dnsmasq详解以及在openstack和容器中的使用

dnsmasq简介

了解Dnsmasq，还是从研究openstack neutron网络开始的，在openstack的网络中，dnsmasq为指定网络提供dhcp和dns功能，后台起的进程如下：

dnsmasq --no-hosts --no-resolv --strict-order --except-interface=lo --pid-file=/var/lib/neutron/dhcp/35b593af-7e57-4a4b-8346-975d227c557c/pid --dhcp-hostsfile=/var/lib/neutron/dhcp/35b593af-7e57-4a4b-8346-975d227c557c/host --addn-hosts=/var/lib/neutron/dhcp/35b593af-7e57-4a4b-8346-975d227c557c/addn_hosts --dhcp-optsfile=/var/lib/neutron/dhcp/35b593af-7e57-4a4b-8346-975d227c557c/opts --dhcp-leasefile=/var/lib/neutron/dhcp/35b593af-7e57-4a4b-8346-975d227c557c/leases --dhcp-match=set:ipxe,175 --bind-interfaces --interface=tap3043df67-be --dhcp-range=set:tag0,10.1.0.0,static,86400s --dhcp-option-force=option:mtu,1450 --dhcp-lease-max=256 --conf-file=/etc/neutron/dnsmasq.conf --server=8.8.8.8 --server=8.8.4.4 --domain=sample.openstack.org.

该进程在开启子网的dhcp或者dns功能时启动，如果在同一网络下开启多个子网的dhcp或者dns功能，那么会修改该网络下首次开启dnsmasq的进程。也就是说，如果第一个子网开启了dnsmasq进程，那么后面创建的通网络下面的子网不会重新启动新的进程，而是会修改第一次启动的进程。如下：
一个子网开启dnsmasq进程：

dnsmasq --no-hosts --no-resolv --strict-order --except-interface=lo --pid-file=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/pid --dhcp-hostsfile=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/host --addn-hosts=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/addn_hosts --dhcp-optsfile=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/opts --dhcp-leasefile=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/leases --dhcp-match=set:ipxe,175 --bind-interfaces --interface=tapf2df91fa-f7 --dhcp-range=set:tag0,10.10.0.0,static,255.255.0.0,86400s --dhcp-option-force=option:mtu,1450 --dhcp-lease-max=65536 --conf-file=/etc/neutron/dnsmasq.conf --server=8.8.8.8 --server=8.8.4.4 --domain=openstacklocal

两个子网开启dnsmasq进程：

dnsmasq --no-hosts --no-resolv --strict-order --except-interface=lo --pid-file=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/pid --dhcp-hostsfile=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/host --addn-hosts=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/addn_hosts --dhcp-optsfile=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/opts --dhcp-leasefile=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/leases --dhcp-match=set:ipxe,175 --bind-interfaces --interface=tapf2df91fa-f7 --dhcp-range=set:tag0,10.10.0.0,static,255.255.0.0,86400s --dhcp-range=set:tag1,10.11.0.0,static,255.255.255.0,86400s --dhcp-option-force=option:mtu,1450 --dhcp-lease-max=65792 --conf-file=/etc/neutron/dnsmasq.conf --server=8.8.8.8 --server=8.8.4.4 --domain=openstacklocal

我们会发现：多开启一个子网的dhcp或则dns功能，只会在首次创建的dnsmasq进程上修改，增加第二次子网的相关信息，比如：--dhcp-range=set:tag1,10.11.0.0,static,255.255.255.0,86400s。关于openstack的dnsmasq就简单说到这里，下面我们来具体说下dnsmasq的整体功能。

Dnsmasq （dnsmasq）
       提供 DNS 缓存和 DHCP 服务功能。作为域名解析服务器(DNS)，dnsmasq可以通过缓存 DNS 请求来提高我们对访问过的网址的连接速度。而作为DHCP 服务器，dnsmasq 可以为局域网（比如openstack中的网络）电脑（云主机）提供内网ip地址和路由。DNS和DHCP两个功能可以同时或分别单独实现。dnsmasq轻量且易配置，适用于个人用户或少于50台主机的网络。

dnsmasq配置文件

下面说一下dnsmasq的配置，dnsmasq的配置文件在/etc/dnsmasq.conf，也可能会因为你linux版本的不同位于/etc/default/dnsmasq、/etc/dnsmasq.d/，或者 /etc/dnsmasq.d-available/目录下，我们也可以在启动dnsmasq的进程时指定配置文件地址或者在配置文件里面通过conf-file= 选项来调用其他的配置文件，这些根据需求可以灵活定义。
下面是摘自dnsmasq.conf里面比较重要且常使用的一些配置项以及简短说明：

不读取任何服务器 默认 /etc/resolv.conf 可以使用resolv-file自定义
不加载本地的 /etc/hosts 文件

#no-hosts

添加读取额外的 hosts 文件路径，可以多次指定。如果指定为目录，则读取目录中的所有文件。

#addn-hosts=/etc/dnsmasq.hosts.d

读取目录中的所有文件，文件更新将自动读取

#hostsdir=/etc/dnsmasq.hosts.d

指定用户和组

#user=nobody
#group=nobody

指定DNS的端口，默认53，设置 port=0 将完全禁用 DNS 功能，仅使用 DHCP/TFTP

#port=53

设置DNS缓存大小（单位：DNS解析条数）

#cache-size=500

不缓存未知域名缓存，默认情况下dnsmasq缓存未知域名并直接返回为客户端。

#no-negcache

 指定DNS同属查询转发数量

#dns-forward-max=1000

定义dnsmasq监听的地址，默认是监控本机的所有网卡上。局域网内主机若要使用dnsmasq服务时，指定本机的IP地址。

#listen-address=192.168.26.111

address启用泛域名解析，即自定义解析a记录，如下：访问demon.com时的所有域名都会被解析成127.0.0.1

#address=/demon.com/127.0.0.1 

#server指定dnsmasq程序使用哪个DNS服务器进行解析，对于不同的网站可以使用不同的域名对应解析
#表示对于google的服务，使用谷歌的DNS解析

#server=/google.com/8.8.8.8

定义dnsmasq从哪里获取上游DNS服务器的地址， 默认是从/etc/resolv.conf获取

#resolve-file

表示严格按照resolv-file文件中的顺序从上到下进行DNS解析，直到第一个解析成功为止

#strict-order　　   

绑定接口，开启此项将仅监听指定的接口。

#bind-interfaces

对于新添加的接口也进行绑定。

#bind-dynamic

限制 Dnsmasq 监听的网络接口

#interface=eth0

指定需要排除监听的接口，排除优先级高，可以使用'*'通配符

#except-interface=

指定不提供 DHCP 或 TFTP 服务的接口，仅提供 DNS 服务。

#no-dhcp-interface=eth0

dhcp动态分配的地址范围

dhcp-range=10.10.10.10,10.10.10.100,24h

dhcp服务的静态绑定

# dhcp-host=00:0C:38:52:42:61,10.10.10.11
# dhcp-host=00:0C:38:52:43:62,10.10.10.12,infinite    无限租期
dhcp-host=00:0C:38:52:44:64,10.10.10.13,OS13
dhcp-host=00:0C:38:52:45:65,10.10.10.14,0S14

设置默认租期

#dhcp-lease-max=150

租期保存在下面文件

#dhcp-leasefile=/var/lib/dnsmasq/dnsmasq.leases

 忽略下面MAC地址的DHCP请求

#dhcp-host=11:22:33:44:55:66,ignore

 dhcp所在的domain

#domain=test.com

设置默认路由出口，option 3为default route, 10.10.10.1为网关

#dhcp-option=3,10.10.10.1

dnsmasq命令行以及在openstack中的进程参数解析

看完配置文件，我们再来看下dnsmasq进程有那些参数可以配置：
可以参考英文文档：dnsmasq命令行参数解析

dnsmasq --test 测试配置是否正确
    -w, --help #帮助命令
    -v, --version #打印版本号
    -H, --addn-hosts= 
    --hostsdir= 
    -d, --no-daemon #前台运行该进程
    -x, --pid-file= 将进程的pid号写到指定文件
    -I, --except-interface=
    -2, --no-dhcp-interface=    
    -a, --listen-address=
    -z, --bind-interfaces
    --ignore-address=
    -r, --resolv-file=
    -R, --no-resolv
    -o, --strict-order
    -S, --local, --server=[/[]/[domain/]][[#][@|[#]]
    -G, --dhcp-host=[][,id:|*][,set:][,][,][,][,ignore]
    --dhcp-hostsfile=
    --dhcp-optsfile=

上面是一些常用的配置项，没有解释的可以查看上文的配置文件解析

下面我们就上面的配置解析一下openstack中dnsmasq的进程参数：

dnsmasq --no-hosts #不加载本地的 /etc/hosts 文件
                --no-resolv #不读取/etc/resolv.conf.，获取dns只从命令行或者dnsmasq配置文件读取
                --strict-order  #严格按照resolv.conf中的顺序进行查找
                --except-interface=lo #不监听lo网卡
                --pid-file=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/pid 保存dnsmasq进程pid号的文件
               --dhcp-hostsfile=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/host 读取该文件保存的dhcp 主机信息
               --addn-hosts=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/addn_hosts  #添加读取额外的 hosts 文件路径
               --dhcp-optsfile=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/opts #从指定的文件中读取DHCP选项信息
               --dhcp-leasefile=/var/lib/neutron/dhcp/07b37097-c902-4f19-9214-6e23befd476b/leases #保存租约的文件
               --dhcp-match=set:ipxe,175 #设置dhcp tag
               --bind-interfaces #绑定接口，开启此项将仅监听指定的接口
               --interface=tapf2df91fa-f7  #要监听的端口
               --dhcp-range=set:tag0,10.10.0.0,static,255.255.0.0,86400s  #1）设置网络的tag,2)dhcp监听的网络范围 3）static表示dnsmasq为指定的网络启用DHCP，而不是动态分配IP地址 4）租约时间
               --dhcp-option-force=option:mtu,1450  为DHCP客户端指定不同的或额外的选项，这里为客户端指定mtu=1450
              --dhcp-lease-max=65536 指定dnsmasq为dhcp提供租约的最大个数，默认为1000
               --conf-file=/etc/neutron/dnsmasq.conf #调用其他的配置文件
               --server=8.8.8.8 --server=8.8.4.4 #指定上游域名服务器
               --domain=openstacklocal #为dhcp服务指定dns域名

 

dnsmasq安装

  容器中也是一样安装dnsmasq，下面安装是针对centos7版本的：

[root@test centos]# yum install dnsmasq
base                                                                                                                                                | 3.6 kB  00:00:00     
epel                                                                                                                                                | 3.2 kB  00:00:00     
extras                                                                                                                                              | 3.4 kB  00:00:00     
updates                                                                                                                                             | 3.4 kB  00:00:00     
(1/7): epel/x86_64/group_gz                                                                                                                         |  88 kB  00:00:00     
(2/7): base/7/x86_64/group_gz                                                                                                                       | 166 kB  00:00:00     
(3/7): epel/x86_64/updateinfo                                                                                                                       | 932 kB  00:00:00     
(4/7): base/7/x86_64/primary_db                                                                                                                     | 5.9 MB  00:00:00     
(5/7): epel/x86_64/primary                                                                                                                          | 3.6 MB  00:00:00     
(6/7): extras/7/x86_64/primary_db                                                                                                                   | 174 kB  00:00:00     
(7/7): updates/7/x86_64/primary_db                                                                                                                  | 5.0 MB  00:00:00     
epel                                                                                                                                                           12650/12650
Resolving Dependencies
--> Running transaction check
---> Package dnsmasq.x86_64 0:2.76-5.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

===========================================================================================================================================================================
 Package                                  Arch                                    Version                                      Repository                             Size
===========================================================================================================================================================================
Installing:
 dnsmasq                                  x86_64                                  2.76-5.el7                                   base                                  277 k

Transaction Summary
===========================================================================================================================================================================
Install  1 Package

Total download size: 277 k
Installed size: 586 k
Is this ok [y/d/N]: y
Downloading packages:
warning: /var/cache/yum/x86_64/7/base/packages/dnsmasq-2.76-5.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Public key for dnsmasq-2.76-5.el7.x86_64.rpm is not installed
dnsmasq-2.76-5.el7.x86_64.rpm                                                                                                                       | 277 kB  00:00:00     
Retrieving key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
Importing GPG key 0xF4A80EB5:
 Userid     : "CentOS-7 Key (CentOS 7 Official Signing Key) "
 Fingerprint: 6341 ab27 53d7 8a78 a7c2 7bb1 24c6 a8a7 f4a8 0eb5
 Package    : centos-release-7-4.1708.el7.centos.x86_64 (installed)
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
Is this ok [y/N]: y
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : dnsmasq-2.76-5.el7.x86_64                                                                                                                               1/1 
  Verifying  : dnsmasq-2.76-5.el7.x86_64                                                                                                                               1/1 

Installed:
  dnsmasq.x86_64 0:2.76-5.el7                                                                                                                                              

Complete!

简单使用：

[root@test centos]# dnsmasq --test
dnsmasq: syntax check OK.

[root@test centos]# dnsmasq --version
Dnsmasq version 2.76  Copyright (c) 2000-2016 Simon Kelley
Compile time options: IPv6 GNU-getopt DBus no-i18n IDN DHCP DHCPv6 no-Lua TFTP no-conntrack ipset auth no-DNSSEC loop-detect inotify

This software comes with ABSOLUTELY NO WARRANTY.
Dnsmasq is free software, and you are welcome to redistribute it
under the terms of the GNU General Public License, version 2 or 3.

[root@test centos]# dnsmasq --help
Usage: dnsmasq [options]

Valid options are:
-a, --listen-address=           Specify local address(es) to listen on.
-A, --address=//        Return ipaddr for all hosts in specified domains.
-b, --bogus-priv                        Fake reverse lookups for RFC1918 private address ranges.
-B, --bogus-nxdomain=           Treat ipaddr as NXDOMAIN (defeats Verisign wildcard).
-c, --cache-size=              Specify the size of the cache in entries (defaults to 150).
-C, --conf-file=                  Specify configuration file (defaults to /etc/dnsmasq.conf).
-d, --no-daemon                         Do NOT fork into the background: run in debug mode.
-D, --domain-needed                     Do NOT forward queries with no domain part.
-e, --selfmx                            Return self-pointing MX records for local hosts.
-E, --expand-hosts                      Expand simple names in /etc/hosts with domain-suffix.
-f, --filterwin2k                       Don't forward spurious DNS requests from Windows hosts.
-F, --dhcp-range=,...           Enable DHCP in the range given with lease duration.
-g, --group=                 Change to this group after startup (defaults to dip).
-G, --dhcp-host=              Set address or hostname for a specified machine.
    --dhcp-hostsfile=             Read DHCP host specs from file.
    --dhcp-optsfile=              Read DHCP option specs from file.
    --dhcp-hostsdir=              Read DHCP host specs from a directory.
    --dhcp-optsdir=               Read DHCP options from a directory.
    --tag-if=tag-expression             Evaluate conditional tag expression.
-h, --no-hosts                          Do NOT load /etc/hosts file.
-H, --addn-hosts=                 Specify a hosts file to be read in addition to /etc/hosts.
    --hostsdir=                   Read hosts files from a directory.
-i, --interface=             Specify interface(s) to listen on.
-I, --except-interface=      Specify interface(s) NOT to listen on.
-j, --dhcp-userclass=set:,  Map DHCP user class to tag.
    --dhcp-circuitid=set:,Map RFC3046 circuit-id to tag.
    --dhcp-remoteid=set:,  Map RFC3046 remote-id to tag.
    --dhcp-subscrid=set:,  Map RFC3993 subscriber-id to tag.
-J, --dhcp-ignore=tag:...          Don't do DHCP for hosts with tag set.
    --dhcp-broadcast[=tag:...]     Force broadcast replies for hosts with tag set.
-k, --keep-in-foreground                Do NOT fork into the background, do NOT run in debug mode.
-K, --dhcp-authoritative                Assume we are the only DHCP server on the local network.
-l, --dhcp-leasefile=             Specify where to store DHCP leases (defaults to /var/lib/dnsmasq/dnsmasq.leases).
-L, --localmx                           Return MX records for local hosts.
-m, --mx-host=,,            Specify BOOTP options to DHCP server.
-n, --no-poll                           Do NOT poll /etc/resolv.conf file, reload only on SIGHUP.
-N, --no-negcache                       Do NOT cache failed search results.
-o, --strict-order                      Use nameservers strictly in the order given in /etc/resolv.conf.
-O, --dhcp-option=             Specify options to be sent to DHCP clients.
    --dhcp-option-force=       DHCP option sent even if the client does not request it.
-p, --port=                    Specify port to listen for DNS requests on (defaults to 53).
-P, --edns-packet-max=         Maximum supported UDP packet size for EDNS.0 (defaults to 4096).
-q, --log-queries                       Log DNS queries.
-Q, --query-port=              Force the originating port for upstream DNS queries.
-R, --no-resolv                         Do NOT read resolv.conf.
-r, --resolv-file=                Specify path to resolv.conf (defaults to /etc/resolv.conf).
    --servers-file=               Specify path to file with server= options
-S, --server=//         Specify address(es) of upstream servers with optional domains.
    --rev-server=/,/                  Never forward queries to specified domains.
-s, --domain=[,]         Specify the domain to be assigned in DHCP leases.
-t, --mx-target=             Specify default target in an MX record.
-T, --local-ttl=               Specify time-to-live in seconds for replies from /etc/hosts.
    --neg-ttl=                 Specify time-to-live in seconds for negative caching.
    --max-ttl=                 Specify time-to-live in seconds for maximum TTL to send to clients.
    --max-cache-ttl=           Specify time-to-live ceiling for cache.
    --min-cache-ttl=           Specify time-to-live floor for cache.
-u, --user=                   Change to this user after startup. (defaults to nobody).
-U, --dhcp-vendorclass=set:,Map DHCP vendor class to tag.
-v, --version                           Display dnsmasq version and copyright information.
-V, --alias=,, Translate IPv4 addresses from upstream servers.
-W, --srv-host=,,...      Specify a SRV record.
-w, --help                              Display this message. Use --help dhcp or --help dhcp6 for known DHCP options.
-x, --pid-file=                   Specify path of PID file (defaults to /var/run/dnsmasq.pid).
-X, --dhcp-lease-max=          Specify maximum number of DHCP leases (defaults to 1000).
-y, --localise-queries                  Answer DNS queries based on the interface a query was sent to.
-Y, --txt-record=,[,,        Specify PTR DNS record.
    --interface-name=, Give DNS name to IPv4 address of interface.
-z, --bind-interfaces                   Bind only to interfaces in use.
-Z, --read-ethers                       Read DHCP static host information from /etc/ethers.
-1, --enable-dbus[=]           Enable the DBus interface for setting upstream servers, etc.
-2, --no-dhcp-interface=     Do not provide DHCP on this interface, only provide DNS.
-3, --bootp-dynamic[=tag:]...      Enable dynamic address allocation for bootp.
-4, --dhcp-mac=set:,  Map MAC address (with wildcards) to option set.
    --bridge-interface=,..Treat DHCP requests on aliases as arriving from interface.
-5, --no-ping                           Disable ICMP echo address checking in the DHCP server.
-6, --dhcp-script=                Shell script to run on DHCP lease creation and destruction.
    --dhcp-luascript=path               Lua script to run on DHCP lease creation and destruction.
    --dhcp-scriptuser=        Run lease-change scripts as this user.
    --script-arp                        Call dhcp-script with changes to local ARP table.
-7, --conf-dir=                   Read configuration from all the files in this directory.
-8, --log-facility=|     Log to this syslog facility or file. (defaults to DAEMON)
-9, --leasefile-ro                      Do not use leasefile.
-0, --dns-forward-max=         Maximum number of concurrent DNS queries. (defaults to 150)
    --clear-on-reload                   Clear DNS cache when reloading /etc/resolv.conf.
    --dhcp-ignore-names[=tag:]...  Ignore hostnames provided by DHCP clients.
    --dhcp-no-override                  Do NOT reuse filename and server fields for extra DHCP options.
    --enable-tftp[=[,]]     Enable integrated read-only TFTP server.
    --tftp-root=[,]         Export files by TFTP only from the specified subtree.
    --tftp-unique-root                  Add client IP address to tftp-root.
    --tftp-secure                       Allow access only to files owned by the user running dnsmasq.
    --tftp-no-fail                      Do not terminate the service if TFTP directories are inaccessible.
    --tftp-max=                Maximum number of conncurrent TFTP transfers (defaults to 50).
    --tftp-mtu=                Maximum MTU to use for TFTP transfers.
    --tftp-no-blocksize                 Disable the TFTP blocksize extension.
    --tftp-lowercase                    Convert TFTP filenames to lowercase
    --tftp-port-range=,     Ephemeral port range for use by TFTP transfers.
    --log-dhcp                          Extra logging for DHCP.
    --log-async[=]             Enable async. logging; optionally set queue length.
    --stop-dns-rebind                   Stop DNS rebinding. Filter private IP ranges when resolving.
    --rebind-localhost-ok               Allow rebinding of 127.0.0.0/8, for RBL servers.
    --rebind-domain-ok=//       Inhibit DNS-rebind protection on this domain.
    --all-servers                       Always perform DNS queries to all servers.
    --dhcp-match=set:,    Set tag if client includes matching option in request.
    --dhcp-alternate-port[=]     Use alternative ports for DHCP.
    --naptr-record=,       Specify NAPTR DNS record.
    --min-port=                   Specify lowest port available for DNS query transmission.
    --max-port=                   Specify highest port available for DNS query transmission.
    --dhcp-fqdn                         Use only fully qualified domain names for DHCP clients.
    --dhcp-generate-names[=tag:]   Generate hostnames based on MAC address for nameless clients.
    --dhcp-proxy[=]...          Use these DHCP relays as full proxies.
    --dhcp-relay=,[,Relay DHCP requests to a remote server
    --cname=,[,]    Specify alias name for LOCAL DNS name.
    --pxe-prompt=,[]   Prompt to send to PXE clients.
    --pxe-service=             Boot service for PXE menu.
    --test                              Check configuration syntax.
    --add-mac[=base64|text]             Add requestor's MAC address to forwarded DNS queries.
    --add-subnet=[,]  Add specified IP subnet to forwarded DNS queries.
    --add-cpe-id=                 Add client identification to forwarded DNS queries.
    --proxy-dnssec                      Proxy DNSSEC validation results from upstream nameservers.
    --dhcp-sequential-ip                Attempt to allocate sequential IP addresses to DHCP clients.
    --conntrack                         Copy connection-track mark from queries to upstream connections.
    --dhcp-client-update                Allow DHCP clients to do their own DDNS updates.
    --enable-ra                         Send router-advertisements for interfaces doing DHCPv6
    --dhcp-duid=,     Specify DUID_EN-type DHCPv6 server DUID
    --host-record=,
[,,,[]Specify arbitrary DNS resource record
    --bind-dynamic                      Bind to interfaces in use - check for new interfaces
    --auth-server=,      Export local names to global DNS
    --auth-zone=,[...]  Domain to export to global DNS
    --auth-ttl=                Set TTL for authoritative replies
    --auth-soa=[,...]           Set authoritive zone information
    --auth-sec-servers=[,...]   Secondary authoritative nameservers for forward domains
    --auth-peer=[,...]  Peers which are allowed to do zone transfer
    --ipset=//[,..Specify ipsets to which matching domains should be added
    --synth-domain=,,[,[],..Specify trust anchor key digest.
    --dnssec-debug                      Disable upstream checking for DNSSEC debugging.
    --dnssec-check-unsigned             Ensure answers without DNSSEC are in unsigned zones.
    --dnssec-no-timecheck               Don't check DNSSEC signature timestamps until first cache-reload
    --dnssec-timestamp=           Timestamp file to verify system clock for DNSSEC
    --ra-param=,[high,|low,]           Ignore DNS responses containing ipaddr.
    --dhcp-ttl=                    Set TTL in DNS responses with DHCP-derived addresses.

dnsmasq测试环境搭建

简单的一个网络拓扑如下：在ovs+kvm环境中搭建如下网络，dnsmasq进程监听DHCP tap1设备，主机host1和host2发出的dhcp广播包被tap1接受，dnsmasq进程会到对应的host文件中找到匹配mac的ip并下发给主机，如果没找到，主机获取ip失败。

这个环境搭建请看：测试环境搭建

dnsmasq进程启动以及测试

将两个主机的mac写入到对应的host文件中：

[root@cnc dhcp]# pwd
/root/dnsmasq/dhcp
[root@cnc dhcp]# ls
host  pid
[root@cnc dhcp]# cat pid 
[root@cnc dhcp]# cat host 
52:54:00:aa:69:cc,10.10.10.20
52:54:00:aa:69:dd,10.10.10.30

启动进程：

[root@cnc ~]# dnsmasq --no-hosts --no-resolv --strict-order --except-interface=lo --pid-file=/root/dnsmasq/dhcp/pid --dhcp-hostsfile=/root/dnsmasq/dhcp/host --dhcp-match=set:ipxe,175 --bind-interfaces --interface=dhcp_tap --dhcp-range=10.10.10.1,static,86400s --dhcp-option-force=option:mtu,1450 --dhcp-lease-max=512 --dhcp-option=3,10.10.10.1 --dhcp-option=6,8.8.8.8

进入虚拟机进行自动获取ip测试：

[root@cnc ~]# virsh console 2
Connected to domain cirros-test-vm2
Escape character is ^]

$ sudo ifup eth0
udhcpc (v1.20.1) started
Sending discover...
Sending select for 10.10.10.30...
Lease of 10.10.10.30 obtained, lease time 86400
deleting routers
adding dns 8.8.8.8

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.10.10.1      0.0.0.0         UG    0      0        0 eth0
10.10.10.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0

[root@cnc dhcp]# virsh console 9
Connected to domain cirros-test-vm
Escape character is ^]

$ sudo ifup eth0
udhcpc (v1.20.1) started
Sending discover...
Sending select for 10.10.10.20...
Lease of 10.10.10.20 obtained, lease time 86400
deleting routers
adding dns 8.8.8.8
$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.10.10.1      0.0.0.0         UG    0      0        0 eth0
10.10.10.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0

[root@cnc ~]# dnsmasq -d --no-hosts --no-resolv --strict-order --except-interface=lo --pid-file=/root/dnsmasq/dhcp/pid --dhcp-hostsfile=/root/dnsmasq/dhcp/host --dhcp-match=set:ipxe,175 --bind-interfaces --interface=dhcp_tap --dhcp-range=10.10.10.1,static,86400s --dhcp-option-force=option:mtu,1450 --dhcp-lease-max=512 --dhcp-option=3,10.10.10.1 --dhcp-option=6,8.8.8.8
dnsmasq: started, version 2.76 cachesize 150
dnsmasq: compile time options: IPv6 GNU-getopt DBus no-i18n IDN DHCP DHCPv6 no-Lua TFTP no-conntrack ipset auth no-DNSSEC loop-detect inotify
dnsmasq: warning: no upstream servers configured
dnsmasq-dhcp: DHCP, static leases only on 10.10.10.1, lease time 1d
dnsmasq-dhcp: DHCP, sockets bound exclusively to interface dhcp_tap
dnsmasq: cleared cache
dnsmasq-dhcp: read /root/dnsmasq/dhcp/host
dnsmasq-dhcp: DHCPDISCOVER(dhcp_tap) 52:54:00:aa:69:dd 
dnsmasq-dhcp: DHCPOFFER(dhcp_tap) 10.10.10.30 52:54:00:aa:69:dd 
dnsmasq-dhcp: DHCPREQUEST(dhcp_tap) 10.10.10.30 52:54:00:aa:69:dd 
dnsmasq-dhcp: DHCPACK(dhcp_tap) 10.10.10.30 52:54:00:aa:69:dd 
dnsmasq-dhcp: DHCPDISCOVER(dhcp_tap) 52:54:00:aa:69:cc 
dnsmasq-dhcp: DHCPOFFER(dhcp_tap) 10.10.10.20 52:54:00:aa:69:cc 
dnsmasq-dhcp: DHCPREQUEST(dhcp_tap) 10.10.10.20 52:54:00:aa:69:cc 
dnsmasq-dhcp: DHCPACK(dhcp_tap) 10.10.10.20 52:54:00:aa:69:cc 

dnsmasq容器启动以及测试

容器中启动dnsmasq，需要容器以net=host的网络模式启动，如此才可以监控主机上的dhcp_tap接口,host 、pid等文件保存到容器内部。

[root@cnc ~]# docker exec -it 3da033d6c511 bash
[root@cnc dhcp]# pwd
/dnsmasq/dhcp
[root@cnc dhcp]# ls
host  pid
[root@cnc dhcp]# cat pid 
[root@cnc dhcp]# cat host 
52:54:00:aa:69:cc,10.10.10.40
52:54:00:aa:69:dd,10.10.10.50

在容器中启动进程

[root@cnc dhcp]# dnsmasq -d --no-hosts --no-resolv --strict-order --except-interface=lo --pid-file=/dnsmasq/dhcp/pid --dhcp-hostsfile=/dnsmasq/dhcp/host --dhcp-match=set:ipxe,175 --bind-interfaces --interface=dhcp_tap --dhcp-range=10.10.10.1,static,86400s --dhcp-option-force=option:mtu,1450 --dhcp-lease-max=512 --dhcp-option=3,10.10.10.1 --dhcp-option=6,8.8.8.8
dnsmasq: started, version 2.76 cachesize 150
dnsmasq: compile time options: IPv6 GNU-getopt DBus no-i18n IDN DHCP DHCPv6 no-Lua TFTP no-conntrack ipset auth no-DNSSEC loop-detect inotify
dnsmasq: warning: no upstream servers configured
dnsmasq-dhcp: DHCP, static leases only on 10.10.10.1, lease time 1d
dnsmasq-dhcp: DHCP, sockets bound exclusively to interface dhcp_tap
dnsmasq: cleared cache
dnsmasq-dhcp: read /dnsmasq/dhcp/host

注意：如果dnsmasq进程在容器中作为入口程序启动，需要添加-d参数，让这个进程在前台启动，而不能在后台启动。

经测试，在虚拟机获取ip时，进程报如下错误：

dnsmasq-dhcp: ARP-cache injection failed: Operation not permitted

操作不被允许，这里是因为权限的问题，当创建容器时，给与特权模式便可。

[root@cnc ~]# docker run -it --privileged --net=host library/centos /bin/bash

重新测试，虚拟机可以正常获取ip：

$ sudo ifup eth0
udhcpc (v1.20.1) started
Sending discover...
Sending select for 10.10.10.40...
Lease of 10.10.10.40 obtained, lease time 86400
deleting routers
adding dns 8.8.8.8

$ sudo ifup eth0
udhcpc (v1.20.1) started
Sending discover...
Sending select for 10.10.10.50...
Lease of 10.10.10.50 obtained, lease time 86400
deleting routers
adding dns 8.8.8.8

[root@cnc dhcp]# dnsmasq -d --no-hosts --no-resolv --strict-order --except-interface=lo --pid-file=/dnsmasq/dhcp/pid --dhcp-hostsfile=/dnsmasq/dhcp/host --dhcp-match=set:ipxe,175 --bind-interfaces --interface=dhcp_tap --dhcp-range=10.10.10.1,static,86400s --dhcp-option-force=option:mtu,1450 --dhcp-lease-max=512 --dhcp-option=3,10.10.10.1 --dhcp-option=6,8.8.8.8
dnsmasq: started, version 2.76 cachesize 150
dnsmasq: compile time options: IPv6 GNU-getopt DBus no-i18n IDN DHCP DHCPv6 no-Lua TFTP no-conntrack ipset auth no-DNSSEC loop-detect inotify
dnsmasq: warning: no upstream servers configured
dnsmasq-dhcp: DHCP, static leases only on 10.10.10.1, lease time 1d
dnsmasq-dhcp: DHCP, sockets bound exclusively to interface dhcp_tap
dnsmasq: cleared cache
dnsmasq-dhcp: read /dnsmasq/dhcp/host
dnsmasq-dhcp: DHCPDISCOVER(dhcp_tap) 52:54:00:aa:69:cc 
dnsmasq-dhcp: DHCPOFFER(dhcp_tap) 10.10.10.40 52:54:00:aa:69:cc 
dnsmasq-dhcp: DHCPREQUEST(dhcp_tap) 10.10.10.40 52:54:00:aa:69:cc 
dnsmasq-dhcp: DHCPACK(dhcp_tap) 10.10.10.40 52:54:00:aa:69:cc 
dnsmasq-dhcp: DHCPRELEASE(dhcp_tap) 10.10.10.30 52:54:00:aa:69:dd unknown lease
dnsmasq-dhcp: DHCPDISCOVER(dhcp_tap) 52:54:00:aa:69:dd 
dnsmasq-dhcp: DHCPOFFER(dhcp_tap) 10.10.10.50 52:54:00:aa:69:dd 
dnsmasq-dhcp: DHCPREQUEST(dhcp_tap) 10.10.10.50 52:54:00:aa:69:dd 
dnsmasq-dhcp: DHCPACK(dhcp_tap) 10.10.10.50 52:54:00:aa:69:dd