gnu/packages/dns.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
   3 ;;; Copyright © 2016 Mark H Weaver <mhw@netris.org>
   4 ;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
   5 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2016 John Darrington <jmd@gnu.org>
   7 ;;; Copyright © 2016 Nikita <nikita@n0.is>
   8 ;;; Copyright © 2016, 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
   9 ;;; Copyright © 2016, 2020 Marius Bakke <mbakke@fastmail.com>
  10 ;;; Copyright © 2017 Vasile Dumitrascu <va511e@yahoo.com>
  11 ;;; Copyright © 2017 Gregor Giesen <giesen@zaehlwerk.net>
  12 ;;; Copyright © 2018 Oleg Pykhalov <go.wigust@gmail.com>
  13 ;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
  14 ;;; Copyright © 2019 Chris Marusich <cmmarusich@gmail.com>
  15 ;;; Copyright © 2019 Rutger Helling <rhelling@mykolab.com>
  16 ;;; Copyright © 2020 Pierre Langlois <pierre.langlois@gmx.com>
  17 ;;; Copyright © 2020 Arun Isaac <arunisaac@systemreboot.net>
  18 ;;; Copyright © 2020 Leo Famulari <leo@famulari.name>
  19 ;;; Copyright © 2020 Brice Waegeneire <brice@waegenei.re>
  20 ;;;
  21 ;;; This file is part of GNU Guix.
  22 ;;;
  23 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  24 ;;; under the terms of the GNU General Public License as published by
  25 ;;; the Free Software Foundation; either version 3 of the License, or (at
  26 ;;; your option) any later version.
  27 ;;;
  28 ;;; GNU Guix is distributed in the hope that it will be useful, but
  29 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  30 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  31 ;;; GNU General Public License for more details.
  32 ;;;
  33 ;;; You should have received a copy of the GNU General Public License
  34 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  35
  36 (define-module (gnu packages dns)
  37   #:use-module (gnu packages admin)
  38   #:use-module (gnu packages autotools)
  39   #:use-module (gnu packages base)
  40   #:use-module (gnu packages bash)
  41   #:use-module (gnu packages check)
  42   #:use-module (gnu packages databases)
  43   #:use-module (gnu packages documentation)
  44   #:use-module (gnu packages compression)
  45   #:use-module (gnu packages crypto)
  46   #:use-module (gnu packages datastructures)
  47   #:use-module (gnu packages flex)
  48   #:use-module (gnu packages gcc)
  49   #:use-module (gnu packages glib)
  50   #:use-module (gnu packages groff)
  51   #:use-module (gnu packages groff)
  52   #:use-module (gnu packages libedit)
  53   #:use-module (gnu packages libevent)
  54   #:use-module (gnu packages libidn)
  55   #:use-module (gnu packages linux)
  56   #:use-module (gnu packages lua)
  57   #:use-module (gnu packages ncurses)
  58   #:use-module (gnu packages nettle)
  59   #:use-module (gnu packages networking)
  60   #:use-module (gnu packages perl)
  61   #:use-module (gnu packages pkg-config)
  62   #:use-module (gnu packages protobuf)
  63   #:use-module (gnu packages python)
  64   #:use-module (gnu packages python-xyz)
  65   #:use-module (gnu packages sphinx)
  66   #:use-module (gnu packages swig)
  67   #:use-module (gnu packages tls)
  68   #:use-module (gnu packages web)
  69   #:use-module (gnu packages xml)
  70   #:use-module (gnu packages)
  71   #:use-module ((guix licenses) #:prefix license:)
  72   #:use-module (guix packages)
  73   #:use-module (guix download)
  74   #:use-module (guix git-download)
  75   #:use-module (guix utils)
  76   #:use-module (guix build-system gnu)
  77   #:use-module (guix build-system meson)
  78   #:use-module (guix build-system trivial))
  79
  80 (define-public dnsmasq
  81   (package
  82     (name "dnsmasq")
  83     (version "2.81")
  84     (source (origin
  85               (method url-fetch)
  86               (uri (string-append
  87                     "http://www.thekelleys.org.uk/dnsmasq/dnsmasq-"
  88                     version ".tar.xz"))
  89               (sha256
  90                (base32
  91                 "1yzq6anwgr5rlnwydpszb51cyhp2vjq29b24ck19flbwac1sk73l"))))
  92     (build-system gnu-build-system)
  93     (native-inputs
  94      `(("pkg-config" ,pkg-config)))
  95     (inputs
  96      `(("dbus" ,dbus)))
  97     (arguments
  98      `(#:phases
  99        (modify-phases %standard-phases (delete 'configure))
 100        #:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 101                           "CC=gcc"
 102                           "COPTS=\"-DHAVE_DBUS\"")
 103        #:tests? #f))                    ; no ‘check’ target
 104     (home-page "http://www.thekelleys.org.uk/dnsmasq/doc.html")
 105     (synopsis "Small caching DNS proxy and DHCP/TFTP server")
 106     (description
 107      "Dnsmasq is a light-weight DNS forwarder and DHCP server.  It is designed
 108 to provide DNS and, optionally, DHCP to a small network.  It can serve the
 109 names of local machines which are not in the global DNS.  The DHCP server
 110 integrates with the DNS server and allows machines with DHCP-allocated
 111 addresses to appear in the DNS with names configured either on each host or in
 112 a central configuration file.  Dnsmasq supports static and dynamic DHCP leases
 113 and BOOTP/TFTP for network booting of diskless machines.")
 114     ;; Source files only say GPL2 and GPL3 are allowed.
 115     (license (list license:gpl2 license:gpl3))))
 116
 117 ;; 'bind' is the name of a built-in Guile procedure, which is why we choose a
 118 ;; different name here.
 119 (define-public isc-bind
 120   (package
 121     (name "bind")
 122     (version "9.16.3")
 123     (source (origin
 124               (method url-fetch)
 125               (uri (string-append
 126                     "https://ftp.isc.org/isc/bind9/" version
 127                     "/bind-" version ".tar.xz"))
 128               (sha256
 129                (base32
 130                 "0zjgaspnx0p0rp83h4yj595s25da7fjis94z9frhv3azvq9nbb17"))))
 131     (build-system gnu-build-system)
 132     (outputs `("out" "utils"))
 133     (inputs
 134      ;; It would be nice to add GeoIP and gssapi once there are packages.
 135      `(("libcap" ,libcap)
 136        ("libuv" ,libuv)
 137        ("libxml2" ,libxml2)
 138        ("openssl" ,openssl)
 139        ("p11-kit" ,p11-kit)
 140        ("python" ,python)
 141        ("python-ply" ,python-ply)))
 142     (native-inputs
 143      `(("perl" ,perl)
 144        ("pkg-config" ,pkg-config)))
 145     (arguments
 146      `(#:configure-flags
 147        (list (string-append "--with-pkcs11="
 148                             (assoc-ref %build-inputs "p11-kit")))
 149        #:phases
 150        (modify-phases %standard-phases
 151          (add-after 'strip 'move-to-utils
 152            (lambda _
 153              (for-each
 154               (lambda (file)
 155                 (let ((target  (string-append (assoc-ref %outputs "utils") file))
 156                       (src  (string-append (assoc-ref %outputs "out") file)))
 157                   (mkdir-p (dirname target))
 158                   (link src target)
 159                   (delete-file src)))
 160               '("/bin/dig" "/bin/delv" "/bin/nslookup" "/bin/host" "/bin/nsupdate"
 161                 "/share/man/man1/dig.1"
 162                 "/share/man/man1/host.1"
 163                 "/share/man/man1/nslookup.1"
 164                 "/share/man/man1/nsupdate.1"))
 165              #t))
 166          ;; When and if guix provides user namespaces for the build process,
 167          ;; then the following can be uncommented and the subsequent "force-test"
 168          ;; will not be necessary.
 169          ;;
 170          ;;   (add-before 'check 'set-up-loopback
 171          ;;     (lambda _
 172          ;;          (system "bin/tests/system/ifconfig.sh up")))
 173          (replace 'check
 174            (lambda _
 175              ;; XXX Even ‘make force-test’ tries to create network interfaces
 176              ;; and fails.  The only working target is the (trivial) fuzz test.
 177              (with-directory-excursion "fuzz"
 178                (invoke "make" "check"))
 179              #t)))))
 180     (synopsis "An implementation of the Domain Name System")
 181     (description "BIND is an implementation of the @dfn{Domain Name System}
 182 (DNS) protocols for the Internet.  It is a reference implementation of those
 183 protocols, but it is also production-grade software, suitable for use in
 184 high-volume and high-reliability applications. The name BIND stands for
 185 \"Berkeley Internet Name Domain\", because the software originated in the early
 186 1980s at the University of California at Berkeley.")
 187     (home-page "https://www.isc.org/downloads/bind")
 188     (license (list license:mpl2.0))))
 189
 190 (define-public dnscrypt-proxy
 191   (package
 192     (name "dnscrypt-proxy")
 193     (version "1.9.5")
 194     (source (origin
 195               (method url-fetch)
 196               (uri (string-append
 197                     "https://download.dnscrypt.org/dnscrypt-proxy/"
 198                     "dnscrypt-proxy-" version ".tar.bz2"))
 199               (sha256
 200                (base32
 201                 "1dhvklr4dg2vlw108n11xbamacaryyg3dbrg629b76lp7685p7z8"))
 202               (modules '((guix build utils)))
 203               (snippet
 204                ;; Delete bundled libltdl. XXX: This package also bundles
 205                ;; a modified libevent that cannot currently be removed.
 206                '(begin
 207                   (delete-file-recursively "libltdl")
 208                   #t))))
 209     (build-system gnu-build-system)
 210     (arguments
 211      `(#:phases
 212        (modify-phases %standard-phases
 213          (add-after 'unpack 'autoreconf
 214            (lambda _
 215              ;; Re-generate build files due to unbundling ltdl.
 216              ;; TODO: Prevent generating new libltdl and building it.
 217              ;; The system version is still favored and referenced.
 218              (invoke "autoreconf" "-vif"))))))
 219     (native-inputs
 220      `(("pkg-config" ,pkg-config)
 221        ("automake" ,automake)
 222        ("autoconf" ,autoconf)
 223        ("libtool" ,libtool)))
 224     (inputs
 225      `(("libltdl" ,libltdl)
 226        ("libsodium" ,libsodium)))
 227     (home-page "https://www.dnscrypt.org/")
 228     (synopsis "Securely send DNS requests to a remote server")
 229     (description
 230      "@command{dnscrypt-proxy} is a tool for securing communications
 231 between a client and a DNS resolver.  It verifies that responses you get
 232 from a DNS provider was actually sent by that provider, and haven't been
 233 tampered with.  For optimal performance it is recommended to use this as
 234 a forwarder for a caching DNS resolver such as @command{dnsmasq}, but it
 235 can also be used as a normal DNS \"server\".  A list of public dnscrypt
 236 servers is included, and an up-to-date version is available at
 237 @url{https://download.dnscrypt.org/dnscrypt-proxy/dnscrypt-resolvers.csv}.")
 238     (license (list license:isc
 239                    ;; Libevent and src/ext/queue.h is 3-clause BSD.
 240                    license:bsd-3))))
 241
 242 (define-public dnscrypt-wrapper
 243   (package
 244     (name "dnscrypt-wrapper")
 245     (version "0.2.2")
 246     (source (origin
 247               (method url-fetch)
 248               (uri (string-append
 249                     "https://github.com/cofyc/dnscrypt-wrapper/releases"
 250                     "/download/v" version "/" name "-v" version ".tar.bz2"))
 251               (sha256
 252                (base32
 253                 "1vhg4g0r687f51wcdn7z9w1hxapazx6vyh5rsr8wa48sljzd583g"))))
 254     (build-system gnu-build-system)
 255     (arguments
 256      `(#:make-flags '("CC=gcc")
 257        ;; TODO: Tests require ruby-cucumber and ruby-aruba.
 258        #:tests? #f
 259        #:phases
 260        (modify-phases %standard-phases
 261          (add-after 'unpack 'create-configure
 262            (lambda _
 263              (invoke "make" "configure"))))))
 264     (native-inputs
 265      `(("autoconf" ,autoconf)))
 266     (inputs
 267      `(("libevent" ,libevent)
 268        ("libsodium" ,libsodium)))
 269     (home-page "https://github.com/Cofyc/dnscrypt-wrapper")
 270     (synopsis "Server-side dnscrypt proxy")
 271     (description
 272      "@command{dnscrypt-wrapper} is a tool to expose a name server over
 273 the @code{dnscrypt} protocol.  It can be used as an endpoint for the
 274 @command{dnscrypt-proxy} client to securely tunnel DNS requests between
 275 the two.")
 276     (license (list license:isc
 277                    ;; Bundled argparse is MIT. TODO: package and unbundle.
 278                    license:expat
 279                    ;; dns-protocol.h and rfc1035.{c,h} is gpl2 or gpl3 (either).
 280                    license:gpl2
 281                    license:gpl3))))
 282
 283 (define-public libasr
 284   (package
 285     (name "libasr")
 286     (version "1.0.4")
 287     (source
 288      (origin
 289        (method url-fetch)
 290        (uri (string-append "https://www.opensmtpd.org/archives/"
 291                            "libasr-" version ".tar.gz"))
 292        (sha256
 293         (base32 "1d6s8njqhvayx2gp47409sp1fn8m608ws26hr1srfp6i23nnpyqr"))))
 294     (build-system gnu-build-system)
 295     (arguments
 296      `(#:phases
 297        (modify-phases %standard-phases
 298          (add-after 'install 'install-documentation
 299            (lambda* (#:key outputs #:allow-other-keys)
 300              (let ((out (assoc-ref outputs "out")))
 301                (install-file "src/asr_run.3"
 302                              (string-append out "/share/man/man3"))
 303                #t))))))
 304     (native-inputs
 305      `(("autoconf" ,autoconf)
 306        ("automake" ,automake)
 307        ("libtool" ,libtool)
 308        ("pkg-config" ,pkg-config)))
 309     (home-page "https://www.opensmtpd.org")
 310     (synopsis "Asynchronous resolver library by the OpenBSD project")
 311     (description
 312      "libasr is a free, simple and portable asynchronous resolver library.
 313 It runs DNS queries and performs hostname resolution in a fully
 314 asynchronous fashion.")
 315     (license (list license:isc
 316                    license:bsd-2 ; last part of getrrsetbyname_async.c
 317                    license:bsd-3
 318                    (license:non-copyleft "file://LICENSE") ; includes.h
 319                    license:openssl))))
 320
 321 (define-public nsd
 322   (package
 323     (name "nsd")
 324     (version "4.2.4")
 325     (source
 326      (origin
 327        (method url-fetch)
 328        (uri (string-append "https://www.nlnetlabs.nl/downloads/nsd/nsd-"
 329                            version ".tar.gz"))
 330        (sha256
 331         (base32 "0z7j3vwqqj0hh8n5irb2yqwzl45k4sn2wczbq1b1lqv5cxv6vgcy"))))
 332     (build-system gnu-build-system)
 333     (arguments
 334      `(#:configure-flags
 335        (list "--enable-pie"             ; fully benefit from ASLR
 336              "--enable-ratelimit"
 337              "--enable-recvmmsg"
 338              "--enable-relro-now"       ; protect GOT and .dtor areas
 339              "--disable-radix-tree"
 340              (string-append "--with-libevent="
 341                             (assoc-ref %build-inputs "libevent"))
 342              (string-append "--with-ssl="
 343                             (assoc-ref %build-inputs "openssl"))
 344              "--with-configdir=/etc"
 345              "--with-nsd_conf_file=/etc/nsd/nsd.conf"
 346              "--with-logfile=/var/log/nsd.log"
 347              "--with-pidfile=/var/db/nsd/nsd.pid"
 348              "--with-dbfile=/var/db/nsd/nsd.db"
 349              "--with-zonesdir=/etc/nsd"
 350              "--with-xfrdfile=/var/db/nsd/xfrd.state"
 351              "--with-zonelistfile=/var/db/nsd/zone.list")
 352        #:phases
 353        (modify-phases %standard-phases
 354          (add-before 'configure 'patch-installation-paths
 355            (lambda* (#:key outputs #:allow-other-keys)
 356              (let* ((out (assoc-ref outputs "out"))
 357                     (doc (string-append out "/share/doc/" ,name "-" ,version)))
 358                ;; The ‘make install’ target tries to create the parent
 359                ;; directories of run-time things like ‘pidfile’ above, and
 360                ;; useless empty directories like 'configdir'.  Remove such
 361                ;; '$(INSTALL)' lines and install the example configuration file
 362                ;; in an appropriate location.
 363                (substitute* "Makefile.in"
 364                  ((".*INSTALL.*\\$\\((config|pid|xfr|db)dir" command)
 365                   (string-append "#" command))
 366                  (("\\$\\(nsdconfigfile\\)\\.sample" file-name)
 367                   (string-append doc "/examples/" file-name)))
 368                #t))))
 369        #:tests? #f))                    ; no tests
 370     (inputs
 371      `(("libevent" ,libevent)
 372        ("openssl" ,openssl)))
 373     (home-page "https://www.nlnetlabs.nl/projects/nsd/about/")
 374     (synopsis "Authoritative DNS name server")
 375     (description "@dfn{NSD}, short for Name Server Daemon, is an authoritative
 376 name server for the Domain Name System (@dfn{DNS}).  It aims to be a fast and
 377 RFC-compliant nameserver.
 378
 379 NSD uses zone information compiled via @command{zonec} into a binary database
 380 file (@file{nsd.db}).  This allows fast startup of the name service daemon and
 381 allows syntax-structural errors in zone files to be flagged at compile time,
 382 before being made available to NSD service itself.  However, most traditional
 383 BIND-style zone files can be directly imported into NSD without modification.
 384
 385 The collection of programs and processes that make up NSD are designed so that
 386 the daemon itself runs as a non-privileged user and can be easily configured to
 387 run in a @code{chroot} jail, thus making any security flaws in NSD less likely
 388 to result in system-wide compromise.")
 389     (license (list license:bsd-3))))
 390
 391 (define-public unbound
 392   (package
 393     (name "unbound")
 394     (version "1.10.0")
 395     (source
 396      (origin
 397        (method url-fetch)
 398        (uri (string-append "https://www.unbound.net/downloads/unbound-"
 399                            version ".tar.gz"))
 400        (sha256
 401         (base32 "0mg9divpysr42sp0m693a70693dp8025v6c9dv1yabr4g1jlhbqm"))))
 402     (build-system gnu-build-system)
 403     (outputs '("out" "python"))
 404     (native-inputs
 405      `(("flex" ,flex)
 406        ("swig" ,swig)))
 407     (inputs
 408      `(("expat" ,expat)
 409        ("libevent" ,libevent)
 410        ("protobuf" ,protobuf)
 411        ("python-wrapper" ,python-wrapper)
 412        ("openssl" ,openssl)))
 413     (arguments
 414      `(#:configure-flags
 415        (list "--disable-static" ; save space and non-determinism in libunbound.a
 416              (string-append
 417               "--with-ssl=" (assoc-ref %build-inputs "openssl"))
 418              (string-append
 419               "--with-libevent=" (assoc-ref %build-inputs "libevent"))
 420              (string-append
 421               "--with-libexpat=" (assoc-ref %build-inputs "expat"))
 422              "--with-pythonmodule" "--with-pyunbound")
 423        #:phases
 424        (modify-phases %standard-phases
 425          (add-after 'configure 'fix-python-site-package-path
 426            ;; Move python modules into their own output.
 427            (lambda* (#:key outputs #:allow-other-keys)
 428              (let ((pyout (assoc-ref outputs "python"))
 429                    (ver ,(version-major+minor (package-version python))))
 430                (substitute* "Makefile"
 431                  (("^PYTHON_SITE_PKG=.*$")
 432                   (string-append
 433                    "PYTHON_SITE_PKG="
 434                    pyout "/lib/python-" ver "/site-packages\n"))))
 435              #t))
 436          (add-before 'check 'fix-missing-nss-for-tests
 437            ;; Unfortunately, the package's unittests involve some checks
 438            ;; looking up protocols and services which are not provided
 439            ;; by the minimalistic build environment, in particular,
 440            ;; /etc/protocols and /etc/services are missing.
 441            ;; Also, after plain substitution of protocol and service names
 442            ;; in the test data, the tests still fail because the
 443            ;; corresponding Resource Records have been signed by
 444            ;; RRSIG records.
 445            ;; The following LD_PRELOAD library overwrites the glibc
 446            ;; functions ‘get{proto,serv}byname’, ‘getprotobynumber’ and
 447            ;; ‘getservbyport’ providing the few records required for the
 448            ;; unit tests to pass.
 449            (lambda* (#:key inputs outputs #:allow-other-keys)
 450              (let* ((source (assoc-ref %build-inputs "source"))
 451                     (gcc (assoc-ref %build-inputs "gcc")))
 452                (call-with-output-file "/tmp/nss_preload.c"
 453                  (lambda (port)
 454                    (display "#include <stdlib.h>
 455 #include <string.h>
 456 #include <strings.h>
 457
 458 #include <netdb.h>
 459
 460 struct protoent *getprotobyname(const char *name) {
 461   struct protoent *p = malloc(sizeof(struct protoent));
 462   p->p_aliases = malloc(sizeof(char*));
 463   if (strcasecmp(name, \"tcp\") == 0) {
 464     p->p_name = \"tcp\";
 465     p->p_proto = 6;
 466     p->p_aliases[0] = \"TCP\";
 467   } else if (strcasecmp(name, \"udp\") == 0) {
 468     p->p_name = \"udp\";
 469     p->p_proto = 17;
 470     p->p_aliases[0] = \"UDP\";
 471   } else
 472     p = NULL;
 473   return p;
 474 }
 475
 476 struct protoent *getprotobynumber(int proto) {
 477   struct protoent *p = malloc(sizeof(struct protoent));
 478   p->p_aliases = malloc(sizeof(char*));
 479   switch(proto) {
 480   case 6:
 481     p->p_name = \"tcp\";
 482     p->p_proto = 6;
 483     p->p_aliases[0] = \"TCP\";
 484     break;
 485   case 17:
 486     p->p_name = \"udp\";
 487     p->p_proto = 17;
 488     p->p_aliases[0] = \"UDP\";
 489     break;
 490   default:
 491     p = NULL;
 492     break;
 493   }
 494   return p;
 495 }
 496
 497 struct servent *getservbyname(const char *name, const char *proto) {
 498   struct servent *s = malloc(sizeof(struct servent));
 499   char* buf = malloc((strlen(proto)+1)*sizeof(char));
 500   strcpy(buf, proto);
 501   s->s_aliases = malloc(sizeof(char*));
 502   s->s_aliases[0] = NULL;
 503   if (strcasecmp(name, \"domain\") == 0) {
 504     s->s_name = \"domain\";
 505     s->s_port = htons(53);
 506     s->s_proto = buf;
 507   } else
 508     s = NULL;
 509   return s;
 510 }
 511
 512 struct servent *getservbyport(int port, const char *proto) {
 513   char buf[32];
 514   struct servent *s = malloc(sizeof(struct servent));
 515   strcpy(buf, proto);
 516   s->s_aliases = malloc(sizeof(char*));
 517   s->s_aliases[0] = NULL;
 518   switch(port) {
 519   case 53:
 520     s->s_name = \"domain\";
 521     s->s_port = 53;
 522     s->s_proto = \"udp\";
 523     break;
 524   default:
 525     s = NULL;
 526     break;
 527   }
 528   return s;
 529 }" port)))
 530                (invoke (string-append gcc "/bin/gcc")
 531                        "-shared" "-fPIC" "-o" "/tmp/nss_preload.so"
 532                        "/tmp/nss_preload.c")
 533                ;; The preload library only affects the unittests.
 534                (substitute* "Makefile"
 535                  (("./unittest")
 536                   "LD_PRELOAD=/tmp/nss_preload.so ./unittest")))
 537              #t)))))
 538     (home-page "https://www.unbound.net")
 539     (synopsis "Validating, recursive, and caching DNS resolver")
 540     (description
 541      "Unbound is a recursive-only caching DNS server which can perform DNSSEC
 542 validation of results.  It implements only a minimal amount of authoritative
 543 service to prevent leakage to the root nameservers: forward lookups for
 544 localhost, reverse for @code{127.0.0.1} and @code{::1}, and NXDOMAIN for zones
 545 served by AS112.  Stub and forward zones are supported.")
 546     (license license:bsd-4)))
 547
 548 (define-public yadifa
 549   (package
 550     (name "yadifa")
 551     (version "2.3.9")
 552     (source
 553      (let ((build "8497"))
 554        (origin
 555          (method url-fetch)
 556          (uri
 557           (string-append "http://cdn.yadifa.eu/sites/default/files/releases/"
 558                          "yadifa-" version "-" build ".tar.gz"))
 559          (sha256
 560           (base32 "0xvyr91sfgzkpw6g3h893ldbwnki3w2472n56rr18w67qghs1sa5")))))
 561     (build-system gnu-build-system)
 562     (native-inputs
 563      `(("which" ,which)))
 564     (inputs
 565      `(("openssl" ,openssl)))
 566     (arguments
 567      `(#:phases
 568        (modify-phases %standard-phases
 569          (add-before 'configure 'omit-example-configurations
 570            (lambda _
 571              (substitute* "Makefile.in"
 572                ((" (etc|var)") ""))
 573              #t)))
 574        #:configure-flags
 575        (list "--sysconfdir=/etc"
 576              "--localstatedir=/var"
 577              "--disable-build-timestamp" ; build reproducibly
 578              "--enable-shared"
 579              "--disable-static"
 580              "--enable-acl"
 581              "--enable-caching"
 582              "--enable-ctrl"            ; enable remote control
 583              "--enable-nsec"
 584              "--enable-nsec3"
 585              "--enable-tsig")))
 586     (home-page "https://www.yadifa.eu/")
 587     (synopsis "Authoritative DNS name server")
 588     (description "YADIFA is an authoritative name server for the @dfn{Domain
 589 Name System} (DNS).  It aims for both higher performance and a smaller memory
 590 footprint than other implementations, while remaining fully RFC-compliant.
 591 YADIFA supports dynamic record updates and the @dfn{Domain Name System Security
 592 Extensions} (DNSSEC).")
 593     (license license:bsd-3)))
 594
 595 (define-public knot
 596   (package
 597     (name "knot")
 598     (version "2.9.4")
 599     (source
 600      (origin
 601        (method url-fetch)
 602        (uri (string-append "https://secure.nic.cz/files/knot-dns/"
 603                            "knot-" version ".tar.xz"))
 604        (sha256
 605         (base32 "00d5lkan1yfxphw8q1vrmfpmg8kykdaky8082m1s1ps03cxckwsp"))
 606        (modules '((guix build utils)))
 607        (snippet
 608         '(begin
 609            ;; Delete bundled libraries.
 610            (with-directory-excursion "src/contrib"
 611              (delete-file-recursively "lmdb"))
 612            #t))))
 613     (build-system gnu-build-system)
 614     (native-inputs
 615      `(("pkg-config" ,pkg-config)))
 616     (inputs
 617      `(("fstrm" ,fstrm)
 618        ("gnutls" ,gnutls)
 619        ("jansson" ,jansson)
 620        ("libcap-ng" ,libcap-ng)
 621        ("libedit" ,libedit)
 622        ("libidn" ,libidn)
 623        ("liburcu" ,liburcu)
 624        ("lmdb" ,lmdb)
 625        ("ncurses" ,ncurses)
 626        ("protobuf-c" ,protobuf-c)))
 627     (arguments
 628      `(#:phases
 629        (modify-phases %standard-phases
 630          (add-before 'configure 'disable-directory-pre-creation
 631            (lambda _
 632              ;; Don't install empty directories like ‘/etc’ outside the store.
 633              ;; This is needed even when using ‘make config_dir=... install’.
 634              (substitute* "src/Makefile.in" (("\\$\\(INSTALL\\) -d") "true"))
 635              #t))
 636          (replace 'install
 637            (lambda* (#:key outputs #:allow-other-keys)
 638              (let* ((out (assoc-ref outputs "out"))
 639                     (doc (string-append out "/share/doc/" ,name "-" ,version))
 640                     (etc (string-append doc "/examples/etc")))
 641                (invoke "make"
 642                        (string-append "config_dir=" etc)
 643                        "install")))))
 644        #:configure-flags
 645        (list "--sysconfdir=/etc"
 646              "--localstatedir=/var"
 647              "--enable-dnstap"          ; let tools read/write capture files
 648              "--with-module-dnstap=yes" ; detailed query capturing & logging
 649              (string-append "--with-bash-completions="
 650                             (assoc-ref %outputs "out")
 651                             "/etc/bash_completion.d"))))
 652     (home-page "https://www.knot-dns.cz/")
 653     (synopsis "Authoritative DNS name server")
 654     (description "Knot DNS is an authoritative name server for the @dfn{Domain
 655 Name System} (DNS), designed to meet the needs of root and @dfn{top-level
 656 domain} (TLD) name servers.  It is implemented as a threaded daemon and uses a
 657 number of programming techniques to improve speed.  For example, the responder
 658 is completely lock-free, resulting in a very high response rate.  Other features
 659 include automatic @dfn{DNS Security Extensions} (DNSSEC) signing, dynamic record
 660 synthesis, and on-the-fly re-configuration.")
 661     (license
 662      (list
 663       ;; src/contrib/{hat-trie,murmurhash3,openbsd},
 664       ;; src/dnssec/contrib/vpool.[ch], and parts of libtap/ are ‘MIT’ (expat).
 665       license:expat
 666       license:lgpl2.0+              ; parts of scr/contrib/ucw
 667       license:public-domain         ; src/contrib/fnv and possibly murmurhash3
 668       license:gpl3+))))             ; everything else
 669
 670 (define-public knot-resolver
 671   (package
 672     (name "knot-resolver")
 673     (version "4.3.0")
 674     (source (origin
 675               (method url-fetch)
 676               (uri (string-append "https://secure.nic.cz/files/knot-resolver/"
 677                                   "knot-resolver-" version ".tar.xz"))
 678               (sha256
 679                (base32
 680                 "09ffmqx79lv5psr433x4n946njgsn071b9b7161pcb9bmrqz380c"))))
 681     (build-system meson-build-system)
 682     (arguments
 683      '(#:configure-flags '("-Ddoc=enabled")
 684        #:phases
 685        (modify-phases %standard-phases
 686          (add-before 'configure 'disable-default-ta
 687            (lambda _
 688              ;;  Disable the default managed root TA, since we don't have
 689              ;;  write access to the keyfile and its directory in store.
 690              (substitute* "daemon/lua/sandbox.lua.in"
 691                (("^trust_anchors\\.add_file.*") ""))
 692              #t))
 693          (add-after 'build 'build-doc
 694            (lambda _
 695              (invoke "ninja" "doc")))
 696          (add-after 'install 'wrap-binary
 697            (lambda* (#:key inputs outputs #:allow-other-keys)
 698              (let* ((out (assoc-ref outputs "out"))
 699                     (lua-* (map cdr (filter
 700                                      (lambda (input)
 701                                        (string-prefix? "lua-" (car input)))
 702                                      inputs)))
 703                     (lua-path (lambda (p)
 704                                 (string-append p "/share/lua/5.1/?.lua")))
 705                     (lua-cpath (lambda (p)
 706                                  (string-append p "/lib/lua/5.1/?.so"))))
 707                (wrap-program (string-append out "/sbin/kresd")
 708                  `("LUA_PATH" ";" prefix ,(map lua-path lua-*))
 709                  `("LUA_CPATH" ";" prefix ,(map lua-cpath lua-*)))
 710                #t))))))
 711     (native-inputs
 712      `(("cmocka" ,cmocka)               ; for unit tests
 713        ("doxygen" ,doxygen)
 714        ("protobuf-c" ,protobuf-c)
 715        ("pkg-config" ,pkg-config)
 716        ("python-breathe" ,python-breathe)
 717        ("python-sphinx" ,python-sphinx)
 718        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)))
 719     (inputs
 720      `(("fstrm" ,fstrm)
 721        ("gnutls" ,gnutls)
 722        ("knot" ,knot)
 723        ("libuv" ,libuv)
 724        ("lmdb" ,lmdb)
 725        ("luajit" ,luajit)
 726        ;; TODO: Add optional lua modules: basexx, cqueues and psl.
 727        ("lua-bitop" ,lua5.1-bitop)
 728        ("lua-filesystem" ,lua5.1-filesystem)
 729        ("lua-sec" ,lua5.1-sec)
 730        ("lua-socket" ,lua5.1-socket)))
 731     (home-page "https://www.knot-resolver.cz/")
 732     (synopsis "Caching validating DNS resolver")
 733     (description
 734      "Knot Resolver is a caching full resolver implementation written in C and
 735 LuaJIT, both a resolver library and a daemon.")
 736     (license (list license:gpl3+
 737                    ;; Some 'contrib' files are under MIT, CC0 and LGPL2.
 738                    license:expat
 739                    license:cc0
 740                    license:lgpl2.0))))
 741
 742 (define-public ddclient
 743   (package
 744     (name "ddclient")
 745     (version "3.9.1")
 746     (source
 747      (origin
 748        (method git-fetch)
 749        (uri (git-reference
 750              (url "https://github.com/ddclient/ddclient.git")
 751              (commit (string-append "v" version))))
 752        (file-name (git-file-name name version))
 753        (sha256
 754         (base32 "0hf377g4j9r9sac75xp17nk2h58mazswz4vkg4g2gl2yyhvzq91w"))))
 755     (build-system trivial-build-system) ; no Makefile.PL
 756     (native-inputs
 757      `(("bash" ,bash)
 758        ("perl" ,perl)))
 759     (inputs
 760      `(("inetutils" ,inetutils)         ; logger
 761        ("net-tools" ,net-tools)
 762        ("perl-data-validate-ip" ,perl-data-validate-ip)
 763        ("perl-digest-sha1" ,perl-digest-sha1)
 764        ("perl-io-socket-ssl" ,perl-io-socket-ssl)))
 765     (arguments
 766      `(#:modules ((guix build utils)
 767                   (ice-9 match)
 768                   (srfi srfi-26))
 769        #:builder
 770        (begin
 771          (use-modules (guix build utils)
 772                       (ice-9 match)
 773                       (srfi srfi-26))
 774          (setenv "PATH" (string-append
 775                          (assoc-ref %build-inputs "bash") "/bin" ":"
 776                          (assoc-ref %build-inputs "perl") "/bin"))
 777
 778          ;; Copy the (read-only) source into the (writable) build directory.
 779          (copy-recursively (assoc-ref %build-inputs "source") ".")
 780
 781          ;; Install.
 782          (let* ((out (assoc-ref %outputs "out"))
 783                 (bin (string-append out "/bin")))
 784            (let ((file "ddclient"))
 785              (substitute* file
 786                (("/usr/bin/perl") (which "perl"))
 787                ;; Strictly use ‘/etc/ddclient/ddclient.conf’.
 788                (("\\$\\{program\\}\\.conf") "/etc/ddclient/ddclient.conf")
 789                (("\\$etc\\$program.conf") "/etc/ddclient/ddclient.conf")
 790                ;; Strictly use ‘/var/cache/ddclient/ddclient.cache’
 791                (("\\$cachedir\\$program\\.cache")
 792                 "/var/cache/ddclient/ddclient.cache"))
 793              (install-file file bin)
 794              (wrap-program (string-append bin "/" file)
 795                `("PATH" ":" =
 796                  ("$PATH"
 797                   ,@(map (lambda (input)
 798                            (match input
 799                                   ((name . store)
 800                                    (string-append store "/bin"))))
 801                          %build-inputs)))
 802                `("PERL5LIB" ":" =
 803                  ,(delete
 804                    ""
 805                    (map (match-lambda
 806                          (((? (cut string-prefix? "perl-" <>) name) . dir)
 807                           (string-append dir "/lib/perl5/site_perl"))
 808                          (_ ""))
 809                         %build-inputs)))))
 810            (for-each (cut install-file <> (string-append out
 811                                                          "/share/ddclient"))
 812                      (find-files "." "sample.*$"))))))
 813     (home-page "https://ddclient.net/")
 814     (synopsis "Address updating utility for dynamic DNS services")
 815     (description "This package provides a client to update dynamic IP
 816 addresses with several dynamic DNS service providers, such as
 817 @uref{https://www.dyndns.com/account/login.html,DynDNS.com}.
 818
 819 This makes it possible to use a fixed hostname (such as myhost.dyndns.org) to
 820 access a machine with a dynamic IP address.
 821
 822 The client supports both dynamic and (near) static services, as well as MX
 823 record and alternative name management.  It caches the address, and only
 824 attempts the update when it has changed.")
 825     (license license:gpl2+)))
 826
 827 (define-public hnsd
 828   ;; There have been no releases yet, hence this commit.
 829   (let ((revision "0")
 830         (commit "895d89c25d316d18df9d374fe78aae3902bc89fb"))
 831    (package
 832      (name "hnsd")
 833      (version (git-version "0.0" revision commit))
 834      (source (origin
 835                (method git-fetch)
 836                (uri (git-reference
 837                      (url "https://github.com/handshake-org/hnsd")
 838                      (commit commit)))
 839                (sha256
 840                 (base32
 841                  "0704y73sddn24jga9csw4gxyfb3pnrfnk0vdcph84n1h38490l16"))
 842                (file-name (git-file-name name version))
 843                (modules '((guix build utils)))
 844                (snippet
 845                 '(begin
 846                    ;; Delete the bundled copy of libuv.
 847                    (delete-file-recursively "uv")
 848                    (substitute* "configure.ac"
 849                      (("AC_CONFIG_SUBDIRS\\(\\[uv\\]\\)") ""))
 850                    (substitute* "Makefile.am"
 851                      (("SUBDIRS = uv") "\n")
 852                      (("\\$\\(top_builddir\\)/uv/libuv.la") "-luv")
 853
 854                      ;; Make sure the 'hnsd' binary is installed and
 855                      ;; dynamically-linked.
 856                      (("noinst_PROGRAMS") "bin_PROGRAMS")
 857                      (("hnsd_LDFLAGS = -static") ""))
 858
 859                    ;; This script tries to chdir to "uv" and doesn't do more
 860                    ;; than "autoreconf" so remove it.
 861                    (delete-file "autogen.sh")
 862                    #t))))
 863      (build-system gnu-build-system)
 864      (arguments
 865       '(#:configure-flags '("--disable-static"))) ;no need for libhsk.a
 866      (native-inputs
 867       `(("autoconf" ,autoconf)
 868         ("automake" ,automake)
 869         ("libtool" ,libtool)))
 870      (inputs
 871       `(("unbound" ,unbound)
 872         ("libuv" ,libuv)))
 873      (home-page "https://www.handshake.org/")
 874      (synopsis "Resolver daemon for the Handshake naming protocol")
 875      (description
 876       "@command{hnsd} is a @dfn{host name resolver} for the Handshake Naming
 877 System (HNS) peer-to-peer network.")
 878      (license license:expat))))
 879
 880 (define-public libmicrodns
 881   (package
 882     (name "libmicrodns")
 883     (version "0.1.2")
 884     (source (origin
 885               (method url-fetch)
 886               (uri (string-append "https://github.com/videolabs/libmicrodns/"
 887                                   "releases/download/" version "/microdns-"
 888                                   version ".tar.xz"))
 889               (sha256
 890                (base32
 891                 "0p4va18zxgmzcdwhlbg2mmjwswlbgqy4ay5vaxrw7cxmhsflnv36"))))
 892     (build-system meson-build-system)
 893     (home-page "https://github.com/videolabs/libmicrodns")
 894     (synopsis "Minimal mDNS resolver library")
 895     (description "@code{libmicrodns} provides a minimal implementation of a
 896 mDNS resolver as well as an announcer.  mDNS (Multicast Domain Name System) is
 897 a zero-config service that allows one to resolve host names to IP addresses in
 898 local networks.")
 899     (license license:lgpl2.1)))
 900
 901 (define-public public-suffix-list
 902   ;; Mozilla releases the official list here:
 903   ;;
 904   ;;   https://publicsuffix.org/list/public_suffix_list.dat
 905   ;;
 906   ;; However, Mozilla syncs that file from the GitHub repository periodically,
 907   ;; so its contents will change over time.  If you update this commit, please
 908   ;; make sure that the new commit refers to a list which is identical to the
 909   ;; officially published list available from the URL above.
 910   (let ((commit "9375b697baddb0827a5995c81bd3c75877a0b35d"))
 911     (package
 912       (name "public-suffix-list")
 913       (version (git-version "0" "1" commit))
 914       (source (origin
 915                 (method git-fetch)
 916                 (uri (git-reference
 917                       (url "https://github.com/publicsuffix/list.git")
 918                       (commit commit)))
 919                 (file-name (git-file-name name version))
 920                 (sha256
 921                  (base32
 922                   "1sm7pni01rnl4ldzi8z8nc4cbgq8nxda9gwc68v0s3ij7jd1jmik"))))
 923       (build-system trivial-build-system)
 924       (arguments
 925        `(#:modules ((guix build utils))
 926          #:builder
 927          (begin
 928            (use-modules (guix build utils))
 929            (let* ((out (assoc-ref %outputs "out"))
 930                   ;; Install to /share because that is where "read-only
 931                   ;; architecture-independent data files" should go (see:
 932                   ;; (standards) Directory Variables).  Include the version in
 933                   ;; the directory name so that if multiple versions are ever
 934                   ;; installed in the same profile, they will not conflict.
 935                   (destination (string-append
 936                                 out "/share/public-suffix-list-" ,version))
 937                   (source (assoc-ref %build-inputs "source")))
 938              (with-directory-excursion source
 939              (install-file "public_suffix_list.dat" destination)
 940              (install-file "LICENSE" destination))
 941              #t))))
 942       (home-page "https://publicsuffix.org/")
 943       (synopsis "Database of current and historical DNS suffixes")
 944       (description "This is the Public Suffix List maintained by Mozilla.  A
 945 \"public suffix\" is one under which Internet users can (or historically
 946 could) directly register names in the Domain Name System (DNS).  Some examples
 947 of public suffixes are .com, .co.uk and pvt.k12.ma.us.  This is a list of all
 948 known public suffixes.")
 949       (license license:mpl2.0))))
 950
 951 (define-public maradns
 952   (package
 953     (name "maradns")
 954     (version "3.5.0004")
 955     (source
 956      (origin
 957        (method url-fetch)
 958        (uri (string-append "https://maradns.samiam.org/download/"
 959                            (version-major+minor version) "/"
 960                            version "/maradns-" version ".tar.xz"))
 961        (sha256
 962         (base32
 963          "1zv0i6m4m05ay5zlhwq1h88hgjq2d81cjanpnb3gyhr0xhmjwk6a"))))
 964     (build-system gnu-build-system)
 965     (arguments
 966      `(#:tests? #f ; need to be root to run tests
 967        #:make-flags
 968        (list
 969         (string-append "CC="
 970                        (if ,(%current-target-system)
 971                            (string-append (assoc-ref %build-inputs "cross-gcc")
 972                                           "/bin/" ,(%current-target-system) "-gcc")
 973                            "gcc"))
 974         (string-append "PREFIX=" %output)
 975         (string-append "RPM_BUILD_ROOT=" %output))
 976        #:phases
 977        (modify-phases %standard-phases
 978          (replace 'configure
 979            (lambda* (#:key native-inputs target #:allow-other-keys)
 980              ;; make_32bit_tables generates a header file that is used during
 981              ;; compilation. Hence, during cross compilation, it should be
 982              ;; built for the host system.
 983              (when target
 984                (substitute* "rng/Makefile"
 985                  (("\\$\\(CC\\) -o make_32bit_tables")
 986                   (string-append (assoc-ref native-inputs "gcc")
 987                                  "/bin/gcc -o make_32bit_tables"))))
 988              (invoke "./configure")))
 989          (add-before 'install 'create-install-directories
 990            (lambda* (#:key outputs #:allow-other-keys)
 991              (let ((out (assoc-ref outputs "out")))
 992                (for-each (lambda (dir)
 993                            (mkdir-p (string-append out dir)))
 994                          (list "/bin" "/sbin" "/etc"
 995                                "/share/man/man1"
 996                                "/share/man/man5"
 997                                "/share/man/man8"))
 998                #t))))))
 999     (home-page "https://maradns.samiam.org")
1000     (synopsis "Small lightweight DNS server")
1001     (description "MaraDNS is a small and lightweight DNS server.  MaraDNS
1002 consists of a UDP-only authoritative DNS server for hosting domains, and a UDP
1003 and TCP-capable recursive DNS server for finding domains on the internet.")
1004     (license license:bsd-2)))
1005
1006 (define-public openresolv
1007   (package
1008     (name "openresolv")
1009     (version "3.10.0")
1010     (source (origin
1011               (method url-fetch)
1012               (uri (string-append "https://roy.marples.name/downloads/openresolv/"
1013                                   "openresolv-" version ".tar.xz"))
1014               (sha256
1015                (base32
1016                 "01ms6c087la4hk0f0w6n2vpsb7dg4kklah2rqyhz88p0vr9bqy20"))
1017               (patches
1018                (search-patches "openresolv-restartcmd-guix.patch"))))
1019     (build-system gnu-build-system)
1020     (arguments
1021      `(#:tests? #f                      ; No test suite
1022        #:configure-flags
1023        (list (string-append "--sysconfdir=/etc"))
1024        #:make-flags
1025        (list (string-append "SYSCONFDIR=/" (assoc-ref %outputs "out") "/etc"))))
1026     (home-page "https://roy.marples.name/projects/openresolv/")
1027     (synopsis "Resolvconf POSIX compliant implementation, a middleman for resolv.conf")
1028     (description "openresolv is an implementation of @command{resolvconf}, the
1029 middleman between the network configuration services and
1030 @file{/etc/resolv.conf}.  @command{resolvconf} itself is just a script that
1031 stores, removes and lists a full @file{resolv.conf} generated for the
1032 interface.  It then calls all the helper scripts it knows about so it can
1033 configure the real @file{/etc/resolv.conf} and optionally any local
1034 nameservers other than libc.")
1035     (license license:bsd-2)))