gnu/packages/dns.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
   3 ;;; Copyright © 2016 Mark H Weaver <mhw@netris.org>
   4 ;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
   5 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2016 John Darrington <jmd@gnu.org>
   7 ;;; Copyright © 2016 Nils Gillmann <ng0@n0.is>
   8 ;;; Copyright © 2016, 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
   9 ;;; Copyright © 2016 Marius Bakke <mbakke@fastmail.com>
  10 ;;; Copyright © 2017 Vasile Dumitrascu <va511e@yahoo.com>
  11 ;;; Copyright © 2017 Gregor Giesen <giesen@zaehlwerk.net>
  12 ;;; Copyright © 2018 Oleg Pykhalov <go.wigust@gmail.com>
  13 ;;;
  14 ;;; This file is part of GNU Guix.
  15 ;;;
  16 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  17 ;;; under the terms of the GNU General Public License as published by
  18 ;;; the Free Software Foundation; either version 3 of the License, or (at
  19 ;;; your option) any later version.
  20 ;;;
  21 ;;; GNU Guix is distributed in the hope that it will be useful, but
  22 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  23 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24 ;;; GNU General Public License for more details.
  25 ;;;
  26 ;;; You should have received a copy of the GNU General Public License
  27 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  28
  29 (define-module (gnu packages dns)
  30   #:use-module (gnu packages admin)
  31   #:use-module (gnu packages autotools)
  32   #:use-module (gnu packages base)
  33   #:use-module (gnu packages bash)
  34   #:use-module (gnu packages databases)
  35   #:use-module (gnu packages compression)
  36   #:use-module (gnu packages crypto)
  37   #:use-module (gnu packages datastructures)
  38   #:use-module (gnu packages flex)
  39   #:use-module (gnu packages glib)
  40   #:use-module (gnu packages groff)
  41   #:use-module (gnu packages groff)
  42   #:use-module (gnu packages libedit)
  43   #:use-module (gnu packages libevent)
  44   #:use-module (gnu packages libidn)
  45   #:use-module (gnu packages linux)
  46   #:use-module (gnu packages ncurses)
  47   #:use-module (gnu packages nettle)
  48   #:use-module (gnu packages networking)
  49   #:use-module (gnu packages perl)
  50   #:use-module (gnu packages pkg-config)
  51   #:use-module (gnu packages protobuf)
  52   #:use-module (gnu packages python)
  53   #:use-module (gnu packages swig)
  54   #:use-module (gnu packages tls)
  55   #:use-module (gnu packages web)
  56   #:use-module (gnu packages xml)
  57   #:use-module (gnu packages)
  58   #:use-module ((guix licenses) #:prefix license:)
  59   #:use-module (guix packages)
  60   #:use-module (guix download)
  61   #:use-module (guix utils)
  62   #:use-module (guix build-system gnu)
  63   #:use-module (guix build-system trivial))
  64
  65 (define-public dnsmasq
  66   (package
  67     (name "dnsmasq")
  68     (version "2.79")
  69     (source (origin
  70               (method url-fetch)
  71               (uri (string-append
  72                     "http://www.thekelleys.org.uk/dnsmasq/dnsmasq-"
  73                     version ".tar.xz"))
  74               (sha256
  75                (base32
  76                 "07w6cw706yyahwvbvslhkrbjf2ynv567cgy9pal8bz8lrbsp9bbq"))))
  77     (build-system gnu-build-system)
  78     (native-inputs
  79      `(("pkg-config" ,pkg-config)))
  80     (inputs
  81      `(("dbus" ,dbus)))
  82     (arguments
  83      `(#:phases
  84        (modify-phases %standard-phases (delete 'configure))
  85        #:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
  86                           "CC=gcc"
  87                           "COPTS=\"-DHAVE_DBUS\"")
  88        #:tests? #f))                    ; no ‘check’ target
  89     (home-page "http://www.thekelleys.org.uk/dnsmasq/doc.html")
  90     (synopsis "Small caching DNS proxy and DHCP/TFTP server")
  91     (description
  92      "Dnsmasq is a light-weight DNS forwarder and DHCP server.  It is designed
  93 to provide DNS and, optionally, DHCP to a small network.  It can serve the
  94 names of local machines which are not in the global DNS.  The DHCP server
  95 integrates with the DNS server and allows machines with DHCP-allocated
  96 addresses to appear in the DNS with names configured either on each host or in
  97 a central configuration file.  Dnsmasq supports static and dynamic DHCP leases
  98 and BOOTP/TFTP for network booting of diskless machines.")
  99     ;; Source files only say GPL2 and GPL3 are allowed.
 100     (license (list license:gpl2 license:gpl3))))
 101
 102 ;; 'bind' is the name of a built-in Guile procedure, which is why we choose a
 103 ;; different name here.
 104 (define-public isc-bind
 105   (package
 106     (name "bind")
 107     (version "9.12.2-P2")
 108     (source (origin
 109               (method url-fetch)
 110               (uri (string-append
 111                     "https://ftp.isc.org/isc/bind9/" version "/" name "-"
 112                     version ".tar.gz"))
 113               (sha256
 114                (base32
 115                 "0gk9vwqlbdmn10m21f2awvmiccfbadvcwi8zsgm91awbx4k7h0l7"))))
 116     (build-system gnu-build-system)
 117     (outputs `("out" "utils"))
 118     (inputs
 119      ;; it would be nice to add GeoIP and gssapi once there is package
 120      `(("libcap" ,libcap)
 121        ("libxml2" ,libxml2)
 122        ("openssl" ,openssl)
 123        ("p11-kit" ,p11-kit)))
 124     (native-inputs `(("perl" ,perl)
 125                      ("net-tools" ,net-tools)))
 126     (arguments
 127      `(#:configure-flags
 128        (list (string-append "--with-openssl="
 129                             (assoc-ref %build-inputs "openssl"))
 130              (string-append "--with-pkcs11="
 131                             (assoc-ref %build-inputs "p11-kit")))
 132        #:phases
 133        (modify-phases %standard-phases
 134          (add-after 'strip 'move-to-utils
 135            (lambda _
 136              (for-each
 137               (lambda (file)
 138                 (let ((target  (string-append (assoc-ref %outputs "utils") file))
 139                       (src  (string-append (assoc-ref %outputs "out") file)))
 140                   (mkdir-p (dirname target))
 141                   (link src target)
 142                   (delete-file src)))
 143               '("/bin/dig" "/bin/delv" "/bin/nslookup" "/bin/host" "/bin/nsupdate"
 144                 "/share/man/man1/dig.1"
 145                 "/share/man/man1/host.1"
 146                 "/share/man/man1/nslookup.1"
 147                 "/share/man/man1/nsupdate.1"))))
 148          ;; When and if guix provides user namespaces for the build process,
 149          ;; then the following can be uncommented and the subsequent "force-test"
 150          ;; will not be necessary.
 151          ;;
 152          ;;   (add-before 'check 'set-up-loopback
 153          ;;     (lambda _
 154          ;;          (system "bin/tests/system/ifconfig.sh up")))
 155          (replace 'check
 156            (lambda _
 157              (invoke "make" "force-test")
 158              #t)))))
 159     (synopsis "An implementation of the Domain Name System")
 160     (description "BIND is an implementation of the @dfn{Domain Name System}
 161 (DNS) protocols for the Internet.  It is a reference implementation of those
 162 protocols, but it is also production-grade software, suitable for use in
 163 high-volume and high-reliability applications. The name BIND stands for
 164 \"Berkeley Internet Name Domain\", because the software originated in the early
 165 1980s at the University of California at Berkeley.")
 166     (home-page "https://www.isc.org/downloads/bind")
 167     (license (list license:mpl2.0))))
 168
 169 (define-public dnscrypt-proxy
 170   (package
 171     (name "dnscrypt-proxy")
 172     (version "1.9.5")
 173     (source (origin
 174               (method url-fetch)
 175               (uri (string-append
 176                     "https://download.dnscrypt.org/dnscrypt-proxy/"
 177                     "dnscrypt-proxy-" version ".tar.bz2"))
 178               (sha256
 179                (base32
 180                 "1dhvklr4dg2vlw108n11xbamacaryyg3dbrg629b76lp7685p7z8"))
 181               (modules '((guix build utils)))
 182               (snippet
 183                ;; Delete bundled libltdl. XXX: This package also bundles
 184                ;; a modified libevent that cannot currently be removed.
 185                '(begin
 186                   (delete-file-recursively "libltdl")
 187                   #t))))
 188     (build-system gnu-build-system)
 189     (arguments
 190      `(#:phases
 191        (modify-phases %standard-phases
 192          (add-after 'unpack 'autoreconf
 193            (lambda _
 194              ;; Re-generate build files due to unbundling ltdl.
 195              ;; TODO: Prevent generating new libltdl and building it.
 196              ;; The system version is still favored and referenced.
 197              (invoke "autoreconf" "-vif"))))))
 198     (native-inputs
 199      `(("pkg-config" ,pkg-config)
 200        ("automake" ,automake)
 201        ("autoconf" ,autoconf)
 202        ("libtool" ,libtool)))
 203     (inputs
 204      `(("libltdl" ,libltdl)
 205        ("libsodium" ,libsodium)))
 206     (home-page "https://www.dnscrypt.org/")
 207     (synopsis "Securely send DNS requests to a remote server")
 208     (description
 209      "@command{dnscrypt-proxy} is a tool for securing communications
 210 between a client and a DNS resolver.  It verifies that responses you get
 211 from a DNS provider was actually sent by that provider, and haven't been
 212 tampered with.  For optimal performance it is recommended to use this as
 213 a forwarder for a caching DNS resolver such as @command{dnsmasq}, but it
 214 can also be used as a normal DNS \"server\".  A list of public dnscrypt
 215 servers is included, and an up-to-date version is available at
 216 @url{https://download.dnscrypt.org/dnscrypt-proxy/dnscrypt-resolvers.csv}.")
 217     (license (list license:isc
 218                    ;; Libevent and src/ext/queue.h is 3-clause BSD.
 219                    license:bsd-3))))
 220
 221 (define-public dnscrypt-wrapper
 222   (package
 223     (name "dnscrypt-wrapper")
 224     (version "0.2.2")
 225     (source (origin
 226               (method url-fetch)
 227               (uri (string-append
 228                     "https://github.com/cofyc/dnscrypt-wrapper/releases"
 229                     "/download/v" version "/" name "-v" version ".tar.bz2"))
 230               (sha256
 231                (base32
 232                 "1vhg4g0r687f51wcdn7z9w1hxapazx6vyh5rsr8wa48sljzd583g"))))
 233     (build-system gnu-build-system)
 234     (arguments
 235      `(#:make-flags '("CC=gcc")
 236        ;; TODO: Tests require ruby-cucumber and ruby-aruba.
 237        #:tests? #f
 238        #:phases
 239        (modify-phases %standard-phases
 240          (add-after 'unpack 'create-configure
 241            (lambda _
 242              (invoke "make" "configure"))))))
 243     (native-inputs
 244      `(("autoconf" ,autoconf)))
 245     (inputs
 246      `(("libevent" ,libevent)
 247        ("libsodium" ,libsodium)))
 248     (home-page "https://github.com/Cofyc/dnscrypt-wrapper")
 249     (synopsis "Server-side dnscrypt proxy")
 250     (description
 251      "@command{dnscrypt-wrapper} is a tool to expose a name server over
 252 the @code{dnscrypt} protocol.  It can be used as an endpoint for the
 253 @command{dnscrypt-proxy} client to securely tunnel DNS requests between
 254 the two.")
 255     (license (list license:isc
 256                    ;; Bundled argparse is MIT. TODO: package and unbundle.
 257                    license:expat
 258                    ;; dns-protocol.h and rfc1035.{c,h} is gpl2 or gpl3 (either).
 259                    license:gpl2
 260                    license:gpl3))))
 261
 262 (define-public libasr
 263   (package
 264     (name "libasr")
 265     (version "201602131606")
 266     (source
 267      (origin
 268        (method url-fetch)
 269        (uri (string-append "https://www.opensmtpd.org/archives/"
 270                            name "-" version ".tar.gz"))
 271        (sha256
 272         (base32
 273          "18kdmbjsxrfai16d66qslp48b1zf7gr8him2jj5dcqgbsl44ls75"))))
 274     (build-system gnu-build-system)
 275     (native-inputs
 276      `(("autoconf" ,autoconf)
 277        ("automake" ,automake)
 278        ("pkg-config" ,pkg-config)
 279        ("groff" ,groff)))
 280     (home-page "https://www.opensmtpd.org")
 281     (synopsis "Asynchronous resolver library by the OpenBSD project")
 282     (description
 283      "libasr is a free, simple and portable asynchronous resolver library.
 284 It allows to run DNS queries and perform hostname resolutions in a fully
 285 asynchronous fashion.")
 286     (license (list license:isc
 287                    license:bsd-2 ; last part of getrrsetbyname_async.c
 288                    license:bsd-3
 289                    (license:non-copyleft "file://LICENSE") ; includes.h
 290                    license:openssl))))
 291
 292 (define-public nsd
 293   (package
 294     (name "nsd")
 295     (version "4.1.25")
 296     (source
 297      (origin
 298        (method url-fetch)
 299        (uri (string-append "https://www.nlnetlabs.nl/downloads/nsd/nsd-"
 300                            version ".tar.gz"))
 301        (sha256
 302         (base32
 303          "0zyzjd3wmq258jiry62ci1z23qfd0rc5ggnpmybc60xvpddgynwg"))))
 304     (build-system gnu-build-system)
 305     (arguments
 306      `(#:configure-flags
 307        (list "--enable-pie"             ; fully benefit from ASLR
 308              "--enable-ratelimit"
 309              "--enable-recvmmsg"
 310              "--enable-relro-now"       ; protect GOT and .dtor areas
 311              "--disable-radix-tree"
 312              (string-append "--with-libevent="
 313                             (assoc-ref %build-inputs "libevent"))
 314              (string-append "--with-ssl="
 315                             (assoc-ref %build-inputs "openssl"))
 316              "--with-configdir=/etc"
 317              "--with-nsd_conf_file=/etc/nsd/nsd.conf"
 318              "--with-logfile=/var/log/nsd.log"
 319              "--with-pidfile=/var/db/nsd/nsd.pid"
 320              "--with-dbfile=/var/db/nsd/nsd.db"
 321              "--with-zonesdir=/etc/nsd"
 322              "--with-xfrdfile=/var/db/nsd/xfrd.state"
 323              "--with-zonelistfile=/var/db/nsd/zone.list")
 324        #:phases
 325        (modify-phases %standard-phases
 326          (add-before 'configure 'patch-installation-paths
 327            (lambda* (#:key outputs #:allow-other-keys)
 328              (let* ((out (assoc-ref outputs "out"))
 329                     (doc (string-append out "/share/doc/" ,name "-" ,version)))
 330                ;; The ‘make install’ target tries to create the parent
 331                ;; directories of run-time things like ‘pidfile’ above, and
 332                ;; useless empty directories like 'configdir'.  Remove such
 333                ;; '$(INSTALL)' lines and install the example configuration file
 334                ;; in an appropriate location.
 335                (substitute* "Makefile.in"
 336                  ((".*INSTALL.*\\$\\((config|pid|xfr|db)dir" command)
 337                   (string-append "#" command))
 338                  (("\\$\\(nsdconfigfile\\)\\.sample" file-name)
 339                   (string-append doc "/examples/" file-name)))
 340                #t))))
 341        #:tests? #f))                    ; no tests
 342     (inputs
 343      `(("libevent" ,libevent)
 344        ("openssl" ,openssl)))
 345     (home-page "https://www.nlnetlabs.nl/projects/nsd/about/")
 346     (synopsis "Authoritative DNS name server")
 347     (description "@dfn{NSD}, short for Name Server Daemon, is an authoritative
 348 name server for the Domain Name System (@dfn{DNS}).  It aims to be a fast and
 349 RFC-compliant nameserver.
 350
 351 NSD uses zone information compiled via @command{zonec} into a binary database
 352 file (@file{nsd.db}).  This allows fast startup of the name service daemon and
 353 allows syntax-structural errors in zone files to be flagged at compile time,
 354 before being made available to NSD service itself.  However, most traditional
 355 BIND-style zone files can be directly imported into NSD without modification.
 356
 357 The collection of programs and processes that make up NSD are designed so that
 358 the daemon itself runs as a non-privileged user and can be easily configured to
 359 run in a @code{chroot} jail, thus making any security flaws in NSD less likely
 360 to result in system-wide compromise.")
 361     (license (list license:bsd-3))))
 362
 363 (define-public unbound
 364   (package
 365     (name "unbound")
 366     (version "1.8.1")
 367     (source
 368      (origin
 369        (method url-fetch)
 370        (uri (string-append "https://www.unbound.net/downloads/unbound-"
 371                            version ".tar.gz"))
 372        (sha256
 373         (base32
 374          "0p9w6spar5dfi7fplxjcq4394wldabaws0ns30cqq6sxqfwv6qn3"))))
 375     (build-system gnu-build-system)
 376     (outputs '("out" "python"))
 377     (native-inputs
 378      `(("flex" ,flex)
 379        ("swig" ,swig)))
 380     (inputs
 381      `(("expat" ,expat)
 382        ("libevent" ,libevent)
 383        ("protobuf" ,protobuf)
 384        ("python" ,python-3)
 385        ("python-wrapper" ,python-wrapper)
 386        ("openssl" ,openssl)))
 387     (arguments
 388      `(#:configure-flags
 389        (list "--disable-static" ;save space and non-determinism in libunbound.a
 390              (string-append
 391               "--with-ssl=" (assoc-ref %build-inputs "openssl"))
 392              (string-append
 393               "--with-libevent=" (assoc-ref %build-inputs "libevent"))
 394              (string-append
 395               "--with-libexpat=" (assoc-ref %build-inputs "expat"))
 396              "--with-pythonmodule" "--with-pyunbound")
 397        #:phases
 398        (modify-phases %standard-phases
 399          (add-after 'configure 'fix-python-site-package-path
 400            ;; Move python modules into their own output.
 401            (lambda* (#:key outputs #:allow-other-keys)
 402              (let ((pyout (assoc-ref outputs "python"))
 403                    (ver ,(version-major+minor (package-version python))))
 404                (substitute* "Makefile"
 405                  (("^PYTHON_SITE_PKG=.*$")
 406                   (string-append
 407                    "PYTHON_SITE_PKG="
 408                    pyout "/lib/python-" ver "/site-packages\n"))))
 409              #t))
 410          (add-before 'check 'fix-missing-nss-for-tests
 411            ;; Unfortunately, the package's unittests involve some checks
 412            ;; looking up protocols and services which are not provided
 413            ;; by the minimalistic build environment, in particular,
 414            ;; /etc/protocols and /etc/services are missing.
 415            ;; Also, after plain substitution of protocol and service names
 416            ;; in the test data, the tests still fail because the
 417            ;; corresponding Resource Records have been signed by
 418            ;; RRSIG records.
 419            ;; The following LD_PRELOAD library overwrites the glibc
 420            ;; functions ‘get{proto,serv}byname’, ‘getprotobynumber’ and
 421            ;; ‘getservbyport’ providing the few records required for the
 422            ;; unit tests to pass.
 423            (lambda* (#:key inputs outputs #:allow-other-keys)
 424              (let* ((source (assoc-ref %build-inputs "source"))
 425                     (gcc (assoc-ref %build-inputs "gcc")))
 426                (call-with-output-file "/tmp/nss_preload.c"
 427                  (lambda (port)
 428                    (display "#include <stdlib.h>
 429 #include <string.h>
 430 #include <strings.h>
 431
 432 #include <netdb.h>
 433
 434 struct protoent *getprotobyname(const char *name) {
 435   struct protoent *p = malloc(sizeof(struct protoent));
 436   p->p_aliases = malloc(sizeof(char*));
 437   if (strcasecmp(name, \"tcp\") == 0) {
 438     p->p_name = \"tcp\";
 439     p->p_proto = 6;
 440     p->p_aliases[0] = \"TCP\";
 441   } else if (strcasecmp(name, \"udp\") == 0) {
 442     p->p_name = \"udp\";
 443     p->p_proto = 17;
 444     p->p_aliases[0] = \"UDP\";
 445   } else
 446     p = NULL;
 447   return p;
 448 }
 449
 450 struct protoent *getprotobynumber(int proto) {
 451   struct protoent *p = malloc(sizeof(struct protoent));
 452   p->p_aliases = malloc(sizeof(char*));
 453   switch(proto) {
 454   case 6:
 455     p->p_name = \"tcp\";
 456     p->p_proto = 6;
 457     p->p_aliases[0] = \"TCP\";
 458     break;
 459   case 17:
 460     p->p_name = \"udp\";
 461     p->p_proto = 17;
 462     p->p_aliases[0] = \"UDP\";
 463     break;
 464   default:
 465     p = NULL;
 466     break;
 467   }
 468   return p;
 469 }
 470
 471 struct servent *getservbyname(const char *name, const char *proto) {
 472   struct servent *s = malloc(sizeof(struct servent));
 473   char* buf = malloc((strlen(proto)+1)*sizeof(char));
 474   strcpy(buf, proto);
 475   s->s_aliases = malloc(sizeof(char*));
 476   s->s_aliases[0] = NULL;
 477   if (strcasecmp(name, \"domain\") == 0) {
 478     s->s_name = \"domain\";
 479     s->s_port = htons(53);
 480     s->s_proto = buf;
 481   } else
 482     s = NULL;
 483   return s;
 484 }
 485
 486 struct servent *getservbyport(int port, const char *proto) {
 487   char buf[32];
 488   struct servent *s = malloc(sizeof(struct servent));
 489   strcpy(buf, proto);
 490   s->s_aliases = malloc(sizeof(char*));
 491   s->s_aliases[0] = NULL;
 492   switch(port) {
 493   case 53:
 494     s->s_name = \"domain\";
 495     s->s_port = 53;
 496     s->s_proto = \"udp\";
 497     break;
 498   default:
 499     s = NULL;
 500     break;
 501   }
 502   return s;
 503 }" port)))
 504                (invoke (string-append gcc "/bin/gcc")
 505                        "-shared" "-fPIC" "-o" "/tmp/nss_preload.so"
 506                        "/tmp/nss_preload.c")
 507                ;; The preload library only affects the unittests.
 508                (substitute* "Makefile"
 509                  (("./unittest")
 510                   "LD_PRELOAD=/tmp/nss_preload.so ./unittest")))
 511              #t)))))
 512     (home-page "https://www.unbound.net")
 513     (synopsis "Validating, recursive, and caching DNS resolver")
 514     (description
 515      "Unbound is a recursive-only caching DNS server which can perform DNSSEC
 516 validation of results.  It implements only a minimal amount of authoritative
 517 service to prevent leakage to the root nameservers: forward lookups for
 518 localhost, reverse for @code{127.0.0.1} and @code{::1}, and NXDOMAIN for zones
 519 served by AS112.  Stub and forward zones are supported.")
 520     (license license:bsd-4)))
 521
 522 (define-public yadifa
 523   (package
 524     (name "yadifa")
 525     (version "2.3.8")
 526     (source
 527      (let ((build "7713"))
 528        (origin
 529          (method url-fetch)
 530          (uri
 531           (string-append "http://cdn.yadifa.eu/sites/default/files/releases/"
 532                          name "-" version "-" build ".tar.gz"))
 533          (sha256
 534           (base32 "15xhzg4crjcxascwpz6y8qpqcgypzv2p9bspdskp4nx1x1y4316c")))))
 535     (build-system gnu-build-system)
 536     (native-inputs
 537      `(("which" ,which)))
 538     (inputs
 539      `(("openssl" ,openssl)))
 540     (arguments
 541      `(#:phases
 542        (modify-phases %standard-phases
 543          (add-before 'configure 'omit-example-configurations
 544            (lambda _
 545              (substitute* "Makefile.in"
 546                ((" (etc|var)") ""))
 547              #t)))
 548        #:configure-flags
 549        (list "--sysconfdir=/etc"
 550              "--localstatedir=/var"
 551              "--disable-build-timestamp" ; build reproducibly
 552              "--enable-shared"
 553              "--disable-static"
 554              "--enable-acl"
 555              "--enable-caching"
 556              "--enable-ctrl"            ; enable remote control
 557              "--enable-nsec"
 558              "--enable-nsec3"
 559              "--enable-tsig")))
 560     (home-page "http://www.yadifa.eu/")
 561     (synopsis "Authoritative DNS name server")
 562     (description "YADIFA is an authoritative name server for the @dfn{Domain
 563 Name System} (DNS).  It aims for both higher performance and a smaller memory
 564 footprint than other implementations, while remaining fully RFC-compliant.
 565 YADIFA supports dynamic record updates and the @dfn{Domain Name System Security
 566 Extensions} (DNSSEC).")
 567     (license license:bsd-3)))
 568
 569 (define-public knot
 570   (package
 571     (name "knot")
 572     (version "2.7.3")
 573     (source (origin
 574               (method url-fetch)
 575               (uri (string-append "https://secure.nic.cz/files/knot-dns/"
 576                                   name "-" version ".tar.xz"))
 577               (sha256
 578                (base32
 579                 "1pwjcv7hzhqawisibybma160k77a6f1v94xw6ay9c7j49vrw05w7"))
 580               (modules '((guix build utils)))
 581               (snippet
 582                '(begin
 583                   ;; Delete bundled libraries.
 584                   (with-directory-excursion "src/contrib"
 585                     (delete-file-recursively "lmdb"))
 586                   #t))))
 587     (build-system gnu-build-system)
 588     (native-inputs
 589      `(("pkg-config" ,pkg-config)))
 590     (inputs
 591      `(("fstrm" ,fstrm)
 592        ("gnutls" ,gnutls)
 593        ("jansson" ,jansson)
 594        ("libcap-ng" ,libcap-ng)
 595        ("libedit" ,libedit)
 596        ("libidn" ,libidn)
 597        ("liburcu" ,liburcu)
 598        ("lmdb" ,lmdb)
 599        ("ncurses" ,ncurses)
 600        ("protobuf-c" ,protobuf-c)))
 601     (arguments
 602      `(#:phases
 603        (modify-phases %standard-phases
 604          (add-before 'configure 'disable-directory-pre-creation
 605            (lambda _
 606              ;; Don't install empty directories like ‘/etc’ outside the store.
 607              ;; This is needed even when using ‘make config_dir=... install’.
 608              (substitute* "src/Makefile.in" (("\\$\\(INSTALL\\) -d") "true"))
 609              #t))
 610          (replace 'install
 611            (lambda* (#:key outputs #:allow-other-keys)
 612              (let* ((out (assoc-ref outputs "out"))
 613                     (doc (string-append out "/share/doc/" ,name "-" ,version))
 614                     (etc (string-append doc "/examples/etc")))
 615                (invoke "make"
 616                        (string-append "config_dir=" etc)
 617                        "install")))))
 618        #:configure-flags
 619        (list "--sysconfdir=/etc"
 620              "--localstatedir=/var"
 621              "--enable-dnstap"          ; let tools read/write capture files
 622              "--with-module-dnstap=yes" ; detailed query capturing & logging
 623              (string-append "--with-bash-completions="
 624                             (assoc-ref %outputs "out")
 625                             "/etc/bash_completion.d"))))
 626     (home-page "https://www.knot-dns.cz/")
 627     (synopsis "Authoritative DNS name server")
 628     (description "Knot DNS is an authoritative name server for the @dfn{Domain
 629 Name System} (DNS), designed to meet the needs of root and @dfn{top-level
 630 domain} (TLD) name servers.  It is implemented as a threaded daemon and uses a
 631 number of programming techniques to improve speed.  For example, the responder
 632 is completely lock-free, resulting in a very high response rate.  Other features
 633 include automatic @dfn{DNS Security Extensions} (DNSSEC) signing, dynamic record
 634 synthesis, and on-the-fly re-configuration.")
 635     (license
 636      (list
 637       ;; src/contrib/{hat-trie,murmurhash3,openbsd},
 638       ;; src/dnssec/contrib/vpool.[ch], and parts of libtap/ are ‘MIT’ (expat).
 639       license:expat
 640       license:lgpl2.0+              ; parts of scr/contrib/ucw
 641       license:public-domain         ; src/contrib/fnv and possibly murmurhash3
 642       license:gpl3+))))             ; everything else
 643
 644 (define-public ddclient
 645   (package
 646     (name "ddclient")
 647     (version "3.9.0")
 648     (source (origin
 649               (method url-fetch)
 650               (uri (string-append "mirror://sourceforge/ddclient/ddclient/ddclient-"
 651                                   version "/ddclient-" version ".tar.gz"))
 652               (sha256
 653                (base32
 654                 "0fwyhab8yga2yi1kdfkbqxa83wxhwpagmj1w1mwkg2iffh1fjjlw"))))
 655     (build-system trivial-build-system) ; no Makefile.PL
 656     (native-inputs
 657      `(("bash" ,bash)
 658        ("gzip" ,gzip)
 659        ("perl" ,perl)
 660        ("tar" ,tar)))
 661     (inputs
 662      `(("inetutils" ,inetutils)         ; logger
 663        ("net-tools" ,net-tools)
 664        ("perl-data-validate-ip" ,perl-data-validate-ip)
 665        ("perl-digest-sha1" ,perl-digest-sha1)
 666        ("perl-io-socket-ssl" ,perl-io-socket-ssl)))
 667     (arguments
 668      `(#:modules ((guix build utils)
 669                   (ice-9 match)
 670                   (srfi srfi-26))
 671        #:builder
 672        (begin
 673          (use-modules (guix build utils)
 674                       (ice-9 match)
 675                       (srfi srfi-26))
 676          ;; bootstrap
 677          (setenv "PATH" (string-append
 678                          (assoc-ref %build-inputs "bash") "/bin" ":"
 679                          (assoc-ref %build-inputs "tar") "/bin" ":"
 680                          (assoc-ref %build-inputs "gzip") "/bin" ":"
 681                          (assoc-ref %build-inputs "perl") "/bin"))
 682          ;; extract source
 683          (invoke "tar" "xvf" (assoc-ref %build-inputs "source"))
 684          ;; package
 685          (with-directory-excursion (string-append ,name "-" ,version)
 686            (let* ((out (assoc-ref %outputs "out"))
 687                   (bin (string-append out "/bin")))
 688              (let ((file "ddclient"))
 689                (substitute* file
 690                  (("/usr/bin/perl") (which "perl"))
 691                  ;; Strictly use ‘/etc/ddclient/ddclient.conf’.
 692                  (("\\$\\{program\\}\\.conf") "/etc/ddclient/ddclient.conf")
 693                  (("\\$etc\\$program.conf") "/etc/ddclient/ddclient.conf")
 694                  ;; Strictly use ‘/var/cache/ddclient/ddclient.cache’
 695                  (("\\$cachedir\\$program\\.cache")
 696                   "/var/cache/ddclient/ddclient.cache"))
 697                (install-file file bin)
 698                (wrap-program (string-append bin "/" file)
 699                  `("PATH" ":" =
 700                    ("$PATH"
 701                     ,@(map (lambda (input)
 702                              (match input
 703                                ((name . store)
 704                                 (string-append store "/bin"))))
 705                            %build-inputs)))
 706                  `("PERL5LIB" ":" =
 707                    ,(delete
 708                      ""
 709                      (map (match-lambda
 710                             (((? (cut string-prefix? "perl-" <>) name) . dir)
 711                              (string-append dir "/lib/perl5/site_perl"))
 712                             (_ ""))
 713                           %build-inputs)))))
 714              (for-each (cut install-file <> (string-append out
 715                                                            "/share/ddclient"))
 716                        (find-files "." "sample.*$")))))))
 717     (home-page "https://sourceforge.net/projects/ddclient/")
 718     (synopsis "Address updating utility for dynamic DNS services")
 719     (description "This package provides a client to update dynamic IP
 720 addresses with several dynamic DNS service providers, such as
 721 @uref{https://www.dyndns.com/account/login.html,DynDNS.com}.
 722
 723 This makes it possible to use a fixed hostname (such as myhost.dyndns.org) to
 724 access a machine with a dynamic IP address.
 725
 726 The client supports both dynamic and (near) static services, as well as MX
 727 record and alternative name management.  It caches the address, and only
 728 attempts the update when it has changed.")
 729     (license license:gpl2+)))