gnu/packages/dns.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
   3 ;;; Copyright © 2016 Mark H Weaver <mhw@netris.org>
   4 ;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
   5 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2016 John Darrington <jmd@gnu.org>
   7 ;;; Copyright © 2016 Nikita <nikita@n0.is>
   8 ;;; Copyright © 2016, 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
   9 ;;; Copyright © 2016, 2020 Marius Bakke <mbakke@fastmail.com>
  10 ;;; Copyright © 2017 Vasile Dumitrascu <va511e@yahoo.com>
  11 ;;; Copyright © 2017 Gregor Giesen <giesen@zaehlwerk.net>
  12 ;;; Copyright © 2018 Oleg Pykhalov <go.wigust@gmail.com>
  13 ;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
  14 ;;; Copyright © 2019 Chris Marusich <cmmarusich@gmail.com>
  15 ;;; Copyright © 2019 Rutger Helling <rhelling@mykolab.com>
  16 ;;; Copyright © 2020 Pierre Langlois <pierre.langlois@gmx.com>
  17 ;;; Copyright © 2020 Arun Isaac <arunisaac@systemreboot.net>
  18 ;;; Copyright © 2020 Leo Famulari <leo@famulari.name>
  19 ;;; Copyright © 2020 Brice Waegeneire <brice@waegenei.re>
  20 ;;;
  21 ;;; This file is part of GNU Guix.
  22 ;;;
  23 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  24 ;;; under the terms of the GNU General Public License as published by
  25 ;;; the Free Software Foundation; either version 3 of the License, or (at
  26 ;;; your option) any later version.
  27 ;;;
  28 ;;; GNU Guix is distributed in the hope that it will be useful, but
  29 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  30 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  31 ;;; GNU General Public License for more details.
  32 ;;;
  33 ;;; You should have received a copy of the GNU General Public License
  34 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  35
  36 (define-module (gnu packages dns)
  37   #:use-module (gnu packages admin)
  38   #:use-module (gnu packages autotools)
  39   #:use-module (gnu packages base)
  40   #:use-module (gnu packages bash)
  41   #:use-module (gnu packages check)
  42   #:use-module (gnu packages databases)
  43   #:use-module (gnu packages documentation)
  44   #:use-module (gnu packages compression)
  45   #:use-module (gnu packages crypto)
  46   #:use-module (gnu packages datastructures)
  47   #:use-module (gnu packages flex)
  48   #:use-module (gnu packages gcc)
  49   #:use-module (gnu packages glib)
  50   #:use-module (gnu packages groff)
  51   #:use-module (gnu packages groff)
  52   #:use-module (gnu packages libedit)
  53   #:use-module (gnu packages libevent)
  54   #:use-module (gnu packages libidn)
  55   #:use-module (gnu packages linux)
  56   #:use-module (gnu packages lua)
  57   #:use-module (gnu packages ncurses)
  58   #:use-module (gnu packages nettle)
  59   #:use-module (gnu packages networking)
  60   #:use-module (gnu packages perl)
  61   #:use-module (gnu packages pkg-config)
  62   #:use-module (gnu packages protobuf)
  63   #:use-module (gnu packages python)
  64   #:use-module (gnu packages python-xyz)
  65   #:use-module (gnu packages sphinx)
  66   #:use-module (gnu packages swig)
  67   #:use-module (gnu packages tls)
  68   #:use-module (gnu packages web)
  69   #:use-module (gnu packages xml)
  70   #:use-module (gnu packages)
  71   #:use-module ((guix licenses) #:prefix license:)
  72   #:use-module (guix packages)
  73   #:use-module (guix download)
  74   #:use-module (guix git-download)
  75   #:use-module (guix utils)
  76   #:use-module (guix build-system gnu)
  77   #:use-module (guix build-system meson)
  78   #:use-module (guix build-system trivial))
  79
  80 (define-public dnsmasq
  81   (package
  82     (name "dnsmasq")
  83     (version "2.81")
  84     (source (origin
  85               (method url-fetch)
  86               (uri (string-append
  87                     "http://www.thekelleys.org.uk/dnsmasq/dnsmasq-"
  88                     version ".tar.xz"))
  89               (sha256
  90                (base32
  91                 "1yzq6anwgr5rlnwydpszb51cyhp2vjq29b24ck19flbwac1sk73l"))))
  92     (build-system gnu-build-system)
  93     (native-inputs
  94      `(("pkg-config" ,pkg-config)))
  95     (inputs
  96      `(("dbus" ,dbus)))
  97     (arguments
  98      `(#:phases
  99        (modify-phases %standard-phases (delete 'configure))
 100        #:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 101                           "CC=gcc"
 102                           "COPTS=\"-DHAVE_DBUS\"")
 103        #:tests? #f))                    ; no ‘check’ target
 104     (home-page "http://www.thekelleys.org.uk/dnsmasq/doc.html")
 105     (synopsis "Small caching DNS proxy and DHCP/TFTP server")
 106     (description
 107      "Dnsmasq is a light-weight DNS forwarder and DHCP server.  It is designed
 108 to provide DNS and, optionally, DHCP to a small network.  It can serve the
 109 names of local machines which are not in the global DNS.  The DHCP server
 110 integrates with the DNS server and allows machines with DHCP-allocated
 111 addresses to appear in the DNS with names configured either on each host or in
 112 a central configuration file.  Dnsmasq supports static and dynamic DHCP leases
 113 and BOOTP/TFTP for network booting of diskless machines.")
 114     ;; Source files only say GPL2 and GPL3 are allowed.
 115     (license (list license:gpl2 license:gpl3))))
 116
 117 ;; 'bind' is the name of a built-in Guile procedure, which is why we choose a
 118 ;; different name here.
 119 (define-public isc-bind
 120   (package
 121     (name "bind")
 122     (version "9.16.5")
 123     (source (origin
 124               (method url-fetch)
 125               (uri (string-append
 126                     "https://ftp.isc.org/isc/bind9/" version
 127                     "/bind-" version ".tar.xz"))
 128               (sha256
 129                (base32
 130                 "0xf07mmd0vi91jd15z8d3hhjva8v27l4ip4l8yzah4gg3zjv6y33"))))
 131     (build-system gnu-build-system)
 132     (outputs `("out" "utils"))
 133     (inputs
 134      ;; It would be nice to add GeoIP and gssapi once there are packages.
 135      `(("libcap" ,libcap)
 136        ("libuv" ,libuv)
 137        ("libxml2" ,libxml2)
 138        ("openssl" ,openssl)
 139        ("p11-kit" ,p11-kit)
 140        ("python" ,python)
 141        ("python-ply" ,python-ply)))
 142     (native-inputs
 143      `(("perl" ,perl)
 144        ("pkg-config" ,pkg-config)))
 145     (arguments
 146      `(#:configure-flags
 147        (list (string-append "--with-pkcs11="
 148                             (assoc-ref %build-inputs "p11-kit")))
 149        #:phases
 150        (modify-phases %standard-phases
 151          (add-after 'strip 'move-to-utils
 152            (lambda _
 153              (for-each
 154               (lambda (file)
 155                 (let ((target  (string-append (assoc-ref %outputs "utils") file))
 156                       (src  (string-append (assoc-ref %outputs "out") file)))
 157                   (mkdir-p (dirname target))
 158                   (link src target)
 159                   (delete-file src)))
 160               '("/bin/dig" "/bin/delv" "/bin/nslookup" "/bin/host" "/bin/nsupdate"
 161                 "/share/man/man1/dig.1"
 162                 "/share/man/man1/host.1"
 163                 "/share/man/man1/nslookup.1"
 164                 "/share/man/man1/nsupdate.1"))
 165              #t))
 166          ;; When and if guix provides user namespaces for the build process,
 167          ;; then the following can be uncommented and the subsequent "force-test"
 168          ;; will not be necessary.
 169          ;;
 170          ;;   (add-before 'check 'set-up-loopback
 171          ;;     (lambda _
 172          ;;          (system "bin/tests/system/ifconfig.sh up")))
 173          (replace 'check
 174            (lambda _
 175              ;; XXX Even ‘make force-test’ tries to create network interfaces
 176              ;; and fails.  The only working target is the (trivial) fuzz test.
 177              (with-directory-excursion "fuzz"
 178                (invoke "make" "check"))
 179              #t)))))
 180     (synopsis "Domain Name System (DNS) implementation")
 181     (description "BIND is an implementation of the @dfn{Domain Name System}
 182 (DNS) protocols for the Internet.  It is a reference implementation of those
 183 protocols, but it is also production-grade software, suitable for use in
 184 high-volume and high-reliability applications.  The name BIND stands for
 185 \"Berkeley Internet Name Domain\", because the software originated in the
 186 early 1980s at the University of California at Berkeley.  The @code{utils}
 187 output of this package contains the following DNS name servers related command
 188 line utilities:
 189 @table @code
 190 @item delv
 191 DNS lookup and validation utility
 192 @item dig
 193 DNS lookup utility
 194 @item host
 195 DNS lookup utility
 196 @item nslookup
 197 Internet name servers interactive query utility
 198 @item nsupdate
 199 Dynamic DNS update utility
 200 @end table")
 201     (home-page "https://www.isc.org/bind/")
 202     (license (list license:mpl2.0))))
 203
 204 (define-public dnscrypt-proxy
 205   (package
 206     (name "dnscrypt-proxy")
 207     (version "1.9.5")
 208     (source (origin
 209               (method url-fetch)
 210               (uri (string-append
 211                     "https://download.dnscrypt.org/dnscrypt-proxy/"
 212                     "dnscrypt-proxy-" version ".tar.bz2"))
 213               (sha256
 214                (base32
 215                 "1dhvklr4dg2vlw108n11xbamacaryyg3dbrg629b76lp7685p7z8"))
 216               (modules '((guix build utils)))
 217               (snippet
 218                ;; Delete bundled libltdl. XXX: This package also bundles
 219                ;; a modified libevent that cannot currently be removed.
 220                '(begin
 221                   (delete-file-recursively "libltdl")
 222                   #t))))
 223     (build-system gnu-build-system)
 224     (arguments
 225      `(#:phases
 226        (modify-phases %standard-phases
 227          (add-after 'unpack 'autoreconf
 228            (lambda _
 229              ;; Re-generate build files due to unbundling ltdl.
 230              ;; TODO: Prevent generating new libltdl and building it.
 231              ;; The system version is still favored and referenced.
 232              (invoke "autoreconf" "-vif"))))))
 233     (native-inputs
 234      `(("pkg-config" ,pkg-config)
 235        ("automake" ,automake)
 236        ("autoconf" ,autoconf)
 237        ("libtool" ,libtool)))
 238     (inputs
 239      `(("libltdl" ,libltdl)
 240        ("libsodium" ,libsodium)))
 241     (home-page "https://www.dnscrypt.org/")
 242     (synopsis "Securely send DNS requests to a remote server")
 243     (description
 244      "@command{dnscrypt-proxy} is a tool for securing communications
 245 between a client and a DNS resolver.  It verifies that responses you get
 246 from a DNS provider was actually sent by that provider, and haven't been
 247 tampered with.  For optimal performance it is recommended to use this as
 248 a forwarder for a caching DNS resolver such as @command{dnsmasq}, but it
 249 can also be used as a normal DNS \"server\".  A list of public dnscrypt
 250 servers is included, and an up-to-date version is available at
 251 @url{https://download.dnscrypt.org/dnscrypt-proxy/dnscrypt-resolvers.csv}.")
 252     (license (list license:isc
 253                    ;; Libevent and src/ext/queue.h is 3-clause BSD.
 254                    license:bsd-3))))
 255
 256 (define-public dnscrypt-wrapper
 257   (package
 258     (name "dnscrypt-wrapper")
 259     (version "0.2.2")
 260     (source (origin
 261               (method url-fetch)
 262               (uri (string-append
 263                     "https://github.com/cofyc/dnscrypt-wrapper/releases"
 264                     "/download/v" version "/" name "-v" version ".tar.bz2"))
 265               (sha256
 266                (base32
 267                 "1vhg4g0r687f51wcdn7z9w1hxapazx6vyh5rsr8wa48sljzd583g"))))
 268     (build-system gnu-build-system)
 269     (arguments
 270      `(#:make-flags '("CC=gcc")
 271        ;; TODO: Tests require ruby-cucumber and ruby-aruba.
 272        #:tests? #f
 273        #:phases
 274        (modify-phases %standard-phases
 275          (add-after 'unpack 'create-configure
 276            (lambda _
 277              (invoke "make" "configure"))))))
 278     (native-inputs
 279      `(("autoconf" ,autoconf)))
 280     (inputs
 281      `(("libevent" ,libevent)
 282        ("libsodium" ,libsodium)))
 283     (home-page "https://github.com/Cofyc/dnscrypt-wrapper")
 284     (synopsis "Server-side dnscrypt proxy")
 285     (description
 286      "@command{dnscrypt-wrapper} is a tool to expose a name server over
 287 the @code{dnscrypt} protocol.  It can be used as an endpoint for the
 288 @command{dnscrypt-proxy} client to securely tunnel DNS requests between
 289 the two.")
 290     (license (list license:isc
 291                    ;; Bundled argparse is MIT. TODO: package and unbundle.
 292                    license:expat
 293                    ;; dns-protocol.h and rfc1035.{c,h} is gpl2 or gpl3 (either).
 294                    license:gpl2
 295                    license:gpl3))))
 296
 297 (define-public libasr
 298   (package
 299     (name "libasr")
 300     (version "1.0.4")
 301     (source
 302      (origin
 303        (method url-fetch)
 304        (uri (string-append "https://www.opensmtpd.org/archives/"
 305                            "libasr-" version ".tar.gz"))
 306        (sha256
 307         (base32 "1d6s8njqhvayx2gp47409sp1fn8m608ws26hr1srfp6i23nnpyqr"))))
 308     (build-system gnu-build-system)
 309     (arguments
 310      `(#:phases
 311        (modify-phases %standard-phases
 312          (add-after 'install 'install-documentation
 313            (lambda* (#:key outputs #:allow-other-keys)
 314              (let ((out (assoc-ref outputs "out")))
 315                (install-file "src/asr_run.3"
 316                              (string-append out "/share/man/man3"))
 317                #t))))))
 318     (native-inputs
 319      `(("autoconf" ,autoconf)
 320        ("automake" ,automake)
 321        ("libtool" ,libtool)
 322        ("pkg-config" ,pkg-config)))
 323     (home-page "https://www.opensmtpd.org")
 324     (synopsis "Asynchronous resolver library by the OpenBSD project")
 325     (description
 326      "libasr is a free, simple and portable asynchronous resolver library.
 327 It runs DNS queries and performs hostname resolution in a fully
 328 asynchronous fashion.")
 329     (license (list license:isc
 330                    license:bsd-2 ; last part of getrrsetbyname_async.c
 331                    license:bsd-3
 332                    (license:non-copyleft "file://LICENSE") ; includes.h
 333                    license:openssl))))
 334
 335 (define-public nsd
 336   (package
 337     (name "nsd")
 338     (version "4.3.2")
 339     (source
 340      (origin
 341        (method url-fetch)
 342        (uri (string-append "https://www.nlnetlabs.nl/downloads/nsd/nsd-"
 343                            version ".tar.gz"))
 344        (sha256
 345         (base32 "0ac3mbn5z4nc18782m9aswdpi2m9f4665vidw0ciyigdh0pywp2v"))))
 346     (build-system gnu-build-system)
 347     (arguments
 348      `(#:configure-flags
 349        (list "--enable-pie"             ; fully benefit from ASLR
 350              "--enable-ratelimit"
 351              "--enable-recvmmsg"
 352              "--enable-relro-now"       ; protect GOT and .dtor areas
 353              "--disable-radix-tree"
 354              (string-append "--with-libevent="
 355                             (assoc-ref %build-inputs "libevent"))
 356              (string-append "--with-ssl="
 357                             (assoc-ref %build-inputs "openssl"))
 358              "--with-configdir=/etc"
 359              "--with-nsd_conf_file=/etc/nsd/nsd.conf"
 360              "--with-logfile=/var/log/nsd.log"
 361              "--with-pidfile=/var/db/nsd/nsd.pid"
 362              "--with-dbfile=/var/db/nsd/nsd.db"
 363              "--with-zonesdir=/etc/nsd"
 364              "--with-xfrdfile=/var/db/nsd/xfrd.state"
 365              "--with-zonelistfile=/var/db/nsd/zone.list")
 366        #:phases
 367        (modify-phases %standard-phases
 368          (add-before 'configure 'patch-installation-paths
 369            (lambda* (#:key outputs #:allow-other-keys)
 370              (let* ((out (assoc-ref outputs "out"))
 371                     (doc (string-append out "/share/doc/" ,name "-" ,version)))
 372                ;; The ‘make install’ target tries to create the parent
 373                ;; directories of run-time things like ‘pidfile’ above, and
 374                ;; useless empty directories like 'configdir'.  Remove such
 375                ;; '$(INSTALL)' lines and install the example configuration file
 376                ;; in an appropriate location.
 377                (substitute* "Makefile.in"
 378                  ((".*INSTALL.*\\$\\((config|pid|xfr|db)dir" command)
 379                   (string-append "#" command))
 380                  (("\\$\\(nsdconfigfile\\)\\.sample" file-name)
 381                   (string-append doc "/examples/" file-name)))
 382                #t))))
 383        #:tests? #f))                    ; no tests
 384     (inputs
 385      `(("libevent" ,libevent)
 386        ("openssl" ,openssl)))
 387     (home-page "https://www.nlnetlabs.nl/projects/nsd/about/")
 388     (synopsis "Authoritative DNS name server")
 389     (description "@dfn{NSD}, short for Name Server Daemon, is an authoritative
 390 name server for the Domain Name System (@dfn{DNS}).  It aims to be a fast and
 391 RFC-compliant nameserver.
 392
 393 NSD uses zone information compiled via @command{zonec} into a binary database
 394 file (@file{nsd.db}).  This allows fast startup of the name service daemon and
 395 allows syntax-structural errors in zone files to be flagged at compile time,
 396 before being made available to NSD service itself.  However, most traditional
 397 BIND-style zone files can be directly imported into NSD without modification.
 398
 399 The collection of programs and processes that make up NSD are designed so that
 400 the daemon itself runs as a non-privileged user and can be easily configured to
 401 run in a @code{chroot} jail, thus making any security flaws in NSD less likely
 402 to result in system-wide compromise.")
 403     (license (list license:bsd-3))))
 404
 405 (define-public unbound
 406   (package
 407     (name "unbound")
 408     (version "1.10.1")
 409     (source
 410      (origin
 411        (method url-fetch)
 412        (uri (string-append "https://www.unbound.net/downloads/unbound-"
 413                            version ".tar.gz"))
 414        (sha256
 415         (base32 "0dnmh9jjh2v274f0hl31bgv40pl77mmfgky8bkqr5kvi3b17fdmp"))))
 416     (build-system gnu-build-system)
 417     (outputs '("out" "python"))
 418     (native-inputs
 419      `(("flex" ,flex)
 420        ("swig" ,swig)))
 421     (inputs
 422      `(("expat" ,expat)
 423        ("libevent" ,libevent)
 424        ("protobuf" ,protobuf)
 425        ("python-wrapper" ,python-wrapper)
 426        ("openssl" ,openssl)))
 427     (arguments
 428      `(#:configure-flags
 429        (list "--disable-static" ; save space and non-determinism in libunbound.a
 430              (string-append
 431               "--with-ssl=" (assoc-ref %build-inputs "openssl"))
 432              (string-append
 433               "--with-libevent=" (assoc-ref %build-inputs "libevent"))
 434              (string-append
 435               "--with-libexpat=" (assoc-ref %build-inputs "expat"))
 436              "--with-pythonmodule" "--with-pyunbound")
 437        #:phases
 438        (modify-phases %standard-phases
 439          (add-after 'configure 'fix-python-site-package-path
 440            ;; Move python modules into their own output.
 441            (lambda* (#:key outputs #:allow-other-keys)
 442              (let ((pyout (assoc-ref outputs "python"))
 443                    (ver ,(version-major+minor (package-version python))))
 444                (substitute* "Makefile"
 445                  (("^PYTHON_SITE_PKG=.*$")
 446                   (string-append
 447                    "PYTHON_SITE_PKG="
 448                    pyout "/lib/python-" ver "/site-packages\n"))))
 449              #t))
 450          (add-before 'check 'fix-missing-nss-for-tests
 451            ;; Unfortunately, the package's unittests involve some checks
 452            ;; looking up protocols and services which are not provided
 453            ;; by the minimalistic build environment, in particular,
 454            ;; /etc/protocols and /etc/services are missing.
 455            ;; Also, after plain substitution of protocol and service names
 456            ;; in the test data, the tests still fail because the
 457            ;; corresponding Resource Records have been signed by
 458            ;; RRSIG records.
 459            ;; The following LD_PRELOAD library overwrites the glibc
 460            ;; functions ‘get{proto,serv}byname’, ‘getprotobynumber’ and
 461            ;; ‘getservbyport’ providing the few records required for the
 462            ;; unit tests to pass.
 463            (lambda* (#:key inputs outputs #:allow-other-keys)
 464              (let* ((source (assoc-ref %build-inputs "source"))
 465                     (gcc (assoc-ref %build-inputs "gcc")))
 466                (call-with-output-file "/tmp/nss_preload.c"
 467                  (lambda (port)
 468                    (display "#include <stdlib.h>
 469 #include <string.h>
 470 #include <strings.h>
 471
 472 #include <netdb.h>
 473
 474 struct protoent *getprotobyname(const char *name) {
 475   struct protoent *p = malloc(sizeof(struct protoent));
 476   p->p_aliases = malloc(sizeof(char*));
 477   if (strcasecmp(name, \"tcp\") == 0) {
 478     p->p_name = \"tcp\";
 479     p->p_proto = 6;
 480     p->p_aliases[0] = \"TCP\";
 481   } else if (strcasecmp(name, \"udp\") == 0) {
 482     p->p_name = \"udp\";
 483     p->p_proto = 17;
 484     p->p_aliases[0] = \"UDP\";
 485   } else
 486     p = NULL;
 487   return p;
 488 }
 489
 490 struct protoent *getprotobynumber(int proto) {
 491   struct protoent *p = malloc(sizeof(struct protoent));
 492   p->p_aliases = malloc(sizeof(char*));
 493   switch(proto) {
 494   case 6:
 495     p->p_name = \"tcp\";
 496     p->p_proto = 6;
 497     p->p_aliases[0] = \"TCP\";
 498     break;
 499   case 17:
 500     p->p_name = \"udp\";
 501     p->p_proto = 17;
 502     p->p_aliases[0] = \"UDP\";
 503     break;
 504   default:
 505     p = NULL;
 506     break;
 507   }
 508   return p;
 509 }
 510
 511 struct servent *getservbyname(const char *name, const char *proto) {
 512   struct servent *s = malloc(sizeof(struct servent));
 513   char* buf = malloc((strlen(proto)+1)*sizeof(char));
 514   strcpy(buf, proto);
 515   s->s_aliases = malloc(sizeof(char*));
 516   s->s_aliases[0] = NULL;
 517   if (strcasecmp(name, \"domain\") == 0) {
 518     s->s_name = \"domain\";
 519     s->s_port = htons(53);
 520     s->s_proto = buf;
 521   } else
 522     s = NULL;
 523   return s;
 524 }
 525
 526 struct servent *getservbyport(int port, const char *proto) {
 527   char buf[32];
 528   struct servent *s = malloc(sizeof(struct servent));
 529   strcpy(buf, proto);
 530   s->s_aliases = malloc(sizeof(char*));
 531   s->s_aliases[0] = NULL;
 532   switch(port) {
 533   case 53:
 534     s->s_name = \"domain\";
 535     s->s_port = 53;
 536     s->s_proto = \"udp\";
 537     break;
 538   default:
 539     s = NULL;
 540     break;
 541   }
 542   return s;
 543 }" port)))
 544                (invoke (string-append gcc "/bin/gcc")
 545                        "-shared" "-fPIC" "-o" "/tmp/nss_preload.so"
 546                        "/tmp/nss_preload.c")
 547                ;; The preload library only affects the unittests.
 548                (substitute* "Makefile"
 549                  (("./unittest")
 550                   "LD_PRELOAD=/tmp/nss_preload.so ./unittest")))
 551              #t)))))
 552     (home-page "https://www.unbound.net")
 553     (synopsis "Validating, recursive, and caching DNS resolver")
 554     (description
 555      "Unbound is a recursive-only caching DNS server which can perform DNSSEC
 556 validation of results.  It implements only a minimal amount of authoritative
 557 service to prevent leakage to the root nameservers: forward lookups for
 558 localhost, reverse for @code{127.0.0.1} and @code{::1}, and NXDOMAIN for zones
 559 served by AS112.  Stub and forward zones are supported.")
 560     (license license:bsd-4)))
 561
 562 (define-public yadifa
 563   (package
 564     (name "yadifa")
 565     (version "2.3.9")
 566     (source
 567      (let ((build "8497"))
 568        (origin
 569          (method url-fetch)
 570          (uri
 571           (string-append "http://cdn.yadifa.eu/sites/default/files/releases/"
 572                          "yadifa-" version "-" build ".tar.gz"))
 573          (sha256
 574           (base32 "0xvyr91sfgzkpw6g3h893ldbwnki3w2472n56rr18w67qghs1sa5")))))
 575     (build-system gnu-build-system)
 576     (native-inputs
 577      `(("which" ,which)))
 578     (inputs
 579      `(("openssl" ,openssl)))
 580     (arguments
 581      `(#:phases
 582        (modify-phases %standard-phases
 583          (add-before 'configure 'omit-example-configurations
 584            (lambda _
 585              (substitute* "Makefile.in"
 586                ((" (etc|var)") ""))
 587              #t)))
 588        #:configure-flags
 589        (list "--sysconfdir=/etc"
 590              "--localstatedir=/var"
 591              "--disable-build-timestamp" ; build reproducibly
 592              "--enable-shared"
 593              "--disable-static"
 594              "--enable-acl"
 595              "--enable-caching"
 596              "--enable-ctrl"            ; enable remote control
 597              "--enable-nsec"
 598              "--enable-nsec3"
 599              "--enable-tsig")))
 600     (home-page "https://www.yadifa.eu/")
 601     (synopsis "Authoritative DNS name server")
 602     (description "YADIFA is an authoritative name server for the @dfn{Domain
 603 Name System} (DNS).  It aims for both higher performance and a smaller memory
 604 footprint than other implementations, while remaining fully RFC-compliant.
 605 YADIFA supports dynamic record updates and the @dfn{Domain Name System Security
 606 Extensions} (DNSSEC).")
 607     (license license:bsd-3)))
 608
 609 (define-public knot
 610   (package
 611     (name "knot")
 612     (version "2.9.5")
 613     (source
 614      (origin
 615        (method url-fetch)
 616        (uri (string-append "https://secure.nic.cz/files/knot-dns/"
 617                            "knot-" version ".tar.xz"))
 618        (sha256
 619         (base32 "0xmzmhd2m9rb24clrrd9k058harsq67nyjplpbyxvy1g46xah28i"))
 620        (modules '((guix build utils)))
 621        (snippet
 622         '(begin
 623            ;; Delete bundled libraries.
 624            (with-directory-excursion "src/contrib"
 625              (delete-file-recursively "lmdb"))
 626            #t))))
 627     (build-system gnu-build-system)
 628     (native-inputs
 629      `(("pkg-config" ,pkg-config)))
 630     (inputs
 631      `(("fstrm" ,fstrm)
 632        ("gnutls" ,gnutls)
 633        ("jansson" ,jansson)
 634        ("libcap-ng" ,libcap-ng)
 635        ("libedit" ,libedit)
 636        ("libidn" ,libidn)
 637        ("liburcu" ,liburcu)
 638        ("lmdb" ,lmdb)
 639        ("ncurses" ,ncurses)
 640        ("protobuf-c" ,protobuf-c)))
 641     (arguments
 642      `(#:phases
 643        (modify-phases %standard-phases
 644          (add-before 'configure 'disable-directory-pre-creation
 645            (lambda _
 646              ;; Don't install empty directories like ‘/etc’ outside the store.
 647              ;; This is needed even when using ‘make config_dir=... install’.
 648              (substitute* "src/Makefile.in" (("\\$\\(INSTALL\\) -d") "true"))
 649              #t))
 650          (replace 'install
 651            (lambda* (#:key outputs #:allow-other-keys)
 652              (let* ((out (assoc-ref outputs "out"))
 653                     (doc (string-append out "/share/doc/" ,name "-" ,version))
 654                     (etc (string-append doc "/examples/etc")))
 655                (invoke "make"
 656                        (string-append "config_dir=" etc)
 657                        "install")))))
 658        #:configure-flags
 659        (list "--sysconfdir=/etc"
 660              "--localstatedir=/var"
 661              "--enable-dnstap"          ; let tools read/write capture files
 662              "--with-module-dnstap=yes" ; detailed query capturing & logging
 663              (string-append "--with-bash-completions="
 664                             (assoc-ref %outputs "out")
 665                             "/etc/bash_completion.d"))))
 666     (home-page "https://www.knot-dns.cz/")
 667     (synopsis "Authoritative DNS name server")
 668     (description "Knot DNS is an authoritative name server for the @dfn{Domain
 669 Name System} (DNS), designed to meet the needs of root and @dfn{top-level
 670 domain} (TLD) name servers.  It is implemented as a threaded daemon and uses a
 671 number of programming techniques to improve speed.  For example, the responder
 672 is completely lock-free, resulting in a very high response rate.  Other features
 673 include automatic @dfn{DNS Security Extensions} (DNSSEC) signing, dynamic record
 674 synthesis, and on-the-fly re-configuration.")
 675     (license
 676      (list
 677       ;; src/contrib/{hat-trie,murmurhash3,openbsd},
 678       ;; src/dnssec/contrib/vpool.[ch], and parts of libtap/ are ‘MIT’ (expat).
 679       license:expat
 680       license:lgpl2.0+              ; parts of scr/contrib/ucw
 681       license:public-domain         ; src/contrib/fnv and possibly murmurhash3
 682       license:gpl3+))))             ; everything else
 683
 684 (define-public knot-resolver
 685   (package
 686     (name "knot-resolver")
 687     (version "4.3.0")
 688     (source (origin
 689               (method url-fetch)
 690               (uri (string-append "https://secure.nic.cz/files/knot-resolver/"
 691                                   "knot-resolver-" version ".tar.xz"))
 692               (sha256
 693                (base32
 694                 "09ffmqx79lv5psr433x4n946njgsn071b9b7161pcb9bmrqz380c"))))
 695     (build-system meson-build-system)
 696     (arguments
 697      '(#:configure-flags '("-Ddoc=enabled")
 698        #:phases
 699        (modify-phases %standard-phases
 700          (add-before 'configure 'disable-default-ta
 701            (lambda _
 702              ;;  Disable the default managed root TA, since we don't have
 703              ;;  write access to the keyfile and its directory in store.
 704              (substitute* "daemon/lua/sandbox.lua.in"
 705                (("^trust_anchors\\.add_file.*") ""))
 706              #t))
 707          (add-after 'build 'build-doc
 708            (lambda _
 709              (invoke "ninja" "doc")))
 710          (add-after 'install 'wrap-binary
 711            (lambda* (#:key inputs outputs #:allow-other-keys)
 712              (let* ((out (assoc-ref outputs "out"))
 713                     (lua-* (map cdr (filter
 714                                      (lambda (input)
 715                                        (string-prefix? "lua-" (car input)))
 716                                      inputs)))
 717                     (lua-path (lambda (p)
 718                                 (string-append p "/share/lua/5.1/?.lua")))
 719                     (lua-cpath (lambda (p)
 720                                  (string-append p "/lib/lua/5.1/?.so"))))
 721                (wrap-program (string-append out "/sbin/kresd")
 722                  `("LUA_PATH" ";" prefix ,(map lua-path lua-*))
 723                  `("LUA_CPATH" ";" prefix ,(map lua-cpath lua-*)))
 724                #t))))))
 725     (native-inputs
 726      `(("cmocka" ,cmocka)               ; for unit tests
 727        ("doxygen" ,doxygen)
 728        ("protobuf-c" ,protobuf-c)
 729        ("pkg-config" ,pkg-config)
 730        ("python-breathe" ,python-breathe)
 731        ("python-sphinx" ,python-sphinx)
 732        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)))
 733     (inputs
 734      `(("fstrm" ,fstrm)
 735        ("gnutls" ,gnutls)
 736        ("knot" ,knot)
 737        ("libuv" ,libuv)
 738        ("lmdb" ,lmdb)
 739        ("luajit" ,luajit)
 740        ;; TODO: Add optional lua modules: basexx and psl.
 741        ("lua-bitop" ,lua5.1-bitop)
 742        ("lua-cqueues" ,lua5.1-cqueues)
 743        ("lua-filesystem" ,lua5.1-filesystem)
 744        ("lua-sec" ,lua5.1-sec)
 745        ("lua-socket" ,lua5.1-socket)))
 746     (home-page "https://www.knot-resolver.cz/")
 747     (synopsis "Caching validating DNS resolver")
 748     (description
 749      "Knot Resolver is a caching full resolver implementation written in C and
 750 LuaJIT, both a resolver library and a daemon.")
 751     (license (list license:gpl3+
 752                    ;; Some 'contrib' files are under MIT, CC0 and LGPL2.
 753                    license:expat
 754                    license:cc0
 755                    license:lgpl2.0))))
 756
 757 (define-public ddclient
 758   (package
 759     (name "ddclient")
 760     (version "3.9.1")
 761     (source
 762      (origin
 763        (method git-fetch)
 764        (uri (git-reference
 765              (url "https://github.com/ddclient/ddclient")
 766              (commit (string-append "v" version))))
 767        (file-name (git-file-name name version))
 768        (sha256
 769         (base32 "0hf377g4j9r9sac75xp17nk2h58mazswz4vkg4g2gl2yyhvzq91w"))))
 770     (build-system trivial-build-system) ; no Makefile.PL
 771     (native-inputs
 772      `(("bash" ,bash)
 773        ("perl" ,perl)))
 774     (inputs
 775      `(("inetutils" ,inetutils)         ; logger
 776        ("net-tools" ,net-tools)
 777        ("perl-data-validate-ip" ,perl-data-validate-ip)
 778        ("perl-digest-sha1" ,perl-digest-sha1)
 779        ("perl-io-socket-ssl" ,perl-io-socket-ssl)))
 780     (arguments
 781      `(#:modules ((guix build utils)
 782                   (ice-9 match)
 783                   (srfi srfi-26))
 784        #:builder
 785        (begin
 786          (use-modules (guix build utils)
 787                       (ice-9 match)
 788                       (srfi srfi-26))
 789          (setenv "PATH" (string-append
 790                          (assoc-ref %build-inputs "bash") "/bin" ":"
 791                          (assoc-ref %build-inputs "perl") "/bin"))
 792
 793          ;; Copy the (read-only) source into the (writable) build directory.
 794          (copy-recursively (assoc-ref %build-inputs "source") ".")
 795
 796          ;; Install.
 797          (let* ((out (assoc-ref %outputs "out"))
 798                 (bin (string-append out "/bin")))
 799            (let ((file "ddclient"))
 800              (substitute* file
 801                (("/usr/bin/perl") (which "perl"))
 802                ;; Strictly use ‘/etc/ddclient/ddclient.conf’.
 803                (("\\$\\{program\\}\\.conf") "/etc/ddclient/ddclient.conf")
 804                (("\\$etc\\$program.conf") "/etc/ddclient/ddclient.conf")
 805                ;; Strictly use ‘/var/cache/ddclient/ddclient.cache’
 806                (("\\$cachedir\\$program\\.cache")
 807                 "/var/cache/ddclient/ddclient.cache"))
 808              (install-file file bin)
 809              (wrap-program (string-append bin "/" file)
 810                `("PATH" ":" =
 811                  ("$PATH"
 812                   ,@(map (lambda (input)
 813                            (match input
 814                                   ((name . store)
 815                                    (string-append store "/bin"))))
 816                          %build-inputs)))
 817                `("PERL5LIB" ":" =
 818                  ,(delete
 819                    ""
 820                    (map (match-lambda
 821                          (((? (cut string-prefix? "perl-" <>) name) . dir)
 822                           (string-append dir "/lib/perl5/site_perl"))
 823                          (_ ""))
 824                         %build-inputs)))))
 825            (for-each (cut install-file <> (string-append out
 826                                                          "/share/ddclient"))
 827                      (find-files "." "sample.*$"))))))
 828     (home-page "https://ddclient.net/")
 829     (synopsis "Address updating utility for dynamic DNS services")
 830     (description "This package provides a client to update dynamic IP
 831 addresses with several dynamic DNS service providers, such as
 832 @uref{https://www.dyndns.com/account/login.html,DynDNS.com}.
 833
 834 This makes it possible to use a fixed hostname (such as myhost.dyndns.org) to
 835 access a machine with a dynamic IP address.
 836
 837 The client supports both dynamic and (near) static services, as well as MX
 838 record and alternative name management.  It caches the address, and only
 839 attempts the update when it has changed.")
 840     (license license:gpl2+)))
 841
 842 (define-public hnsd
 843   ;; There have been no releases yet, hence this commit.
 844   (let ((revision "0")
 845         (commit "895d89c25d316d18df9d374fe78aae3902bc89fb"))
 846    (package
 847      (name "hnsd")
 848      (version (git-version "0.0" revision commit))
 849      (source (origin
 850                (method git-fetch)
 851                (uri (git-reference
 852                      (url "https://github.com/handshake-org/hnsd")
 853                      (commit commit)))
 854                (sha256
 855                 (base32
 856                  "0704y73sddn24jga9csw4gxyfb3pnrfnk0vdcph84n1h38490l16"))
 857                (file-name (git-file-name name version))
 858                (modules '((guix build utils)))
 859                (snippet
 860                 '(begin
 861                    ;; Delete the bundled copy of libuv.
 862                    (delete-file-recursively "uv")
 863                    (substitute* "configure.ac"
 864                      (("AC_CONFIG_SUBDIRS\\(\\[uv\\]\\)") ""))
 865                    (substitute* "Makefile.am"
 866                      (("SUBDIRS = uv") "\n")
 867                      (("\\$\\(top_builddir\\)/uv/libuv.la") "-luv")
 868
 869                      ;; Make sure the 'hnsd' binary is installed and
 870                      ;; dynamically-linked.
 871                      (("noinst_PROGRAMS") "bin_PROGRAMS")
 872                      (("hnsd_LDFLAGS = -static") ""))
 873
 874                    ;; This script tries to chdir to "uv" and doesn't do more
 875                    ;; than "autoreconf" so remove it.
 876                    (delete-file "autogen.sh")
 877                    #t))))
 878      (build-system gnu-build-system)
 879      (arguments
 880       '(#:configure-flags '("--disable-static"))) ;no need for libhsk.a
 881      (native-inputs
 882       `(("autoconf" ,autoconf)
 883         ("automake" ,automake)
 884         ("libtool" ,libtool)))
 885      (inputs
 886       `(("unbound" ,unbound)
 887         ("libuv" ,libuv)))
 888      (home-page "https://www.handshake.org/")
 889      (synopsis "Resolver daemon for the Handshake naming protocol")
 890      (description
 891       "@command{hnsd} is a @dfn{host name resolver} for the Handshake Naming
 892 System (HNS) peer-to-peer network.")
 893      (license license:expat))))
 894
 895 (define-public libmicrodns
 896   (package
 897     (name "libmicrodns")
 898     (version "0.1.2")
 899     (source (origin
 900               (method url-fetch)
 901               (uri (string-append "https://github.com/videolabs/libmicrodns/"
 902                                   "releases/download/" version "/microdns-"
 903                                   version ".tar.xz"))
 904               (sha256
 905                (base32
 906                 "0p4va18zxgmzcdwhlbg2mmjwswlbgqy4ay5vaxrw7cxmhsflnv36"))))
 907     (build-system meson-build-system)
 908     (home-page "https://github.com/videolabs/libmicrodns")
 909     (synopsis "Minimal mDNS resolver library")
 910     (description "@code{libmicrodns} provides a minimal implementation of a
 911 mDNS resolver as well as an announcer.  mDNS (Multicast Domain Name System) is
 912 a zero-config service that allows one to resolve host names to IP addresses in
 913 local networks.")
 914     (license license:lgpl2.1)))
 915
 916 (define-public public-suffix-list
 917   ;; Mozilla releases the official list here:
 918   ;;
 919   ;;   https://publicsuffix.org/list/public_suffix_list.dat
 920   ;;
 921   ;; However, Mozilla syncs that file from the GitHub repository periodically,
 922   ;; so its contents will change over time.  If you update this commit, please
 923   ;; make sure that the new commit refers to a list which is identical to the
 924   ;; officially published list available from the URL above.
 925   (let ((commit "9375b697baddb0827a5995c81bd3c75877a0b35d"))
 926     (package
 927       (name "public-suffix-list")
 928       (version (git-version "0" "1" commit))
 929       (source (origin
 930                 (method git-fetch)
 931                 (uri (git-reference
 932                       (url "https://github.com/publicsuffix/list")
 933                       (commit commit)))
 934                 (file-name (git-file-name name version))
 935                 (sha256
 936                  (base32
 937                   "1sm7pni01rnl4ldzi8z8nc4cbgq8nxda9gwc68v0s3ij7jd1jmik"))))
 938       (build-system trivial-build-system)
 939       (arguments
 940        `(#:modules ((guix build utils))
 941          #:builder
 942          (begin
 943            (use-modules (guix build utils))
 944            (let* ((out (assoc-ref %outputs "out"))
 945                   ;; Install to /share because that is where "read-only
 946                   ;; architecture-independent data files" should go (see:
 947                   ;; (standards) Directory Variables).  Include the version in
 948                   ;; the directory name so that if multiple versions are ever
 949                   ;; installed in the same profile, they will not conflict.
 950                   (destination (string-append
 951                                 out "/share/public-suffix-list-" ,version))
 952                   (source (assoc-ref %build-inputs "source")))
 953              (with-directory-excursion source
 954              (install-file "public_suffix_list.dat" destination)
 955              (install-file "LICENSE" destination))
 956              #t))))
 957       (home-page "https://publicsuffix.org/")
 958       (synopsis "Database of current and historical DNS suffixes")
 959       (description "This is the Public Suffix List maintained by Mozilla.  A
 960 \"public suffix\" is one under which Internet users can (or historically
 961 could) directly register names in the Domain Name System (DNS).  Some examples
 962 of public suffixes are .com, .co.uk and pvt.k12.ma.us.  This is a list of all
 963 known public suffixes.")
 964       (license license:mpl2.0))))
 965
 966 (define-public maradns
 967   (package
 968     (name "maradns")
 969     (version "3.5.0007")
 970     (source
 971      (origin
 972        (method url-fetch)
 973        (uri (string-append "https://maradns.samiam.org/download/"
 974                            (version-major+minor version) "/"
 975                            version "/maradns-" version ".tar.xz"))
 976        (sha256
 977         (base32 "0bc19xylg4whww9qaj5i4izwxcrh0c0ja7l1pfcn2la02hlvg1a6"))))
 978     (build-system gnu-build-system)
 979     (arguments
 980      `(#:tests? #f                      ; need to be root to run tests
 981        #:make-flags
 982        (list
 983         ,(string-append "CC=" (cc-for-target))
 984         (string-append "PREFIX=" %output)
 985         (string-append "RPM_BUILD_ROOT=" %output))
 986        #:phases
 987        (modify-phases %standard-phases
 988          (replace 'configure
 989            (lambda* (#:key native-inputs target #:allow-other-keys)
 990              ;; make_32bit_tables generates a header file that is used during
 991              ;; compilation. Hence, during cross compilation, it should be
 992              ;; built for the host system.
 993              (when target
 994                (substitute* "rng/Makefile"
 995                  (("\\$\\(CC\\) -o make_32bit_tables")
 996                   (string-append (assoc-ref native-inputs "gcc")
 997                                  "/bin/gcc -o make_32bit_tables"))))
 998              (invoke "./configure")))
 999          (add-before 'install 'create-install-directories
1000            (lambda* (#:key outputs #:allow-other-keys)
1001              (let ((out (assoc-ref outputs "out")))
1002                (for-each (lambda (dir)
1003                            (mkdir-p (string-append out dir)))
1004                          (list "/bin" "/sbin" "/etc"
1005                                "/share/man/man1"
1006                                "/share/man/man5"
1007                                "/share/man/man8"))
1008                #t))))))
1009     (home-page "https://maradns.samiam.org")
1010     (synopsis "Small lightweight DNS server")
1011     (description "MaraDNS is a small and lightweight DNS server.  MaraDNS
1012 consists of a UDP-only authoritative DNS server for hosting domains, and a UDP
1013 and TCP-capable recursive DNS server for finding domains on the internet.")
1014     (license license:bsd-2)))
1015
1016 (define-public openresolv
1017   (package
1018     (name "openresolv")
1019     (version "3.10.0")
1020     (source (origin
1021               (method url-fetch)
1022               (uri (string-append "https://roy.marples.name/downloads/openresolv/"
1023                                   "openresolv-" version ".tar.xz"))
1024               (sha256
1025                (base32
1026                 "01ms6c087la4hk0f0w6n2vpsb7dg4kklah2rqyhz88p0vr9bqy20"))
1027               (patches
1028                (search-patches "openresolv-restartcmd-guix.patch"))))
1029     (build-system gnu-build-system)
1030     (arguments
1031      `(#:tests? #f                      ; No test suite
1032        #:configure-flags
1033        (list (string-append "--sysconfdir=/etc"))
1034        #:make-flags
1035        (list (string-append "SYSCONFDIR=/" (assoc-ref %outputs "out") "/etc"))))
1036     (home-page "https://roy.marples.name/projects/openresolv/")
1037     (synopsis "Resolvconf POSIX compliant implementation, a middleman for resolv.conf")
1038     (description "openresolv is an implementation of @command{resolvconf}, the
1039 middleman between the network configuration services and
1040 @file{/etc/resolv.conf}.  @command{resolvconf} itself is just a script that
1041 stores, removes and lists a full @file{resolv.conf} generated for the
1042 interface.  It then calls all the helper scripts it knows about so it can
1043 configure the real @file{/etc/resolv.conf} and optionally any local
1044 nameservers other than libc.")
1045     (license license:bsd-2)))