dnsmasq: follow upstream dnsmasq pre-v2.81 v2

Backport upstream commits.  Most interesting 122392e which changes how
SERVFAIL is handled especially in event of genuine server down/failure
scenarios with multiple servers.  a799ca0 also interesting in that
answered received via TCP are now cached, DNSSEC typically using TCP
meant until now answers weren't cached, hence reducing performance.

59e4703 Free config file values on parsing errors.
48d12f1 Remove the NO_FORK compile-time option, and support for uclinux.
122392e Revert 68f6312d4bae30b78daafcd6f51dc441b8685b1e
3a5a84c Fix Makefile lines generating UBUS linker config.
24b8760 Do not rely on dead code elimination, use array instead. Make options bits derived from size and count. Use size of option bits and last supported bit in computation. No new change would be required when new options are added. Just change OPT_LAST constant.
6f7812d Fix spurious AD flags in some DNS replies from local config.
cbb5b17 Fix logging in cf5984367bc6a949e3803a576512c5a7bc48ebab
cf59843 Don't forward *.bind/*.server queries upstream
ee87504 Remove ability to compile without IPv6 support.
a220545 Ensure that AD bit is reset on answers from --address=/<domain>/<address>.
a799ca0 Impove cache behaviour for TCP connections.

Along with an additional patch to fix compilation without DHCPv6, sent
upstream.

I've been running this for aaaages without obvious issue hence brave
step of opening to wider openwrt community.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

1 files changed, 41 insertions, 0 deletions

diff --git a/package/network/services/dnsmasq/patches/0009-Revert-68f6312d4bae30b78daafcd6f51dc441b8685b1e.patch b/package/network/services/dnsmasq/patches/0009-Revert-68f6312d4bae30b78daafcd6f51dc441b8685b1e.patch
new file mode 100644
index 0000000000..ff9ddd842c
--- /dev/null
+++ b/package/network/services/dnsmasq/patches/0009-Revert-68f6312d4bae30b78daafcd6f51dc441b8685b1e.patch
@@ -0,0 +1,41 @@
+From 122392e0b352507cabb9e982208d35d2e56902e0 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Wed, 31 Oct 2018 22:24:02 +0000
+Subject: [PATCH 09/11] Revert 68f6312d4bae30b78daafcd6f51dc441b8685b1e
+
+The above is intended to increase robustness, but actually does the
+opposite. The problem is that by ignoring SERVFAIL messages and hoping
+for a better answer from another of the servers we've forwarded to,
+we become vulnerable in the case that one or more of the configured
+servers is down or not responding.
+
+Consider the case that a domain is indeed BOGUS, and we've send the
+query to n servers. With 68f6312d4bae30b78daafcd6f51dc441b8685b1e
+we ignore the first n-1 SERVFAIL replies, and only return the
+final n'th answer to the client. Now, if one of the servers we are
+forwarding to is down, then we won't get all n replies, and the
+client will never get an answer! This is a far more likely scenario
+than a temporary SERVFAIL from only one of a set of notionally identical
+servers, so, on the ground of robustness, we have to believe
+any SERVFAIL answers we get, and return them to the client.
+
+The client could be using the same recursive servers we are,
+so it should, in theory, retry on SERVFAIL anyway.
+
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ src/forward.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/src/forward.c
++++ b/src/forward.c
+@@ -957,8 +957,7 @@ void reply_query(int fd, int family, tim
+      we get a good reply from another server. Kill it when we've
+      had replies from all to avoid filling the forwarding table when
+      everything is broken */
+-  if (forward->forwardall == 0 || --forward->forwardall == 1 ||
+-      (RCODE(header) != REFUSED && RCODE(header) != SERVFAIL))
++  if (forward->forwardall == 0 || --forward->forwardall == 1 || RCODE(header) != REFUSED)
+     {
+       int check_rebind = 0, no_cache_dnssec = 0, cache_secure = 0, bogusanswer = 0;
+