From d16828d89dacfe39d6191c91b6d2cbc3ecde960c Mon Sep 17 00:00:00 2001
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Fri, 22 Jan 2021 16:49:12 +0000
Subject: [PATCH 01/11] Move fd into frec_src, fixes
 15b60ddf935a531269bb8c68198de012a4967156

If identical queries from IPv4 and IPv6 sources are combined by the
new code added in 15b60ddf935a531269bb8c68198de012a4967156 then replies
can end up being sent via the wrong family of socket. The ->fd
should be per query, not per-question.

In bind-interfaces mode, this could also result in replies being sent
via the wrong socket even when IPv4/IPV6 issues are not in play.

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 src/dnsmasq/dnsmasq.h | 3 ++-
 src/dnsmasq/forward.c | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/dnsmasq/dnsmasq.h b/src/dnsmasq/dnsmasq.h
index 2522a406..abb87424 100644
--- a/src/dnsmasq/dnsmasq.h
+++ b/src/dnsmasq/dnsmasq.h
@@ -666,6 +666,7 @@ struct frec {
     union mysockaddr source;
     union all_addr dest;
     unsigned int iface, log_id;
+    int fd;
     unsigned short orig_id;
     struct frec_src *next;
   } frec_src;
@@ -673,7 +674,7 @@ struct frec {
   struct randfd *rfd4;
   struct randfd *rfd6;
   unsigned short new_id;
-  int fd, forwardall, flags;
+  int forwardall, flags;
   time_t time;
   unsigned char *hash[HASH_SIZE];
 #ifdef HAVE_DNSSEC 
diff --git a/src/dnsmasq/forward.c b/src/dnsmasq/forward.c
index 5deb386b..a3337980 100644
--- a/src/dnsmasq/forward.c
+++ b/src/dnsmasq/forward.c
@@ -415,8 +415,8 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr,
 	  forward->frec_src.dest = *dst_addr;
 	  forward->frec_src.iface = dst_iface;
 	  forward->frec_src.next = NULL;
+	  forward->frec_src.fd = udpfd;
 	  forward->new_id = get_id();
-	  forward->fd = udpfd;
 	  memcpy(forward->hash, hash, HASH_SIZE);
 	  forward->forwardall = 0;
 	  forward->flags = fwd_flags;
@@ -1337,7 +1337,7 @@ void reply_query(int fd, int family, time_t now)
 	      dump_packet(DUMP_REPLY, daemon->packet, (size_t)nn, NULL, &src->source);
 #endif
 	      
-	      send_from(forward->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn, 
+	      send_from(src->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn, 
 			&src->source, &src->dest, src->iface);
 
 	      if (option_bool(OPT_EXTRALOG) && src != &forward->frec_src)

From f04ef768c41bfd1e8d1b582ead74b7a3bd1254c9 Mon Sep 17 00:00:00 2001
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Fri, 22 Jan 2021 18:24:03 +0000
Subject: [PATCH 02/11] Fix to 75e2f0aec33e58ef5b8d4d107d821c215a52827c

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 src/dnsmasq/forward.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/dnsmasq/forward.c b/src/dnsmasq/forward.c
index a3337980..df76f7eb 100644
--- a/src/dnsmasq/forward.c
+++ b/src/dnsmasq/forward.c
@@ -391,6 +391,7 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr,
 	      new->dest = *dst_addr;
 	      new->log_id = daemon->log_id;
 	      new->iface = dst_iface;
+	      forward->frec_src.fd = udpfd;
 	    }
 	  
 	  return 1;

From 3e61132165d9e2ee28f00dbef75966102f0ec4f1 Mon Sep 17 00:00:00 2001
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Fri, 22 Jan 2021 18:50:43 +0000
Subject: [PATCH 03/11] Optimise sort_rrset for the case where the RR type no
 canonicalisation.

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 src/dnsmasq/dnssec.c | 71 ++++++++++++++++++++++++++++++--------------
 1 file changed, 49 insertions(+), 22 deletions(-)

diff --git a/src/dnsmasq/dnssec.c b/src/dnsmasq/dnssec.c
index 93cc7bf1..3ee1e9eb 100644
--- a/src/dnsmasq/dnssec.c
+++ b/src/dnsmasq/dnssec.c
@@ -334,37 +334,64 @@ static int sort_rrset(struct dns_header *header, size_t plen, u16 *rr_desc, int
 	  if (!CHECK_LEN(header, state2.ip, plen, rdlen2))
 	    return rrsetidx; /* short packet */
 	  state2.end = state2.ip + rdlen2; 
-	  	  
-	  while (1)
-	    {
-	      int ok1, ok2;
-	      
-	      ok1 = get_rdata(header, plen, &state1);
-	      ok2 = get_rdata(header, plen, &state2);
 
-	      if (!ok1 && !ok2)
+	  /* If the RR has no names in it then canonicalisation
+	     is the identity function and we can compare
+	     the RRs directly. If not we compare the 
+	     canonicalised RRs one byte at a time. */
+	  if (*rr_desc == (u16)-1)	  
+	    {
+	      int rdmin = rdlen1 > rdlen2 ? rdlen2 : rdlen1;
+	      int cmp = memcmp(state1.ip, state2.ip, rdmin);
+	      
+	      if (cmp > 0 || (cmp == 0 && rdlen1 > rdmin))
+		{
+		  unsigned char *tmp = rrset[i+1];
+		  rrset[i+1] = rrset[i];
+		  rrset[i] = tmp;
+		  swap = 1;
+		}
+	      else if (cmp == 0 && (rdlen1 == rdlen2))
 		{
 		  /* Two RRs are equal, remove one copy. RFC 4034, para 6.3 */
 		  for (j = i+1; j < rrsetidx-1; j++)
 		    rrset[j] = rrset[j+1];
 		  rrsetidx--;
 		  i--;
-		  break;
 		}
-	      else if (ok1 && (!ok2 || *state1.op > *state2.op)) 
-		{
-		  unsigned char *tmp = rrset[i+1];
-		  rrset[i+1] = rrset[i];
-		  rrset[i] = tmp;
-		  swap = 1;
-		  break;
-		}
-	      else if (ok2 && (!ok1 || *state2.op > *state1.op))
-		break;
-	      
-	      /* arrive here when bytes are equal, go round the loop again
-		 and compare the next ones. */
 	    }
+	  else
+	    /* Comparing canonicalised RRs, byte-at-a-time. */
+	    while (1)
+	      {
+		int ok1, ok2;
+		
+		ok1 = get_rdata(header, plen, &state1);
+		ok2 = get_rdata(header, plen, &state2);
+		
+		if (!ok1 && !ok2)
+		  {
+		    /* Two RRs are equal, remove one copy. RFC 4034, para 6.3 */
+		    for (j = i+1; j < rrsetidx-1; j++)
+		      rrset[j] = rrset[j+1];
+		    rrsetidx--;
+		    i--;
+		    break;
+		  }
+		else if (ok1 && (!ok2 || *state1.op > *state2.op)) 
+		  {
+		    unsigned char *tmp = rrset[i+1];
+		    rrset[i+1] = rrset[i];
+		    rrset[i] = tmp;
+		    swap = 1;
+		    break;
+		  }
+		else if (ok2 && (!ok1 || *state2.op > *state1.op))
+		  break;
+		
+		/* arrive here when bytes are equal, go round the loop again
+		   and compare the next ones. */
+	      }
 	}
     } while (swap);
 

From 6fe533e3c668d60ad20abada7a2ed4855305776e Mon Sep 17 00:00:00 2001
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Fri, 22 Jan 2021 22:26:25 +0000
Subject: [PATCH 04/11] Fix for 12af2b171de0d678d98583e2190789e544440e02

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 src/dnsmasq/forward.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/dnsmasq/forward.c b/src/dnsmasq/forward.c
index df76f7eb..8909754b 100644
--- a/src/dnsmasq/forward.c
+++ b/src/dnsmasq/forward.c
@@ -391,7 +391,7 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr,
 	      new->dest = *dst_addr;
 	      new->log_id = daemon->log_id;
 	      new->iface = dst_iface;
-	      forward->frec_src.fd = udpfd;
+	      new->fd = udpfd;
 	    }
 	  
 	  return 1;

From 6bb025faec41a465727b88cdc4881d7c64d59eb5 Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Sun, 24 Jan 2021 10:41:27 +0100
Subject: [PATCH 05/11] dnsmasq-v2.83 forwards multiple queries to the same
 destination only once and stores the other queries as duplicates. They do
 receive the answer later on, however, this is usually not logged (when
 log-queries=extra is enabled, there will be a warning about the duplicate).
 This commit handles such duplicates and introduces a new reply type 14 =
 "already forwarded"

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 src/dnsmasq/forward.c   |   8 ++++
 src/dnsmasq_interface.c | 101 ++++++++++++++++++++++++++++++++++++++++
 src/dnsmasq_interface.h |   2 +
 src/enums.h             |   1 +
 src/gc.c                |   5 ++
 5 files changed, 117 insertions(+)

diff --git a/src/dnsmasq/forward.c b/src/dnsmasq/forward.c
index 8909754b..0cc8b2fe 100644
--- a/src/dnsmasq/forward.c
+++ b/src/dnsmasq/forward.c
@@ -394,6 +394,9 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr,
 	      new->fd = udpfd;
 	    }
 	  
+	  // Pi-hole modification
+	  FTL_query_in_progress(daemon->log_id);
+
 	  return 1;
 	}
 	
@@ -1330,6 +1333,9 @@ void reply_query(int fd, int family, time_t now)
 	    }
 #endif
 
+	  // Pi-hole modification
+	  int first_ID = -1;
+
 	  for (src = &forward->frec_src; src; src = src->next)
 	    {
 	      header->id = htons(src->orig_id);
@@ -1347,6 +1353,8 @@ void reply_query(int fd, int family, time_t now)
 		  daemon->log_source_addr = &src->source;
 		  log_query(F_UPSTREAM, "query", NULL, "duplicate");
 		}
+	      /* Pi-hole modification */
+	      FTL_duplicate_reply(src->log_id, &first_ID);
 	    }
 	}
 
diff --git a/src/dnsmasq_interface.c b/src/dnsmasq_interface.c
index f4faac65..ddc919d2 100644
--- a/src/dnsmasq_interface.c
+++ b/src/dnsmasq_interface.c
@@ -2180,3 +2180,104 @@ bool FTL_unlink_DHCP_lease(const char *ipaddr)
 	return true;
 	
 }
+
+void FTL_query_in_progress(const int id)
+{
+	// Query (possibly from new source), but the same query may be in
+	// progress from another source.
+
+	// Lock shared memory
+	lock_shm();
+
+	// Search for corresponding query identified by ID
+	const int queryID = findQueryID(id);
+	if(queryID < 0)
+	{
+		// This may happen e.g. if the original query was an unhandled query type
+		unlock_shm();
+		return;
+	}
+
+	// Get query pointer
+	queriesData* query = getQuery(queryID, true);
+	if(query == NULL)
+	{
+		// Memory error, skip this DNSSEC details
+		unlock_shm();
+		return;
+	}
+
+	// Debug logging
+	if(config.debug & DEBUG_QUERIES)
+	{
+		// Get domain pointer
+		const domainsData* domain = getDomain(query->domainID, true);
+		if(domain != NULL)
+		{
+			logg("**** query for %s is already in progress (ID %i)", getstr(domain->domainpos), id);
+		}
+	}
+
+	// Store status
+	query->status = QUERY_IN_PROGRESS;
+
+	// Unlock shared memory
+	unlock_shm();
+}
+
+void FTL_duplicate_reply(const int id, int *firstID)
+{
+	// Reply to duplicated query
+
+	// Check if we can process thes duplicated queries at all
+	if(*firstID == -2)
+		return;
+
+	// Lock shared memory
+	lock_shm();
+
+	// Search for corresponding query identified by ID
+	const int queryID = findQueryID(id);
+	if(queryID < 0)
+	{
+		// This may happen e.g. if the original query was an unhandled query type
+		unlock_shm();
+		*firstID = -2;
+		return;
+	}
+
+	if(*firstID == -1)
+	{
+		// This is not yet a duplicate, we just store the ID
+		// of the successful reply here so we can get it quicker
+		// during the next loop iterations
+		unlock_shm();
+		*firstID = queryID;
+		return;
+	}
+
+	// Get query pointer of duplicate reply
+	queriesData* duplicated_query = getQuery(queryID, true);
+	const queriesData* source_query = getQuery(*firstID, true);
+
+	if(duplicated_query == NULL || source_query == NULL)
+	{
+		// Memory error, skip this duplicate
+		unlock_shm();
+		return;
+	}
+
+	// Debug logging
+	if(config.debug & DEBUG_QUERIES)
+	{
+		logg("**** query %d is duplicate of %d", queryID, *firstID);
+	}
+
+	// Copy relevant information over
+	duplicated_query->reply = source_query->reply;
+	duplicated_query->dnssec = source_query->dnssec;
+	duplicated_query->flags.complete = true;
+
+	// Unlock shared memory
+	unlock_shm();
+}
diff --git a/src/dnsmasq_interface.h b/src/dnsmasq_interface.h
index 7f7d34bf..3b7c4d2c 100644
--- a/src/dnsmasq_interface.h
+++ b/src/dnsmasq_interface.h
@@ -53,6 +53,8 @@ void _FTL_get_blocking_metadata(union all_addr **addrp, unsigned int *flags, con
 bool _FTL_CNAME(const char *domain, const struct crec *cpp, const int id, const char* file, const int line);
 
 unsigned int FTL_extract_question_flags(struct dns_header *header, const size_t qlen);
+void FTL_query_in_progress(const int id);
+void FTL_duplicate_reply(const int id, int *firstID);
 
 void FTL_dnsmasq_reload(void);
 void FTL_fork_and_bind_sockets(struct passwd *ent_pw);
diff --git a/src/enums.h b/src/enums.h
index 314b9bb0..22e43d80 100644
--- a/src/enums.h
+++ b/src/enums.h
@@ -42,6 +42,7 @@ enum query_status {
 	QUERY_BLACKLIST_CNAME,
 	QUERY_RETRIED,
 	QUERY_RETRIED_DNSSEC,
+	QUERY_IN_PROGRESS,
 	QUERY_STATUS_MAX
 } __attribute__ ((packed));
 
diff --git a/src/gc.c b/src/gc.c
index b7960d2d..f29409bf 100644
--- a/src/gc.c
+++ b/src/gc.c
@@ -128,6 +128,11 @@ void *GC_thread(void *val)
 						if(client != NULL)
 							change_clientcount(client, 0, -1, -1, 0);
 						break;
+					case QUERY_IN_PROGRESS:
+						// Nothing to be done here, this was a duplicated query. It
+						// wasn't forwarded on its own to save some traffic (and
+						// reduce the attack surface for cache spoofing)
+						break;
 					case QUERY_STATUS_MAX: // fall through
 					default:
 						/* That cannot happen */

From cff76ba8bfba45b591bc4bd0971e97be93644bd8 Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Sun, 24 Jan 2021 16:43:59 +0100
Subject: [PATCH 06/11] When seeing duplicated queries, the original query may
 have been blocked during CNAME inspection. In this case, we need to change
 the status from "OK (already forwarded)" to the correspondig blocked status.
 The "already forwarded" information is lost but that seems okay.

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 src/dnsmasq_interface.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/dnsmasq_interface.c b/src/dnsmasq_interface.c
index ddc919d2..baaebd82 100644
--- a/src/dnsmasq_interface.c
+++ b/src/dnsmasq_interface.c
@@ -2278,6 +2278,12 @@ void FTL_duplicate_reply(const int id, int *firstID)
 	duplicated_query->dnssec = source_query->dnssec;
 	duplicated_query->flags.complete = true;
 
+	// The original query may have been blocked during CNAME inspection,
+	// correct status in this case
+	if(duplicated_query->status != QUERY_FORWARDED)
+		duplicated_query->status = source_query->status;
+	duplicated_query->CNAME_domainID = source_query->CNAME_domainID;
+
 	// Unlock shared memory
 	unlock_shm();
 }

From 1d09122f8d7c3b4d8ef0851c8f06f9917a571e71 Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Mon, 25 Jan 2021 18:57:55 +0100
Subject: [PATCH 07/11] Check source query for its status when checking if we
 need to update the duplicated ones

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 src/dnsmasq_interface.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/dnsmasq_interface.c b/src/dnsmasq_interface.c
index baaebd82..eafb3701 100644
--- a/src/dnsmasq_interface.c
+++ b/src/dnsmasq_interface.c
@@ -2280,7 +2280,7 @@ void FTL_duplicate_reply(const int id, int *firstID)
 
 	// The original query may have been blocked during CNAME inspection,
 	// correct status in this case
-	if(duplicated_query->status != QUERY_FORWARDED)
+	if(source_query->status != QUERY_FORWARDED)
 		duplicated_query->status = source_query->status;
 	duplicated_query->CNAME_domainID = source_query->CNAME_domainID;
 

From 364763975a92400cb2ceb25b15933cebcec27675 Mon Sep 17 00:00:00 2001
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Fri, 22 Jan 2021 22:50:25 +0000
Subject: [PATCH 08/11] Tidy initialisation in hash_questions.c

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 src/dnsmasq/dnsmasq.c        |  2 +-
 src/dnsmasq/dnsmasq.h        |  1 +
 src/dnsmasq/hash_questions.c | 32 ++++++++++++++++----------------
 3 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/src/dnsmasq/dnsmasq.c b/src/dnsmasq/dnsmasq.c
index 04007aae..4a0d2883 100644
--- a/src/dnsmasq/dnsmasq.c
+++ b/src/dnsmasq/dnsmasq.c
@@ -392,8 +392,8 @@ int main_dnsmasq (int argc, char **argv)
   if (daemon->port != 0)
     {
       cache_init();
-
       blockdata_init();
+      hash_questions_init();
     }
 
 #ifdef HAVE_INOTIFY
diff --git a/src/dnsmasq/dnsmasq.h b/src/dnsmasq/dnsmasq.h
index abb87424..41c682fd 100644
--- a/src/dnsmasq/dnsmasq.h
+++ b/src/dnsmasq/dnsmasq.h
@@ -1266,6 +1266,7 @@ size_t filter_rrsigs(struct dns_header *header, size_t plen);
 int setup_timestamp(void);
 
 /* hash_questions.c */
+void hash_questions_init(void);
 unsigned char *hash_questions(struct dns_header *header, size_t plen, char *name);
 
 /* crypto.c */
diff --git a/src/dnsmasq/hash_questions.c b/src/dnsmasq/hash_questions.c
index 51d88c28..fad32d7e 100644
--- a/src/dnsmasq/hash_questions.c
+++ b/src/dnsmasq/hash_questions.c
@@ -29,27 +29,24 @@
 #include "dnsmasq.h"
 
 #if defined(HAVE_DNSSEC) || defined(HAVE_NETTLEHASH)
+
+static const struct nettle_hash *hash;
+static void *ctx;
+static unsigned char *digest;
+
+void hash_questions_init(void)
+{
+  if (!(hash = hash_find("sha256")) || !hash_init(hash, &ctx, &digest))
+    die(_("Failed to create SHA-256 hash object"), NULL, EC_MISC);
+}
+
 unsigned char *hash_questions(struct dns_header *header, size_t plen, char *name)
 {
   int q;
   unsigned char *p = (unsigned char *)(header+1);
-  const struct nettle_hash *hash;
-  void *ctx;
-  unsigned char *digest;
-  
-  if (!(hash = hash_find("sha256")) || !hash_init(hash, &ctx, &digest))
-    {
-      /* don't think this can ever happen. */
-      static unsigned char dummy[HASH_SIZE];
-      static int warned = 0;
 
-      if (!warned)
-	my_syslog(LOG_ERR, _("Failed to create SHA-256 hash object"));
-      warned = 1;
-     
-      return dummy;
-    }
-  
+  hash->init(ctx);
+
   for (q = ntohs(header->qdcount); q != 0; q--) 
     {
       char *cp, c;
@@ -91,6 +88,9 @@ static void sha256_init(SHA256_CTX *ctx);
 static void sha256_update(SHA256_CTX *ctx, const BYTE data[], size_t len);
 static void sha256_final(SHA256_CTX *ctx, BYTE hash[]);
 
+void hash_questions_init(void)
+{
+}
 
 unsigned char *hash_questions(struct dns_header *header, size_t plen, char *name)
 {

From e14301354445a16ba15b485aed2365cde47a0450 Mon Sep 17 00:00:00 2001
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Sun, 24 Jan 2021 21:53:28 +0000
Subject: [PATCH 09/11] Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH.

HAVE_NETTLEHASH is retained for backwards compatibility, but deprecated.

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 src/dnsmasq/config.h         | 10 +++++-----
 src/dnsmasq/crypto.c         |  2 +-
 src/dnsmasq/dnsmasq.h        |  6 +++++-
 src/dnsmasq/hash_questions.c |  4 ++--
 4 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/src/dnsmasq/config.h b/src/dnsmasq/config.h
index 2c4eb3a4..2fe759d7 100644
--- a/src/dnsmasq/config.h
+++ b/src/dnsmasq/config.h
@@ -122,8 +122,8 @@ HAVE_AUTH
    define this to include the facility to act as an authoritative DNS
    server for one or more zones.
 
-HAVE_NETTLEHASH
-   include just hash function from nettle, but no DNSSEC.
+HAVE_CRYPTOHASH
+   include just hash function from crypto library, but no DNSSEC.
 
 HAVE_DNSSEC
    include DNSSEC validator.
@@ -192,7 +192,7 @@ RESOLVFILE
 /* #define HAVE_IDN */
 /* #define HAVE_LIBIDN2 */
 /* #define HAVE_CONNTRACK */
-/* #define HAVE_NETTLEHASH */
+/* #define HAVE_CRYPTOHASH */
 /* #define HAVE_DNSSEC */
 
 
@@ -426,10 +426,10 @@ static char *compile_opts =
 "no-"
 #endif
 "auth "
-#if !defined(HAVE_NETTLEHASH) && !defined(HAVE_DNSSEC)
+#if !defined(HAVE_CRYPTOHASH) && !defined(HAVE_DNSSEC)
 "no-"
 #endif
-"nettlehash "
+"cryptohash "
 #ifndef HAVE_DNSSEC
 "no-"
 #endif
diff --git a/src/dnsmasq/crypto.c b/src/dnsmasq/crypto.c
index 09525d2f..5f4c390e 100644
--- a/src/dnsmasq/crypto.c
+++ b/src/dnsmasq/crypto.c
@@ -27,7 +27,7 @@
 #endif
 #endif
 
-#if defined(HAVE_DNSSEC) || defined(HAVE_NETTLEHASH)
+#if defined(HAVE_DNSSEC) || defined(HAVE_CRYPTOHASH)
 #include <nettle/nettle-meta.h>
 #include <nettle/bignum.h>
 
diff --git a/src/dnsmasq/dnsmasq.h b/src/dnsmasq/dnsmasq.h
index 41c682fd..86939cc9 100644
--- a/src/dnsmasq/dnsmasq.h
+++ b/src/dnsmasq/dnsmasq.h
@@ -157,7 +157,11 @@ extern int capget(cap_user_header_t header, cap_user_data_t data);
 #include <priv.h>
 #endif
 
-#if defined(HAVE_DNSSEC) || defined(HAVE_NETTLEHASH)
+/* Backwards compat with 2.83 */
+#if defined(HAVE_NETTLEHASH)
+#  define HAVE_CRYPTOHASH
+#endif
+#if defined(HAVE_DNSSEC) || defined(HAVE_CRYPTOHASH)
 #  include <nettle/nettle-meta.h>
 #endif
 
diff --git a/src/dnsmasq/hash_questions.c b/src/dnsmasq/hash_questions.c
index fad32d7e..8b96505e 100644
--- a/src/dnsmasq/hash_questions.c
+++ b/src/dnsmasq/hash_questions.c
@@ -28,7 +28,7 @@
 
 #include "dnsmasq.h"
 
-#if defined(HAVE_DNSSEC) || defined(HAVE_NETTLEHASH)
+#if defined(HAVE_DNSSEC) || defined(HAVE_CRYPTOHASH)
 
 static const struct nettle_hash *hash;
 static void *ctx;
@@ -71,7 +71,7 @@ unsigned char *hash_questions(struct dns_header *header, size_t plen, char *name
   return digest;
 }
 
-#else /* HAVE_DNSSEC */
+#else /* HAVE_DNSSEC  || HAVE_CRYPTOHASH */
 
 #define SHA256_BLOCK_SIZE 32            // SHA256 outputs a 32 byte digest
 typedef unsigned char BYTE;             // 8-bit byte

From db8c788df14b737007488e9e9b8f2719ac6a5c13 Mon Sep 17 00:00:00 2001
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Sun, 24 Jan 2021 21:59:37 +0000
Subject: [PATCH 10/11] Bump copyright notices for 2021. Happy New Year!

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 src/dnsmasq/arp.c            | 2 +-
 src/dnsmasq/auth.c           | 2 +-
 src/dnsmasq/blockdata.c      | 2 +-
 src/dnsmasq/bpf.c            | 2 +-
 src/dnsmasq/cache.c          | 2 +-
 src/dnsmasq/config.h         | 2 +-
 src/dnsmasq/conntrack.c      | 2 +-
 src/dnsmasq/crypto.c         | 2 +-
 src/dnsmasq/dbus.c           | 2 +-
 src/dnsmasq/dhcp-common.c    | 2 +-
 src/dnsmasq/dhcp-protocol.h  | 2 +-
 src/dnsmasq/dhcp.c           | 2 +-
 src/dnsmasq/dhcp6-protocol.h | 2 +-
 src/dnsmasq/dhcp6.c          | 2 +-
 src/dnsmasq/dns-protocol.h   | 2 +-
 src/dnsmasq/dnsmasq.c        | 2 +-
 src/dnsmasq/dnsmasq.h        | 4 ++--
 src/dnsmasq/domain.c         | 2 +-
 src/dnsmasq/dump.c           | 2 +-
 src/dnsmasq/edns0.c          | 2 +-
 src/dnsmasq/forward.c        | 2 +-
 src/dnsmasq/helper.c         | 2 +-
 src/dnsmasq/inotify.c        | 2 +-
 src/dnsmasq/ip6addr.h        | 2 +-
 src/dnsmasq/lease.c          | 2 +-
 src/dnsmasq/log.c            | 2 +-
 src/dnsmasq/loop.c           | 2 +-
 src/dnsmasq/metrics.c        | 2 +-
 src/dnsmasq/metrics.h        | 2 +-
 src/dnsmasq/netlink.c        | 2 +-
 src/dnsmasq/network.c        | 2 +-
 src/dnsmasq/option.c         | 2 +-
 src/dnsmasq/outpacket.c      | 2 +-
 src/dnsmasq/poll.c           | 2 +-
 src/dnsmasq/radv-protocol.h  | 2 +-
 src/dnsmasq/radv.c           | 2 +-
 src/dnsmasq/rfc1035.c        | 2 +-
 src/dnsmasq/rfc2131.c        | 2 +-
 src/dnsmasq/rfc3315.c        | 2 +-
 src/dnsmasq/rrfilter.c       | 2 +-
 src/dnsmasq/slaac.c          | 2 +-
 src/dnsmasq/tftp.c           | 2 +-
 src/dnsmasq/ubus.c           | 2 +-
 src/dnsmasq/util.c           | 2 +-
 44 files changed, 45 insertions(+), 45 deletions(-)

diff --git a/src/dnsmasq/arp.c b/src/dnsmasq/arp.c
index 3329d6d6..2503ce49 100644
--- a/src/dnsmasq/arp.c
+++ b/src/dnsmasq/arp.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/auth.c b/src/dnsmasq/auth.c
index b2fcd4b6..d0263b16 100644
--- a/src/dnsmasq/auth.c
+++ b/src/dnsmasq/auth.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/blockdata.c b/src/dnsmasq/blockdata.c
index f33b28e8..dc818837 100644
--- a/src/dnsmasq/blockdata.c
+++ b/src/dnsmasq/blockdata.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/bpf.c b/src/dnsmasq/bpf.c
index 0ac1c8fd..82d215a9 100644
--- a/src/dnsmasq/bpf.c
+++ b/src/dnsmasq/bpf.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/cache.c b/src/dnsmasq/cache.c
index 00bdb36c..39b440bf 100644
--- a/src/dnsmasq/cache.c
+++ b/src/dnsmasq/cache.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/config.h b/src/dnsmasq/config.h
index 2fe759d7..4e885e5c 100644
--- a/src/dnsmasq/config.h
+++ b/src/dnsmasq/config.h
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/conntrack.c b/src/dnsmasq/conntrack.c
index 33f5ceb5..7ec20833 100644
--- a/src/dnsmasq/conntrack.c
+++ b/src/dnsmasq/conntrack.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/crypto.c b/src/dnsmasq/crypto.c
index 5f4c390e..9e83719d 100644
--- a/src/dnsmasq/crypto.c
+++ b/src/dnsmasq/crypto.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/dbus.c b/src/dnsmasq/dbus.c
index 6def1296..2516483b 100644
--- a/src/dnsmasq/dbus.c
+++ b/src/dnsmasq/dbus.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/dhcp-common.c b/src/dnsmasq/dhcp-common.c
index 2c5c316f..480ed225 100644
--- a/src/dnsmasq/dhcp-common.c
+++ b/src/dnsmasq/dhcp-common.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/dhcp-protocol.h b/src/dnsmasq/dhcp-protocol.h
index e9007c87..6ff3ffa2 100644
--- a/src/dnsmasq/dhcp-protocol.h
+++ b/src/dnsmasq/dhcp-protocol.h
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/dhcp.c b/src/dnsmasq/dhcp.c
index bea46881..97324f23 100644
--- a/src/dnsmasq/dhcp.c
+++ b/src/dnsmasq/dhcp.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/dhcp6-protocol.h b/src/dnsmasq/dhcp6-protocol.h
index 48b027b0..5277c22c 100644
--- a/src/dnsmasq/dhcp6-protocol.h
+++ b/src/dnsmasq/dhcp6-protocol.h
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/dhcp6.c b/src/dnsmasq/dhcp6.c
index 096e2e17..9901e1bb 100644
--- a/src/dnsmasq/dhcp6.c
+++ b/src/dnsmasq/dhcp6.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/dns-protocol.h b/src/dnsmasq/dns-protocol.h
index 8edb9f3f..941bea6a 100644
--- a/src/dnsmasq/dns-protocol.h
+++ b/src/dnsmasq/dns-protocol.h
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/dnsmasq.c b/src/dnsmasq/dnsmasq.c
index 4a0d2883..e76851c2 100644
--- a/src/dnsmasq/dnsmasq.c
+++ b/src/dnsmasq/dnsmasq.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/dnsmasq.h b/src/dnsmasq/dnsmasq.h
index 86939cc9..dbb0db52 100644
--- a/src/dnsmasq/dnsmasq.h
+++ b/src/dnsmasq/dnsmasq.h
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
  
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -14,7 +14,7 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-#define COPYRIGHT "Copyright (c) 2000-2020 Simon Kelley"
+#define COPYRIGHT "Copyright (c) 2000-2021 Simon Kelley"
 
 /* We do defines that influence behavior of stdio.h, so complain
    if included too early. */
diff --git a/src/dnsmasq/domain.c b/src/dnsmasq/domain.c
index 3dc96abc..189bdd15 100644
--- a/src/dnsmasq/domain.c
+++ b/src/dnsmasq/domain.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/dump.c b/src/dnsmasq/dump.c
index 9bd3a5f9..c131953a 100644
--- a/src/dnsmasq/dump.c
+++ b/src/dnsmasq/dump.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/edns0.c b/src/dnsmasq/edns0.c
index 53cfe240..c85b3188 100644
--- a/src/dnsmasq/edns0.c
+++ b/src/dnsmasq/edns0.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/forward.c b/src/dnsmasq/forward.c
index 0cc8b2fe..035d8482 100644
--- a/src/dnsmasq/forward.c
+++ b/src/dnsmasq/forward.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/helper.c b/src/dnsmasq/helper.c
index 8cfa1c42..ac0412fd 100644
--- a/src/dnsmasq/helper.c
+++ b/src/dnsmasq/helper.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/inotify.c b/src/dnsmasq/inotify.c
index d5804cbc..b87798b0 100644
--- a/src/dnsmasq/inotify.c
+++ b/src/dnsmasq/inotify.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
  
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/ip6addr.h b/src/dnsmasq/ip6addr.h
index 352b3300..c00dd08e 100644
--- a/src/dnsmasq/ip6addr.h
+++ b/src/dnsmasq/ip6addr.h
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/lease.c b/src/dnsmasq/lease.c
index 23e6fe0a..ecfe7c3a 100644
--- a/src/dnsmasq/lease.c
+++ b/src/dnsmasq/lease.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/log.c b/src/dnsmasq/log.c
index 85a5f3fd..5ea72bf4 100644
--- a/src/dnsmasq/log.c
+++ b/src/dnsmasq/log.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/loop.c b/src/dnsmasq/loop.c
index 78e1238d..15e34c71 100644
--- a/src/dnsmasq/loop.c
+++ b/src/dnsmasq/loop.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/metrics.c b/src/dnsmasq/metrics.c
index 79f20b0d..fac5b005 100644
--- a/src/dnsmasq/metrics.c
+++ b/src/dnsmasq/metrics.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/metrics.h b/src/dnsmasq/metrics.h
index ccc92a86..cecf8c83 100644
--- a/src/dnsmasq/metrics.h
+++ b/src/dnsmasq/metrics.h
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/netlink.c b/src/dnsmasq/netlink.c
index 8e8431fa..04940707 100644
--- a/src/dnsmasq/netlink.c
+++ b/src/dnsmasq/netlink.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/network.c b/src/dnsmasq/network.c
index 323d446c..8073cabf 100644
--- a/src/dnsmasq/network.c
+++ b/src/dnsmasq/network.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/option.c b/src/dnsmasq/option.c
index 2e61f4fb..2c50a2a7 100644
--- a/src/dnsmasq/option.c
+++ b/src/dnsmasq/option.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/outpacket.c b/src/dnsmasq/outpacket.c
index 50513dc3..da6f73cb 100644
--- a/src/dnsmasq/outpacket.c
+++ b/src/dnsmasq/outpacket.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/poll.c b/src/dnsmasq/poll.c
index 24d01bb1..f4146905 100644
--- a/src/dnsmasq/poll.c
+++ b/src/dnsmasq/poll.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/radv-protocol.h b/src/dnsmasq/radv-protocol.h
index edc15327..dccd4e1e 100644
--- a/src/dnsmasq/radv-protocol.h
+++ b/src/dnsmasq/radv-protocol.h
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/radv.c b/src/dnsmasq/radv.c
index 41df852e..3255904b 100644
--- a/src/dnsmasq/radv.c
+++ b/src/dnsmasq/radv.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/rfc1035.c b/src/dnsmasq/rfc1035.c
index 013fbf14..d24f9faa 100644
--- a/src/dnsmasq/rfc1035.c
+++ b/src/dnsmasq/rfc1035.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/rfc2131.c b/src/dnsmasq/rfc2131.c
index d6780685..3f507550 100644
--- a/src/dnsmasq/rfc2131.c
+++ b/src/dnsmasq/rfc2131.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/rfc3315.c b/src/dnsmasq/rfc3315.c
index b3f0a0a0..982c68a7 100644
--- a/src/dnsmasq/rfc3315.c
+++ b/src/dnsmasq/rfc3315.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/rrfilter.c b/src/dnsmasq/rrfilter.c
index 16e6b554..58c6d8ff 100644
--- a/src/dnsmasq/rrfilter.c
+++ b/src/dnsmasq/rrfilter.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/slaac.c b/src/dnsmasq/slaac.c
index 4a3e01d2..9b100630 100644
--- a/src/dnsmasq/slaac.c
+++ b/src/dnsmasq/slaac.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/tftp.c b/src/dnsmasq/tftp.c
index aa240e5b..846b32e3 100644
--- a/src/dnsmasq/tftp.c
+++ b/src/dnsmasq/tftp.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/ubus.c b/src/dnsmasq/ubus.c
index 5f812877..33c27832 100644
--- a/src/dnsmasq/ubus.c
+++ b/src/dnsmasq/ubus.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/src/dnsmasq/util.c b/src/dnsmasq/util.c
index 5f13027d..972c60b7 100644
--- a/src/dnsmasq/util.c
+++ b/src/dnsmasq/util.c
@@ -1,4 +1,4 @@
-/* dnsmasq is Copyright (c) 2000-2020 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by

From 0d57aa0ba94bc12151fe4d2ac796ea7e56b737ed Mon Sep 17 00:00:00 2001
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Sun, 24 Jan 2021 22:25:13 +0000
Subject: [PATCH 11/11] Fix possible free-memory ref in
 e75069f79aa6b8a61034a9a4db9b6265b8be8ae4

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 src/dnsmasq/hash_questions.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/dnsmasq/hash_questions.c b/src/dnsmasq/hash_questions.c
index 8b96505e..8e1559ff 100644
--- a/src/dnsmasq/hash_questions.c
+++ b/src/dnsmasq/hash_questions.c
@@ -36,8 +36,11 @@ static unsigned char *digest;
 
 void hash_questions_init(void)
 {
-  if (!(hash = hash_find("sha256")) || !hash_init(hash, &ctx, &digest))
+  if (!(hash = hash_find("sha256")))
     die(_("Failed to create SHA-256 hash object"), NULL, EC_MISC);
+
+  ctx = safe_malloc(hash->context_size);
+  digest = safe_malloc(hash->digest_size);
 }
 
 unsigned char *hash_questions(struct dns_header *header, size_t plen, char *name)