ,python)
 146        ("python-ply" ,python-ply)))
 147     (native-inputs
 148      `(("perl" ,perl)
 149        ("pkg-config" ,pkg-config)))
 150     (arguments
 151      `(#:configure-flags
 152        (list (string-append "--with-pkcs11="
 153                             (assoc-ref %build-inputs "p11-kit")))
 154        #:phases
 155        (modify-phases %standard-phases
 156          (add-after 'strip 'move-to-utils
 157            (lambda _
 158              (for-each
 159               (lambda (file)
 160                 (let ((target  (string-append (assoc-ref %outputs "utils") file))
 161                       (src  (string-append (assoc-ref %outputs "out") file)))
 162                   (mkdir-p (dirname target))
 163                   (link src target)
 164                   (delete-file src)))
 165               '("/bin/dig" "/bin/delv" "/bin/nslookup" "/bin/host" "/bin/nsupdate"
 166                 "/share/man/man1/dig.1"
 167                 "/share/man/man1/host.1"
 168                 "/share/man/man1/nslookup.1"
 169                 "/share/man/man1/nsupdate.1"))
 170              #t))
 171          ;; When and if guix provides user namespaces for the build process,
 172          ;; then the following can be uncommented and the subsequent "force-test"
 173          ;; will not be necessary.
 174          ;;
 175          ;;   (add-before 'check 'set-up-loopback
 176          ;;     (lambda _
 177          ;;          (system "bin/tests/system/ifconfig.sh up")))
 178          (replace 'check
 179            (lambda _
 180              ;; XXX Even ‘make force-test’ tries to create network interfaces
 181              ;; and fails.  The only working target is the (trivial) fuzz test.
 182              (with-directory-excursion "fuzz"
 183                (invoke "make" "check"))
 184              #t)))))
 185     (synopsis "An implementation of the Domain Name System")
 186     (description "BIND is an implementation of the @dfn{Domain Name System}
 187 (DNS) protocols for the Internet.  It is a reference implementation of those
 188 protocols, but it is also production-grade software, suitable for use in
 189 high-volume and high-reliability applications. The name BIND stands for
 190 \"Berkeley Internet Name Domain\", because the software originated in the early
 191 1980s at the University of California at Berkeley.")
 192     (home-page "https://www.isc.org/downloads/bind")
 193     (license (list license:mpl2.0))))
 194
 195 (define-public dnscrypt-proxy
 196   (package
 197     (name "dnscrypt-proxy")
 198     (version "1.9.5")
 199     (source (origin
 200               (method url-fetch)
 201               (uri (string-append
 202                     "https://download.dnscrypt.org/dnscrypt-proxy/"
 203                     "dnscrypt-proxy-" version ".tar.bz2"))
 204               (sha256
 205                (base32
 206                 "1dhvklr4dg2vlw108n11xbamacaryyg3dbrg629b76lp7685p7z8"))
 207               (modules '((guix build utils)))
 208               (snippet
 209                ;; Delete bundled libltdl. XXX: This package also bundles
 210                ;; a modified libevent that cannot currently be removed.
 211                '(begin
 212                   (delete-file-recursively "libltdl")
 213                   #t))))
 214     (build-system gnu-build-system)
 215     (arguments
 216      `(#:phases
 217        (modify-phases %standard-phases
 218          (add-after 'unpack 'autoreconf
 219            (lambda _
 220              ;; Re-generate build files due to unbundling ltdl.
 221              ;; TODO: Prevent generating new libltdl and building it.
 222              ;; The system version is still favored and referenced.
 223              (invoke "autoreconf" "-vif"))))))
 224     (native-inputs
 225      `(("pkg-config" ,pkg-config)
 226        ("automake" ,automake)
 227        ("autoconf" ,autoconf)
 228        ("libtool" ,libtool)))
 229     (inputs
 230      `(("libltdl" ,libltdl)
 231        ("libsodium" ,libsodium)))
 232     (home-page "https://www.dnscrypt.org/")
 233     (synopsis "Securely send DNS requests to a remote server")
 234     (description
 235      "@command{dnscrypt-proxy} is a tool for securing communications
 236 between a client and a DNS resolver.  It verifies that responses you get
 237 from a DNS provider was actually sent by that provider, and haven't been
 238 tampered with.  For optimal performance it is recommended to use this as
 239 a forwarder for a caching DNS resolver such as @command{dnsmasq}, but it
 240 can also be used as a normal DNS \"server\".  A list of public dnscrypt
 241 servers is included, and an up-to-date version is available at
 242 @url{https://download.dnscrypt.org/dnscrypt-proxy/dnscrypt-resolvers.csv}.")
 243     (license (list license:isc
 244                    ;; Libevent and src/ext/queue.h is 3-clause BSD.
 245                    license:bsd-3))))
 246
 247 (define-public dnscrypt-wrapper
 248   (package
 249     (name "dnscrypt-wrapper")
 250     (version "0.2.2")
 251     (source (origin
 252               (method url-fetch)
 253               (uri (string-append
 254                     "https://github.com/cofyc/dnscrypt-wrapper/releases"
 255                     "/download/v" version "/" name "-v" version ".tar.bz2"))
 256               (sha256
 257                (base32
 258                 "1vhg4g0r687f51wcdn7z9w1hxapazx6vyh5rsr8wa48sljzd583g"))))
 259     (build-system gnu-build-system)
 260     (arguments
 261      `(#:make-flags '("CC=gcc")
 262        ;; TODO: Tests require ruby-cucumber and ruby-aruba.
 263        #:tests? #f
 264        #:phases
 265        (modify-phases %standard-phases
 266          (add-after 'unpack 'create-configure
 267            (lambda _
 268              (invoke "make" "configure"))))))
 269     (native-inputs
 270      `(("autoconf" ,autoconf)))
 271     (inputs
 272      `(("libevent" ,libevent)
 273        ("libsodium" ,libsodium)))
 274     (home-page "https://github.com/Cofyc/dnscrypt-wrapper")
 275     (synopsis "Server-side dnscrypt proxy")
 276     (description
 277      "@command{dnscrypt-wrapper} is a tool to expose a name server over
 278 the @code{dnscrypt} protocol.  It can be used as an endpoint for the
 279 @command{dnscrypt-proxy} client to securely tunnel DNS requests between
 280 the two.")
 281     (license (list license:isc
 282                    ;; Bundled argparse is MIT. TODO: package and unbundle.
 283                    license:expat
 284                    ;; dns-protocol.h and rfc1035.{c,h} is gpl2 or gpl3 (either).
 285                    license:gpl2
 286                    license:gpl3))))
 287
 288 (define-public libasr
 289   (package
 290     (name "libasr")
 291     (version "1.0.4")
 292     (source
 293      (origin
 294        (method url-fetch)
 295        (uri (string-append "https://www.opensmtpd.org/archives/"
 296                            "libasr-" version ".tar.gz"))
 297        (sha256
 298         (base32 "1d6s8njqhvayx2gp47409sp1fn8m608ws26hr1srfp6i23nnpyqr"))))
 299     (build-system gnu-build-system)
 300     (arguments
 301      `(#:phases
 302        (modify-phases %standard-phases
 303          (add-after 'install 'install-documentation
 304            (lambda* (#:key outputs #:allow-other-keys)
 305              (let ((out (assoc-ref outputs "out")))
 306                (install-file "src/asr_run.3"
 307                              (string-append out "/share/man/man3"))
 308                #t))))))
 309     (native-inputs
 310      `(("autoconf" ,autoconf)
 311        ("automake" ,automake)
 312        ("libtool" ,libtool)
 313        ("pkg-config" ,pkg-config)))
 314     (home-page "https://www.opensmtpd.org")
 315     (synopsis "Asynchronous resolver library by the OpenBSD project")
 316     (description
 317      "libasr is a free, simple and portable asynchronous resolver library.
 318 It allows to run DNS queries and perform hostname resolutions in a fully
 319 asynchronous fashion.")
 320     (license (list license:isc
 321                    license:bsd-2 ; last part of getrrsetbyname_async.c
 322                    license:bsd-3
 323                    (license:non-copyleft "file://LICENSE") ; includes.h
 324                    license:openssl))))
 325
 326 (define-public nsd
 327   (package
 328     (name "nsd")
 329     (version "4.2.4")
 330     (source
 331      (origin
 332        (method url-fetch)
 333        (uri (string-append "https://www.nlnetlabs.nl/downloads/nsd/nsd-"
 334                            version ".tar.gz"))
 335        (sha256
 336         (base32 "0z7j3vwqqj0hh8n5irb2yqwzl45k4sn2wczbq1b1lqv5cxv6vgcy"))))
 337     (build-system gnu-build-system)
 338     (arguments
 339      `(#:configure-flags
 340        (list "--enable-pie"             ; fully benefit from ASLR
 341              "--enable-ratelimit"
 342              "--enable-recvmmsg"
 343              "--enable-relro-now"       ; protect GOT and .dtor areas
 344              "--disable-radix-tree"
 345              (string-append "--with-libevent="
 346                             (assoc-ref %build-inputs "libevent"))
 347              (string-append "--with-ssl="
 348                             (assoc-ref %build-inputs "openssl"))
 349              "--with-configdir=/etc"
 350              "--with-nsd_conf_file=/etc/nsd/nsd.conf"
 351              "--with-logfile=/var/log/nsd.log"
 352              "--with-pidfile=/var/db/nsd/nsd.pid"
 353              "--with-dbfile=/var/db/nsd/nsd.db"
 354              "--with-zonesdir=/etc/nsd"
 355              "--with-xfrdfile=/var/db/nsd/xfrd.state"
 356              "--with-zonelistfile=/var/db/nsd/zone.list")
 357        #:phases
 358        (modify-phases %standard-phases
 359          (add-before 'configure 'patch-installation-paths
 360            (lambda* (#:key outputs #:allow-other-keys)
 361              (let* ((out (assoc-ref outputs "out"))
 362                     (doc (string-append out "/share/doc/" ,name "-" ,version)))
 363                ;; The ‘make install’ target tries to create the parent
 364                ;; directories of run-time things like ‘pidfile’ above, and
 365                ;; useless empty directories like 'configdir'.  Remove such
 366                ;; '$(INSTALL)' lines and install the example configuration file
 367                ;; in an appropriate location.
 368                (substitute* "Makefile.in"
 369                  ((".*INSTALL.*\\$\\((config|pid|xfr|db)dir" command)
 370                   (string-append "#" command))
 371                  (("\\$\\(nsdconfigfile\\)\\.sample" file-name)
 372                   (string-append doc "/examples/" file-name)))
 373                #t))))
 374        #:tests? #f))                    ; no tests
 375     (inputs
 376      `(("libevent" ,libevent)
 377        ("openssl" ,openssl)))
 378     (home-page "https://www.nlnetlabs.nl/projects/nsd/about/")
 379     (synopsis "Authoritative DNS name server")
 380     (description "@dfn{NSD}, short for Name Server Daemon, is an authoritative
 381 name server for the Domain Name System (@dfn{DNS}).  It aims to be a fast and
 382 RFC-compliant nameserver.
 383
 384 NSD uses zone information compiled via @command{zonec} into a binary database
 385 file (@file{nsd.db}).  This allows fast startup of the name service daemon and
 386 allows syntax-structural errors in zone files to be flagged at compile time,
 387 before being made available to NSD service itself.  However, most traditional
 388 BIND-style zone files can be directly imported into NSD without modification.
 389
 390 The collection of programs and processes that make up NSD are designed so that
 391 the daemon itself runs as a non-privileged user and can be easily configured to
 392 run in a @code{chroot} jail, thus making any security flaws in NSD less likely
 393 to result in system-wide compromise.")
 394     (license (list license:bsd-3))))
 395
 396 (define-public unbound
 397   (package
 398     (name "unbound")
 399     (version "1.10.0")
 400     (source
 401      (origin
 402        (method url-fetch)
 403        (uri (string-append "https://www.unbound.net/downloads/unbound-"
 404                            version ".tar.gz"))
 405        (sha256
 406         (base32 "0mg9divpysr42sp0m693a70693dp8025v6c9dv1yabr4g1jlhbqm"))))
 407     (build-system gnu-build-system)
 408     (outputs '("out" "python"))
 409     (native-inputs
 410      `(("flex" ,flex)
 411        ("swig" ,swig)))
 412     (inputs
 413      `(("expat" ,expat)
 414        ("libevent" ,libevent)
 415        ("protobuf" ,protobuf)
 416        ("python-wrapper" ,python-wrapper)
 417        ("openssl" ,openssl)))
 418     (arguments
 419      `(#:configure-flags
 420        (list "--disable-static" ; save space and non-determinism in libunbound.a
 421              (string-append
 422               "--with-ssl=" (assoc-ref %build-inputs "openssl"))
 423              (string-append
 424               "--with-libevent=" (assoc-ref %build-inputs "libevent"))
 425              (string-append
 426               "--with-libexpat=" (assoc-ref %build-inputs "expat"))
 427              "--with-pythonmodule" "--with-pyunbound")
 428        #:phases
 429        (modify-phases %standard-phases
 430          (add-after 'configure 'fix-python-site-package-path
 431            ;; Move python modules into their own output.
 432            (lambda* (#:key outputs #:allow-other-keys)
 433              (let ((pyout (assoc-ref outputs "python"))
 434                    (ver ,(version-major+minor (package-version python))))
 435                (substitute* "Makefile"
 436                  (("^PYTHON_SITE_PKG=.*$")
 437                   (string-append
 438                    "PYTHON_SITE_PKG="
 439                    pyout "/lib/python-" ver "/site-packages\n"))))
 440              #t))
 441          (add-before 'check 'fix-missing-nss-for-tests
 442            ;; Unfortunately, the package's unittests involve some checks
 443            ;; looking up protocols and services which are not provided
 444            ;; by the minimalistic build environment, in particular,
 445            ;; /etc/protocols and /etc/services are missing.
 446            ;; Also, after plain substitution of protocol and service names
 447            ;; in the test data, the tests still fail because the
 448            ;; corresponding Resource Records have been signed by
 449            ;; RRSIG records.
 450            ;; The following LD_PRELOAD library overwrites the glibc
 451            ;; functions ‘get{proto,serv}byname’, ‘getprotobynumber’ and
 452            ;; ‘getservbyport’ providing the few records required for the
 453            ;; unit tests to pass.
 454            (lambda* (#:key inputs outputs #:allow-other-keys)
 455              (let* ((source (assoc-ref %build-inputs "source"))
 456                     (gcc (assoc-ref %build-inputs "gcc")))
 457                (call-with-output-file "/tmp/nss_preload.c"
 458                  (lambda (port)
 459                    (display "#include <stdlib.h>
 460 #include <string.h>
 461 #include <strings.h>
 462
 463 #include <netdb.h>
 464
 465 struct protoent *getprotobyname(const char *name) {
 466   struct protoent *p = malloc(sizeof(struct protoent));
 467   p->p_aliases = malloc(sizeof(char*));
 468   if (strcasecmp(name, \"tcp\") == 0) {
 469     p->p_name = \"tcp\";
 470     p->p_proto = 6;
 471     p->p_aliases[0] = \"TCP\";
 472   } else if (strcasecmp(name, \"udp\") == 0) {
 473     p->p_name = \"udp\";
 474     p->p_proto = 17;
 475     p->p_aliases[0] = \"UDP\";
 476   } else
 477     p = NULL;
 478   return p;
 479 }
 480
 481 struct protoent *getprotobynumber(int proto) {
 482   struct protoent *p = malloc(sizeof(struct protoent));
 483   p->p_aliases = malloc(sizeof(char*));
 484   switch(proto) {
 485   case 6:
 486     p->p_name = \"tcp\";
 487     p->p_proto = 6;
 488     p->p_aliases[0] = \"TCP\";
 489     break;
 490   case 17:
 491     p->p_name = \"udp\";
 492     p->p_proto = 17;
 493     p->p_aliases[0] = \"UDP\";
 494     break;
 495   default:
 496     p = NULL;
 497     break;
 498   }
 499   return p;
 500 }
 501
 502 struct servent *getservbyname(const char *name, const char *proto) {
 503   struct servent *s = malloc(sizeof(struct servent));
 504   char* buf = malloc((strlen(proto)+1)*sizeof(char));
 505   strcpy(buf, proto);
 506   s->s_aliases = malloc(sizeof(char*));
 507   s->s_aliases[0] = NULL;
 508   if (strcasecmp(name, \"domain\") == 0) {
 509     s->s_name = \"domain\";
 510     s->s_port = htons(53);
 511     s->s_proto = buf;
 512   } else
 513     s = NULL;
 514   return s;
 515 }
 516
 517 struct servent *getservbyport(int port, const char *proto) {
 518   char buf[32];
 519   struct servent *s = malloc(sizeof(struct servent));
 520   strcpy(buf, proto);
 521   s->s_aliases = malloc(sizeof(char*));
 522   s->s_aliases[0] = NULL;
 523   switch(port) {
 524   case 53:
 525     s->s_name = \"domain\";
 526     s->s_port = 53;
 527     s->s_proto = \"udp\";
 528     break;
 529   default:
 530     s = NULL;
 531     break;
 532   }
 533   return s;
 534 }" port)))
 535                (invoke (string-append gcc "/bin/gcc")
 536                        "-shared" "-fPIC" "-o" "/tmp/nss_preload.so"
 537                        "/tmp/nss_preload.c")
 538                ;; The preload library only affects the unittests.
 539                (substitute* "Makefile"
 540                  (("./unittest")
 541                   "LD_PRELOAD=/tmp/nss_preload.so ./unittest")))
 542              #t)))))
 543     (home-page "https://www.unbound.net")
 544     (synopsis "Validating, recursive, and caching DNS resolver")
 545     (description
 546      "Unbound is a recursive-only caching DNS server which can perform DNSSEC
 547 validation of results.  It implements only a minimal amount of authoritative
 548 service to prevent leakage to the root nameservers: forward lookups for
 549 localhost, reverse for @code{127.0.0.1} and @code{::1}, and NXDOMAIN for zones
 550 served by AS112.  Stub and forward zones are supported.")
 551     (license license:bsd-4)))
 552
 553 (define-public yadifa
 554   (package
 555     (name "yadifa")
 556     (version "2.3.9")
 557     (source
 558      (let ((build "8497"))
 559        (origin
 560          (method url-fetch)
 561          (uri
 562           (string-append "http://cdn.yadifa.eu/sites/default/files/releases/"
 563                          "yadifa-" version "-" build ".tar.gz"))
 564          (sha256
 565           (base32 "0xvyr91sfgzkpw6g3h893ldbwnki3w2472n56rr18w67qghs1sa5")))))
 566     (build-system gnu-build-system)
 567     (native-inputs
 568      `(("which" ,which)))
 569     (inputs
 570      `(("openssl" ,openssl)))
 571     (arguments
 572      `(#:phases
 573        (modify-phases %standard-phases
 574          (add-before 'configure 'omit-example-configurations
 575            (lambda _
 576              (substitute* "Makefile.in"
 577                ((" (etc|var)") ""))
 578              #t)))
 579        #:configure-flags
 580        (list "--sysconfdir=/etc"
 581              "--localstatedir=/var"
 582              "--disable-build-timestamp" ; build reproducibly
 583              "--enable-shared"
 584              "--disable-static"
 585              "--enable-acl"
 586              "--enable-caching"
 587              "--enable-ctrl"            ; enable remote control
 588              "--enable-nsec"
 589              "--enable-nsec3"
 590              "--enable-tsig")))
 591     (home-page "https://www.yadifa.eu/")
 592     (synopsis "Authoritative DNS name server")
 593     (description "YADIFA is an authoritative name server for the @dfn{Domain
 594 Name System} (DNS).  It aims for both higher performance and a smaller memory
 595 footprint than other implementations, while remaining fully RFC-compliant.
 596 YADIFA supports dynamic record updates and the @dfn{Domain Name System Security
 597 Extensions} (DNSSEC).")
 598     (license license:bsd-3)))
 599
 600 (define-public knot
 601   (package
 602     (name "knot")
 603     (version "2.9.3")
 604     (source
 605      (origin
 606        (method url-fetch)
 607        (uri (string-append "https://secure.nic.cz/files/knot-dns/"
 608                            "knot-" version ".tar.xz"))
 609        (sha256
 610         (base32 "0zm0642hkb16sqkqpa84f89f3s0bw44m837r1nia8m89swvz3bgj"))
 611        (modules '((guix build utils)))
 612        (snippet
 613         '(begin
 614            ;; Delete bundled libraries.
 615            (with-directory-excursion "src/contrib"
 616              (delete-file-recursively "lmdb"))
 617            #t))))
 618     (build-system gnu-build-system)
 619     (native-inputs
 620      `(("pkg-config" ,pkg-config)))
 621     (inputs
 622      `(("fstrm" ,fstrm)
 623        ("gnutls" ,gnutls)
 624        ("jansson" ,jansson)
 625        ("libcap-ng" ,libcap-ng)
 626        ("libedit" ,libedit)
 627        ("libidn" ,libidn)
 628        ("liburcu" ,liburcu)
 629        ("lmdb" ,lmdb)
 630        ("ncurses" ,ncurses)
 631        ("protobuf-c" ,protobuf-c)))
 632     (arguments
 633      `(#:phases
 634        (modify-phases %standard-phases
 635          (add-before 'configure 'disable-directory-pre-creation
 636            (lambda _
 637              ;; Don't install empty directories like ‘/etc’ outside the store.
 638              ;; This is needed even when using ‘make config_dir=... install’.
 639              (substitute* "src/Makefile.in" (("\\$\\(INSTALL\\) -d") "true"))
 640              #t))
 641          (replace 'install
 642            (lambda* (#:key outputs #:allow-other-keys)
 643              (let* ((out (assoc-ref outputs "out"))
 644                     (doc (string-append out "/share/doc/" ,name "-" ,version))
 645                     (etc (string-append doc "/examples/etc")))
 646                (invoke "make"
 647                        (string-append "config_dir=" etc)
 648                        "install")))))
 649        #:configure-flags
 650        (list "--sysconfdir=/etc"
 651              "--localstatedir=/var"
 652              "--enable-dnstap"          ; let tools read/write capture files
 653              "--with-module-dnstap=yes" ; detailed query capturing & logging
 654              (string-append "--with-bash-completions="
 655                             (assoc-ref %outputs "out")
 656                             "/etc/bash_completion.d"))))
 657     (home-page "https://www.knot-dns.cz/")
 658     (synopsis "Authoritative DNS name server")
 659     (description "Knot DNS is an authoritative name server for the @dfn{Domain
 660 Name System} (DNS), designed to meet the needs of root and @dfn{top-level
 661 domain} (TLD) name servers.  It is implemented as a threaded daemon and uses a
 662 number of programming techniques to improve speed.  For example, the responder
 663 is completely lock-free, resulting in a very high response rate.  Other features
 664 include automatic @dfn{DNS Security Extensions} (DNSSEC) signing, dynamic record
 665 synthesis, and on-the-fly re-configuration.")
 666     (license
 667      (list
 668       ;; src/contrib/{hat-trie,murmurhash3,openbsd},
 669       ;; src/dnssec/contrib/vpool.[ch], and parts of libtap/ are ‘MIT’ (expat).
 670       license:expat
 671       license:lgpl2.0+              ; parts of scr/contrib/ucw
 672       license:public-domain         ; src/contrib/fnv and possibly murmurhash3
 673       license:gpl3+))))             ; everything else
 674
 675 (define-public knot-resolver
 676   (package
 677     (name "knot-resolver")
 678     (version "4.3.0")
 679     (source (origin
 680               (method url-fetch)
 681               (uri (string-append "https://secure.nic.cz/files/knot-resolver/"
 682                                   "knot-resolver-" version ".tar.xz"))
 683               (sha256
 684                (base32
 685                 "09ffmqx79lv5psr433x4n946njgsn071b9b7161pcb9bmrqz380c"))))
 686     (build-system meson-build-system)
 687     (arguments
 688      '(#:configure-flags '("-Ddoc=enabled")
 689        #:phases
 690        (modify-phases %standard-phases
 691          (add-before 'configure 'disable-default-ta
 692            (lambda _
 693              ;;  Disable the default managed root TA, since we don't have
 694              ;;  write access to the keyfile and its directory in store.
 695              (substitute* "daemon/lua/sandbox.lua.in"
 696                (("^trust_anchors\\.add_file.*") ""))
 697              #t))
 698          (add-after 'build 'build-doc
 699            (lambda _
 700              (invoke "ninja" "doc")))
 701          (add-after 'install 'wrap-binary
 702            (lambda* (#:key inputs outputs #:allow-other-keys)
 703              (let* ((out (assoc-ref outputs "out"))
 704                     (lua-* (map cdr (filter
 705                                      (lambda (input)
 706                                        (string-prefix? "lua-" (car input)))
 707                                      inputs)))
 708                     (lua-path (lambda (p)
 709                                 (string-append p "/share/lua/5.1/?.lua")))
 710                     (lua-cpath (lambda (p)
 711                                  (string-append p "/lib/lua/5.1/?.so"))))
 712                (wrap-program (string-append out "/sbin/kresd")
 713                  `("LUA_PATH" ";" prefix ,(map lua-path lua-*))
 714                  `("LUA_CPATH" ";" prefix ,(map lua-cpath lua-*)))
 715                #t))))))
 716     (native-inputs
 717      `(("cmocka" ,cmocka)               ; for unit tests
 718        ("doxygen" ,doxygen)
 719        ("protobuf-c" ,protobuf-c)
 720        ("pkg-config" ,pkg-config)
 721        ("python-breathe" ,python-breathe)
 722        ("python-sphinx" ,python-sphinx)
 723        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)))
 724     (inputs
 725      `(("fstrm" ,fstrm)
 726        ("gnutls" ,gnutls)
 727        ("knot" ,knot)
 728        ("libuv" ,libuv)
 729        ("lmdb" ,lmdb)
 730        ("luajit" ,luajit)
 731        ;; TODO: Add optional lua modules: basexx, cqueues and psl.
 732        ("lua-bitop" ,lua5.1-bitop)
 733        ("lua-filesystem" ,lua5.1-filesystem)
 734        ("lua-sec" ,lua5.1-sec)
 735        ("lua-socket" ,lua5.1-socket)))
 736     (home-page "https://www.knot-resolver.cz/")
 737     (synopsis "Caching validating DNS resolver")
 738     (description
 739      "Knot Resolver is a caching full resolver implementation written in C and
 740 LuaJIT, both a resolver library and a daemon.")
 741     (license (list license:gpl3+
 742                    ;; Some 'contrib' files are under MIT, CC0 and LGPL2.
 743                    license:expat
 744                    license:cc0
 745                    license:lgpl2.0))))
 746
 747 (define-public ddclient
 748   (package
 749     (name "ddclient")
 750     (version "3.9.1")
 751     (source
 752      (origin
 753        (method git-fetch)
 754        (uri (git-reference
 755              (url "https://github.com/ddclient/ddclient.git")
 756              (commit (string-append "v" version))))
 757        (file-name (git-file-name name version))
 758        (sha256
 759         (base32 "0hf377g4j9r9sac75xp17nk2h58mazswz4vkg4g2gl2yyhvzq91w"))))
 760     (build-system trivial-build-system) ; no Makefile.PL
 761     (native-inputs
 762      `(("bash" ,bash)
 763        ("perl" ,perl)))
 764     (inputs
 765      `(("inetutils" ,inetutils)         ; logger
 766        ("net-tools" ,net-tools)
 767        ("perl-data-validate-ip" ,perl-data-validate-ip)
 768        ("perl-digest-sha1" ,perl-digest-sha1)
 769        ("perl-io-socket-ssl" ,perl-io-socket-ssl)))
 770     (arguments
 771      `(#:modules ((guix build utils)
 772                   (ice-9 match)
 773                   (srfi srfi-26))
 774        #:builder
 775        (begin
 776          (use-modules (guix build utils)
 777                       (ice-9 match)
 778                       (srfi srfi-26))
 779          (setenv "PATH" (string-append
 780                          (assoc-ref %build-inputs "bash") "/bin" ":"
 781                          (assoc-ref %build-inputs "perl") "/bin"))
 782
 783          ;; Copy the (read-only) source into the (writable) build directory.
 784          (copy-recursively (assoc-ref %build-inputs "source") ".")
 785
 786          ;; Install.
 787          (let* ((out (assoc-ref %outputs "out"))
 788                 (bin (string-append out "/bin")))
 789            (let ((file "ddclient"))
 790              (substitute* file
 791                (("/usr/bin/perl") (which "perl"))
 792                ;; Strictly use ‘/etc/ddclient/ddclient.conf’.
 793                (("\\$\\{program\\}\\.conf") "/etc/ddclient/ddclient.conf")
 794                (("\\$etc\\$program.conf") "/etc/ddclient/ddclient.conf")
 795                ;; Strictly use ‘/var/cache/ddclient/ddclient.cache’
 796                (("\\$cachedir\\$program\\.cache")
 797                 "/var/cache/ddclient/ddclient.cache"))
 798              (install-file file bin)
 799              (wrap-program (string-append bin "/" file)
 800                `("PATH" ":" =
 801                  ("$PATH"
 802                   ,@(map (lambda (input)
 803                            (match input
 804                                   ((name . store)
 805                                    (string-append store "/bin"))))
 806                          %build-inputs)))
 807                `("PERL5LIB" ":" =
 808                  ,(delete
 809                    ""
 810                    (map (match-lambda
 811                          (((? (cut string-prefix? "perl-" <>) name) . dir)
 812                           (string-append dir "/lib/perl5/site_perl"))
 813                          (_ ""))
 814                         %build-inputs)))))
 815            (for-each (cut install-file <> (string-append out
 816                                                          "/share/ddclient"))
 817                      (find-files "." "sample.*$"))))))
 818     (home-page "https://ddclient.net/")
 819     (synopsis "Address updating utility for dynamic DNS services")
 820     (description "This package provides a client to update dynamic IP
 821 addresses with several dynamic DNS service providers, such as
 822 @uref{https://www.dyndns.com/account/login.html,DynDNS.com}.
 823
 824 This makes it possible to use a fixed hostname (such as myhost.dyndns.org) to
 825 access a machine with a dynamic IP address.
 826
 827 The client supports both dynamic and (near) static services, as well as MX
 828 record and alternative name management.  It caches the address, and only
 829 attempts the update when it has changed.")
 830     (license license:gpl2+)))
 831
 832 (define-public hnsd
 833   ;; There have been no releases yet, hence this commit.
 834   (let ((revision "0")
 835         (commit "895d89c25d316d18df9d374fe78aae3902bc89fb"))
 836    (package
 837      (name "hnsd")
 838      (version (git-version "0.0" revision commit))
 839      (source (origin
 840                (method git-fetch)
 841                (uri (git-reference
 842                      (url "https://github.com/handshake-org/hnsd")
 843                      (commit commit)))
 844                (sha256
 845                 (base32
 846                  "0704y73sddn24jga9csw4gxyfb3pnrfnk0vdcph84n1h38490l16"))
 847                (file-name (git-file-name name version))
 848                (modules '((guix build utils)))
 849                (snippet
 850                 '(begin
 851                    ;; Delete the bundled copy of libuv.
 852                    (delete-file-recursively "uv")
 853                    (substitute* "configure.ac"
 854                      (("AC_CONFIG_SUBDIRS\\(\\[uv\\]\\)") ""))
 855                    (substitute* "Makefile.am"
 856                      (("SUBDIRS = uv") "\n")
 857                      (("\\$\\(top_builddir\\)/uv/libuv.la") "-luv")
 858
 859                      ;; Make sure the 'hnsd' binary is installed and
 860                      ;; dynamically-linked.
 861                      (("noinst_PROGRAMS") "bin_PROGRAMS")
 862                      (("hnsd_LDFLAGS = -static") ""))
 863
 864                    ;; This script tries to chdir to "uv" and doesn't do more
 865                    ;; than "autoreconf" so remove it.
 866                    (delete-file "autogen.sh")
 867                    #t))))
 868      (build-system gnu-build-system)
 869      (arguments
 870       '(#:configure-flags '("--disable-static"))) ;no need for libhsk.a
 871      (native-inputs
 872       `(("autoconf" ,autoconf)
 873         ("automake" ,automake)
 874         ("libtool" ,libtool)))
 875      (inputs
 876       `(("unbound" ,unbound)
 877         ("libuv" ,libuv)))
 878      (home-page "https://www.handshake.org/")
 879      (synopsis "Resolver daemon for the Handshake naming protocol")
 880      (description
 881       "@command{hnsd} is a @dfn{host name resolver} for the Handshake Naming
 882 System (HNS) peer-to-peer network.")
 883      (license license:expat))))
 884
 885 (define-public libmicrodns
 886   (package
 887     (name "libmicrodns")
 888     (version "0.0.10")
 889     (source (origin
 890               (method git-fetch)
 891               (uri (git-reference
 892                     (url "https://github.com/videolabs/libmicrodns")
 893                     (commit version)))
 894               (file-name (git-file-name name version))
 895               (sha256
 896                (base32
 897                 "1xvl9k49ng35wbsqmnjnyqvkyjf8dcq2ywsq3jp3wh0rgmxhq2fh"))))
 898     (build-system gnu-build-system)
 899     (native-inputs
 900      `(("pkg-config" ,pkg-config)
 901        ("autoconf" ,autoconf)
 902        ("automake" ,automake)
 903        ("libtool" ,libtool)))
 904     (home-page "https://github.com/videolabs/libmicrodns")
 905     (synopsis "Minimal mDNS resolver library")
 906     (description "@code{libmicrodns} provides a minimal implementation of a
 907 mDNS resolver as well as an announcer.  mDNS (Multicast Domain Name System) is
 908 a zero-config service that allows one to resolve host names to IP addresses in
 909 local networks.")
 910     (license license:lgpl2.1)))
 911
 912 (define-public public-suffix-list
 913   ;; Mozilla releases the official list here:
 914   ;;
 915   ;;   https://publicsuffix.org/list/public_suffix_list.dat
 916   ;;
 917   ;; However, Mozilla syncs that file from the GitHub repository periodically,
 918   ;; so its contents will change over time.  If you update this commit, please
 919   ;; make sure that the new commit refers to a list which is identical to the
 920   ;; officially published list available from the URL above.
 921   (let ((commit "9375b697baddb0827a5995c81bd3c75877a0b35d"))
 922     (package
 923       (name "public-suffix-list")
 924       (version (git-version "0" "1" commit))
 925       (source (origin
 926                 (method git-fetch)
 927                 (uri (git-reference
 928                       (url "https://github.com/publicsuffix/list.git")
 929                       (commit commit)))
 930                 (file-name (git-file-name name version))
 931                 (sha256
 932                  (base32
 933                   "1sm7pni01rnl4ldzi8z8nc4cbgq8nxda9gwc68v0s3ij7jd1jmik"))))
 934       (build-system trivial-build-system)
 935       (arguments
 936        `(#:modules ((guix build utils))
 937          #:builder
 938          (begin
 939            (use-modules (guix build utils))
 940            (let* ((out (assoc-ref %outputs "out"))
 941                   ;; Install to /share because that is where "read-only
 942                   ;; architecture-independent data files" should go (see:
 943                   ;; (standards) Directory Variables).  Include the version in
 944                   ;; the directory name so that if multiple versions are ever
 945                   ;; installed in the same profile, they will not conflict.
 946                   (destination (string-append
 947                                 out "/share/public-suffix-list-" ,version))
 948                   (source (assoc-ref %build-inputs "source")))
 949              (with-directory-excursion source
 950              (install-file "public_suffix_list.dat" destination)
 951              (install-file "LICENSE" destination))
 952              #t))))
 953       (home-page "https://publicsuffix.org/")
 954       (synopsis "Database of current and historical DNS suffixes")
 955       (description "This is the Public Suffix List maintained by Mozilla.  A
 956 \"public suffix\" is one under which Internet users can (or historically
 957 could) directly register names in the Domain Name System (DNS).  Some examples
 958 of public suffixes are .com, .co.uk and pvt.k12.ma.us.  This is a list of all
 959 known public suffixes.")
 960       (license license:mpl2.0))))