CHANGELOG

   1 version 2.60
   2             Fix compilation problem in Mac OS X Lion. Thanks to Olaf
   3             Flebbe for the patch.
   4
   5             Fix DHCP when using --listen-address with an IP address
   6             which is not the primary address of an interface.
   7
   8             Add --dhcp-client-update option.
   9
  10             Add Lua integration. Dnsmasq can now execute a DHCP
  11             lease-change script written in Lua. This needs to be
  12             enabled at compile time by setting HAVE_LUASCRIPT in
  13             src/config.h or running "make COPTS=-DHAVE_LUASCRIPT"
  14             Thanks to Jan-Piet Mens for the idea and proof-of-concept
  15             implementation.
  16
  17             Tidied src/config.h to distinguish between
  18             platform-dependent compile-time options which are selected
  19             automatically, and builder-selectable compile time
  20             options. Document the latter better, and describe how to
  21             set them from the make command line.
  22
  23             Tidied up IPPROTO_IP/SOL_IP (and IPv6 equivalent)
  24             confusion. IPPROTO_IP works everywhere now.
  25
  26             Set TOS on DHCP sockets, this improves things on busy
  27             wireless networks. Thanks to Dave Taht for the patch.
  28
  29             Determine VERSION automatically based on git magic:
  30             release tags or hash values.
  31
  32             Improve start-up speed when reading large hosts files
  33             containing many distinct addresses.
  34
  35             Fix problem if dnsmasq is started without the stdin,
  36             stdout and stderr file descriptors open. This can manifest
  37             itself as 100% CPU use. Thanks to Chris Moore for finding
  38             this.
  39
  40             Fix shell-scripting bug in bld/pkg-wrapper. Thanks to
  41             Mark Mitchell for the patch.
  42
  43             Allow the TFP server or boot server in --pxe-service, to
  44             be a domain name instead of an IP address. This allows for
  45             round-robin to multiple servers, in the same way as
  46             --dhcp-boot. A good suggestion from Cristiano Cumer.
  47
  48             Support BUILDDIR variable in the Makefile. Allows builds
  49             for multiple archs from the same source tree with eg.
  50             make BUILDDIR=linux             (relative to dnsmasq tree)
  51             make BUILDDIR=/tmp/openbsd      (absolute path)
  52             If BUILDDIR is not set, compilation happens in the src
  53             directory, as before. Suggestion from Mark Mitchell.
  54
  55             Support DHCPv6. Support is there for the sort of things
  56             the existing v4 server does, including tags, options,
  57             static addresses and relay support. Missing is prefix
  58             delegation, which is probably not required in the dnsmasq
  59             niche, and an easy way to accept prefix delegations from
  60             an upstream DHCPv6 server, which is. Future plans include
  61             support for DHCPv6 router option and MAC address option
  62             (to make selecting clients by MAC address work like IPv4).
  63             These will be added as the standards mature.
  64             This code has been tested, but this is the first release,
  65             so don't bet the farm on it just yet. Many thanks to all
  66             testers who have got it this far.
  67
  68             Support IPv6 router advertisements. This is a
  69             simple-minded implementation, aimed at providing the
  70             vestigial RA needed to go alongside IPv6. Is picks up
  71             configuration from the DHCPv6 conf, and should just need
  72             enabling with --enable-ra.
  73
  74             Fix long-standing wrinkle with --localise-queries that
  75             could result in wrong answers when DNS packets arrive
  76             via an interface other than the expected one. Thanks to
  77             Lorenzo Milesi and John Hanks for spotting this one.
  78
  79
  80 version 2.59
  81             Fix regression in 2.58 which caused failure to start up
  82             with some combinations of dnsmasq config and IPv6 kernel
  83             network config. Thanks to Brielle Bruns for the bug
  84             report.
  85
  86             Improve dnsmasq's behaviour when network interfaces are
  87             still doing duplicate address detection (DAD). Previously,
  88             dnsmasq would wait up to 20 seconds at start-up for the
  89             DAD state to terminate. This is broken for bridge
  90             interfaces on recent Linux kernels, which don't start DAD
  91             until the bridge comes up, and so can take arbitrary
  92             time. The new behaviour lets dnsmasq poll for an arbitrary
  93             time whilst providing service on other interfaces. Thanks
  94             to Stephen Hemminger for pointing out the problem.
  95
  96
  97 version 2.58
  98             Provide a definition of the SA_SIZE macro where it's
  99             missing. Fixes build failure on openBSD.
 100
 101             Don't include a zero terminator at the end of messages
 102             sent to /dev/log when /dev/log is a datagram socket.
 103             Thanks to Didier Rabound for spotting the problem.
 104
 105             Add --dhcp-sequential-ip flag, to force allocation of IP
 106             addresses in ascending order. Note that the default
 107             pseudo-random mode is in general better but some
 108             server-deployment applications need this.
 109
 110             Fix problem where a server-id of 0.0.0.0 is sent to a
 111             client when a dhcp-relay is in use if a client renews a
 112             lease after dnsmasq restart and before any clients on the
 113             subnet get a new lease. Thanks to Mike Ruiz for assistance
 114             in chasing this one down.
 115
 116             Don't return NXDOMAIN to an AAAA query if we have CNAME
 117             which points to an A record only: NODATA is the correct
 118             reply in this case. Thanks to Tom Fernandes for spotting
 119             the problem.
 120
 121             Relax the need to supply a netmask in --dhcp-range for
 122             networks which use a DHCP relay. Whilst this is still
 123             desireable, in the absence of a netmask dnsmasq will use
 124             a default based on the class (A, B, or C) of the address.
 125             This should at least remove a cause of mysterious failure
 126             for people using RFC1918 addresses and relays.
 127
 128             Add support for Linux conntrack connection marking. If
 129             enabled with --conntrack, the connection mark for incoming
 130             DNS queries will be copied  to the outgoing connections
 131             used to answer those queries. This allows clever firewall
 132             and accounting stuff. Only available if dnsmasq is
 133             compiled with HAVE_CONNTRACK and adds a dependency on
 134             libnetfilter-conntrack. Thanks to Ed Wildgoose for the
 135             initial idea, testing and sponsorship of this function.
 136
 137             Provide a sane error message when someone attempts to
 138             match a tag in --dhcp-host.
 139
 140             Tweak the behaviour of --domain-needed, to avoid problems
 141             with recursive nameservers downstream of dnsmasq. The new
 142             behaviour only stops A and AAAA queries, and returns
 143             NODATA rather than NXDOMAIN replies.
 144
 145             Efficiency fix for very large DHCP configurations, thanks
 146             to James Gartrell and Mike Ruiz for help with this.
 147
 148             Allow the TFTP-server address in --dhcp-boot to be a
 149             domain-name which is looked up in /etc/hosts. This can
 150             give multiple IP addresses which are used round-robin,
 151             thus doing TFTP server load-balancing. Thanks to Sushil
 152             Agrawal for the patch.
 153
 154             When two tagged dhcp-options for a particular option
 155             number are both valid, use the one which is valid without
 156             a tag from the dhcp-range. Allows overriding of the value
 157             of a DHCP option for a particular host as well as
 158             per-network values.  So
 159             --dhcp-range=set:interface1,......
 160             --dhcp-host=set:myhost,.....
 161             --dhcp-option=tag:interface1,option:nis-domain,"domain1"
 162             --dhcp-option=tag:myhost,option:nis-domain,"domain2"
 163             will set the NIS-domain to domain1 for hosts in the range, but
 164             override that to domain2 for a particular host.
 165
 166             Fix bug which resulted in truncated files and timeouts for
 167             some TFTP transfers. The bug only occurs with netascii
 168             transfers and needs an unfortunate relationship between
 169             file size, blocksize and the number of newlines in the
 170             last block before it manifests itself. Many thanks to
 171             Alkis Georgopoulos for spotting the problem and providing
 172             a comprehensive test-case.
 173
 174             Fix regression in TFTP server on *BSD platforms introduced
 175             in version 2.56, due to confusion with sockaddr
 176             length. Many thanks to Loïc Pefferkorn for finding this.
 177
 178             Support scope-ids in IPv6 addresses of nameservers from
 179             /etc/resolv.conf and in --server options. Eg
 180             nameserver fe80::202:a412:4512:7bbf%eth0 or
 181             server=fe80::202:a412:4512:7bbf%eth0. Thanks to
 182             Michael Stapelberg for the suggestion.
 183
 184             Update Polish translation, thanks to Jan Psota.
 185
 186             Update French translation. Thanks to Gildas Le Nadan.
 187
 188
 189 version 2.57
 190             Add patches to allow build under Android.
 191
 192             Provide our own header for the DNS protocol, rather than
 193             relying on arpa/nameser.h. This has proved more or less
 194             defective over the years and the final straw is that it's
 195             effectively empty on Android.
 196
 197             Fix regression in 2.56 which caused hex constants in
 198             configuration to be rejected if they contain the '*'
 199             wildcard.
 200
 201             Correct wrong casts of arguments to ctype.h functions,
 202             isdigit(), isxdigit() etc. Thanks to Matthias Andree for
 203             spotting this.
 204
 205             Allow build with IDN support independently from i18n.
 206             IDN support continues to be included automatically
 207             when i18n is included.
 208             'make COPTS=-DHAVE_IDN' is the magic incantation.
 209
 210             Modify check on extraneous command line junk (added in
 211             2.56) so that it doesn't complain about extra _empty_
 212             arguments. Otherwise this breaks libvirt.
 213
 214
 215 version 2.56
 216             Add a patch to allow dnsmasq to get interface names right in a
 217             Solaris zone. Thanks to Dj Padzensky for this.
 218
 219             Improve data-type parsing heuristics so that
 220             --dhcp-option=option:domain-search,.
 221             treats the value as a string and not an IP address.
 222             Thanks to Clemens Fischer for spotting that.
 223
 224             Add IPv6 support to the TFTP server. Many thanks to Jan
 225             'RedBully' Seiffert for the patches.
 226
 227             Log DNS queries at level LOG_INFO, rather then
 228             LOG_DEBUG. This makes things consistent with DHCP
 229             logging. Thanks to Adam Pribyl for spotting the problem.
 230
 231             Ensure that dnsmasq terminates cleanly when using
 232             --syslog-async even if it cannot make a connection to the
 233             syslogd.
 234
 235             Add --add-mac option. This is to support currently
 236             experimental DNS filtering facilities. Thanks to Benjamin
 237             Petrin for the orignal patch.
 238
 239             Fix bug which meant that tags were ignored in dhcp-range
 240             configuration specifying PXE-proxy service. Thanks to
 241             Cristiano Cumer for spotting this.
 242
 243             Raise an error if there is extra junk, not part of an
 244             option, on the command line.
 245
 246             Flag a couple of log messages in cache.c as coming from
 247             the DHCP subsystem. Thanks to Olaf Westrik for the patch.
 248
 249             Omit timestamps from logs when a) logging to stderr and
 250             b) --keep-in-forground is set. The logging facility on the
 251             other end of stderr can be assumned to supply them. Thanks
 252             to John Hallam for the patch.
 253
 254             Don't complain about strings longer than 255 characters in
 255             --txt-record, just split the long strings into 255
 256             character chunks instead.
 257
 258             Fix crash on double-free. This bug can only happen when
 259             dhcp-script is in use and then only in rare circumstances
 260             triggered by high DHCP transaction rate and a slow
 261             script. Thanks to Ferenc Wagner for finding the problem.
 262
 263             Only log that a file has been sent by TFTP after the
 264             transfer has completed succesfully.
 265
 266             A good suggestion from Ferenc Wagner: extend
 267             the --domain option to allow this sort of thing:
 268             --domain=thekelleys.org.uk,192.168.0.0/24,local
 269             which automatically creates
 270             --local=/thekelleys.org.uk/
 271             --local=/0.168.192.in-addr.arpa/
 272
 273             Tighten up syntax checking of hex contants in the config
 274             file.  Thanks to Fred Damen for spotting this.
 275
 276             Add dnsmasq logo/icon, contributed by Justin Swift. Many
 277             thanks for that.
 278
 279             Never cache DNS replies which have the 'cd' bit set, or
 280             which result from queries forwarded with the 'cd' bit
 281             set. The 'cd' bit instructs a DNSSEC validating server
 282             upstream to ignore signature failures and return replies
 283             anyway. Without this change it's possible to pollute the
 284             dnsmasq cache with bad data by making a query with the
 285             'cd' bit set and subsequent queries would return this data
 286             without its being marked as suspect. Thanks to Anders
 287             Kaseorg for pointing out this problem.
 288
 289             Add --proxy-dnssec flag, for compliance with RFC
 290             4035. Dnsmasq will now clear the 'ad' bit in answers returned
 291             from upstream validating nameservers unless this option is
 292             set.
 293
 294             Allow a filename of "-" for --conf-file to read
 295             stdin. Suggestion from Timothy Redaelli.
 296
 297             Rotate the order of SRV records in replies, to provide
 298             round-robin load balancing when all the priorities are
 299             equal. Thanks to Peter McKinney for the suggestion.
 300
 301             Edit
 302             contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist
 303             so that it doesn't log all queries to a file by
 304             default. Thanks again to Peter McKinney.
 305
 306             By default, setting an IPv4 address for a domain but not
 307             an IPv6 address causes dnsmasq to return
 308             an NODATA reply for IPv6 (or vice-versa). So
 309             --address=/google.com/1.2.3.4 stops IPv6 queries for
 310             *google.com from being forwarded. Make it possible to
 311             override this behaviour by defining the sematics if the
 312             same domain appears in  both --server and --address.
 313             In that case, the --address has priority for the address
 314             family in which is appears, but the --server has priority
 315             of the address family which doesn't appear in --adddress
 316             So:
 317             --address=/google.com/1.2.3.4
 318             --server=/google.com/#
 319             will return 1.2.3.4 for IPv4 queries for *.google.com but
 320             forward IPv6 queries to the normal upstream nameserver.
 321             Similarly when setting an IPv6 address
 322             only this will allow forwarding of IPv4 queries. Thanks to
 323             William for pointing out the need for this.
 324
 325             Allow more than one --dhcp-optsfile and --dhcp-hostsfile
 326             and make them understand directories as arguments in the
 327             same way as --addn-hosts. Suggestion from John Hanks.
 328
 329             Ignore rebinding requests for leases we don't know
 330             about. Rebind is broadcast, so we might get to overhear a
 331             request meant for another DHCP server. NAKing this is
 332             wrong. Thanks to Brad D'Hondt for assistance with this.
 333
 334             Fix cosmetic bug which produced strange output when
 335             dumping cache statistics with some configurations. Thanks
 336             to Fedor Kozhevnikov for spotting this.
 337
 338
 339 version 2.55
 340             Fix crash when /etc/ethers is in use. Thanks to
 341             Gianluigi Tiesi for finding this.
 342
 343             Fix crash in netlink_multicast(). Thanks to Arno Wald for
 344             finding this one.
 345
 346             Allow the empty domain "." in dhcp domain-search (119)
 347             options.
 348
 349
 350 version 2.54
 351             There is no version 2.54 to avoid confusion with 2.53,
 352             which incorrectly identifies itself as 2.54.
 353
 354
 355 version 2.53
 356             Fix failure to compile on Debian/kFreeBSD. Thanks to
 357             Axel Beckert and Petr Salinger.
 358
 359             Fix code to avoid scary strict-aliasing warnings
 360             generated by gcc 4.4.
 361
 362             Added FAQ entry warning about DHCP failures with Vista
 363             when firewalls block 255.255.255.255.
 364
 365             Fixed bug which caused bad things to happen if a
 366             resolv.conf file which exists is subsequently removed.
 367             Thanks to Nikolai Saoukh for the patch.
 368
 369             Rationalised the DHCP tag system. Every configuration item
 370             which can set a tag does so by adding "set:<tag>" and
 371             every configuration item which is conditional on a tag is
 372             made so by "tag:<tag>". The NOT operator changes to '!',
 373             which is a bit more intuitive too. Dhcp-host directives
 374             can set more than one tag now. The old '#' NOT,
 375             "net:" prefix and no-prefixes are still honoured, so
 376             no existing config file needs to be changed, but
 377             the documentation and new-style config files should be
 378             much less confusing.
 379
 380             Added --tag-if to allow boolean operations on tags.
 381             This allows complicated logic to be clearer and more
 382             general. A great suggestion from Richard Voigt.
 383
 384             Add broadcast/unicast information to DHCP logging.
 385
 386             Allow --dhcp-broadcast to be unconditional.
 387
 388             Fixed incorrect behaviour with NOT <tag> conditionals in
 389             dhcp-options. Thanks to Max Turkewitz for assistance
 390             finding this.
 391
 392             If we send vendor-class encapsulated options based on the
 393             vendor-class supplied by the client, and no explicit
 394             vendor-class option is given, echo back the vendor-class
 395             from the client.
 396
 397             Fix bug which stopped dnsmasq from matching both a
 398             circuitid and a remoteid. Thanks to Ignacio Bravo for
 399             finding this.
 400
 401             Add --dhcp-proxy, which makes it possible to configure
 402             dnsmasq to use a DHCP relay agent as a full proxy, with
 403             all DHCP messages passing through the proxy. This is
 404             useful if the relay adds extra information to the packets
 405             it forwards, but cannot be configured with the RFC 5107
 406             server-override option.
 407
 408             Added interface:<iface name> part to dhcp-range. The
 409             semantics of this are very odd at first sight, but it
 410             allows a single line  of the form
 411                 dhcp-range=interface:virt0,192.168.0.4,192.168.0.200
 412             to be added to dnsmasq configuration which then supplies
 413             DHCP and DNS services to that interface, without affecting
 414             what services are supplied to other interfaces and
 415             irrespective of the existance or lack of
 416                 interface=<interface>
 417             lines elsewhere in the dnsmasq configuration. The idea is
 418             that such a line can be added automatically by libvirt
 419             or equivalent systems, without disturbing any manual
 420             configuration.
 421
 422             Similarly to the above, allow --enable-tftp=<interface>
 423
 424             Allow a TFTP root to be set separately for requests via
 425             different interfaces, --tftp-root=<path>,<interface>
 426
 427             Correctly handle and log clashes between CNAMES and
 428             DNS names being given to DHCP leases. This fixes a bug
 429             which caused nonsense IP addresses to be logged. Thanks to
 430             Sergei Zhirikov for finding and analysing the problem.
 431
 432             Tweak flush_log so as to avoid leaving the log
 433             file in non-blocking mode. O_NONBLOCK is a property of the
 434             file, not the process/descriptor.
 435
 436             Fix contrib/Solaris10/create_package
 437             (/usr/man -> /usr/share/man) Thanks to Vita Batrla.
 438
 439             Fix a problem where, if a client got a lease, then went
 440             to another subnet and got another lease, then moved back,
 441             it couldn't resume the old lease, but would instead get
 442             a new address. Thanks to Leonardo Rodrigues for spotting
 443             this and testing the fix.
 444
 445             Fix weird bug which sometimes omitted certain characters
 446             from the start of quoted strings in dhcp-options. Thanks
 447             to Dayton Turner for spotting the problem.
 448
 449             Add facility to redirect some domains to the standard
 450             upstream servers: this allows something like
 451             --server=/google.com/1.2.3.4 --server=/www.google.com/#
 452             which will send queries for *.google.com to 1.2.3.4,
 453             except *www.google.com which will be forwarded as usual.
 454             Thanks to AJ Weber for prompting this addition.
 455
 456             Improve the hash-algorithm used to generate IP addresses
 457             from MAC addresses during initial DHCP address
 458             allocation. This improves performance when large numbers
 459             of hosts with similar MAC addresses all try and get an IP
 460             address at the same time. Thanks to Paul Smith for his
 461             work on this.
 462
 463             Tweak DHCP code so that --bridge-interface can be used to
 464             select which IP alias of an interface should be used for
 465             DHCP purposes on Linux. If eth0 has an alias eth0:dhcp
 466             then adding  --bridge-interface=eth0:dhcp,eth0 will use
 467             the address of eth0:dhcp to determine the correct subnet
 468             for DHCP address allocation. Thanks to Pawel Golaszewski
 469             for prompting this and Eric Cooper for further testing.
 470
 471             Add --dhcp-generate-names. Suggestion by Ferenc Wagner.
 472
 473             Tweak DNS server selection algorithm when there is more
 474             than one server available for a domain, eg.
 475             --server=/mydomain/1.1.1.1
 476             --server=/mydomain/2.2.2.2
 477             Thanks to Alberto Cuesta-Canada for spotting a weakness
 478             here.
 479
 480             Add --max-ttl. Thanks to Fredrik Ringertz for the patch.
 481
 482             Allow --log-facility=- to force all logging to
 483             stderr. Suggestion from Clemens Fischer.
 484
 485             Fix regression which caused configuration like
 486             --address=/.domain.com/1.2.3.4 to be rejected. The dot to the
 487             left of the domain has been implied and not required for a
 488             long time, but it should be accepted for backward
 489             compatibility. Thanks to Andrew Burcin for spotting this.
 490
 491             Add --rebind-domain-ok and --rebind-localhost-ok.
 492             Suggestion from Clemens Fischer.
 493
 494             Log replies to queries of type TXT, when --log-queries
 495             is set.
 496
 497             Fix compiler warnings when compiled with -DNO_DHCP. Thanks
 498             to Shantanu Gadgil for the patch.
 499
 500             Updated French translation. Thanks to Gildas Le Nadan.
 501
 502             Updated Polish translation. Thanks to Jan Psota.
 503
 504             Updated German translation. Thanks to Matthias Andree.
 505
 506             Added contrib/static-arp, thanks to Darren Hoo.
 507
 508             Fix corruption of the domain when a name from /etc/hosts
 509             overrides one supplied by a DHCP client. Thanks to Fedor
 510             Kozhevnikov for spotting the problem.
 511
 512             Updated Spanish translation. Thanks to Chris Chatham.
 513
 514
 515 version 2.52
 516             Work around a Linux kernel bug which insists that the
 517             length of the option passed to setsockopt must be at least
 518             sizeof(int) bytes, even if we're calling SO_BINDTODEVICE
 519             and the device name is "lo".  Note that this is fixed
 520             in kernel 2.6.31, but the workaround is harmless and
 521             allows earlier kernels to be used. Also fix dnsmasq
 522             bug which reported the wrong address when this failed.
 523             Thanks to Fedor for finding this.
 524
 525             The API for IPv6 PKTINFO changed around Linux kernel
 526             2.6.14. Workaround the case where dnsmasq is compiled
 527             against newer headers, but then run on an old kernel:
 528             necessary for some *WRT distros.
 529
 530             Re-read the set of network interfaces when re-loading
 531             /etc/resolv.conf if --bind-interfaces is not set. This
 532             handles the case that loopback interfaces do not exist
 533             when dnsmasq is first started.
 534
 535             Tweak the PXE code to support port 4011. This should
 536             reduce broadcasts and make things more reliable when other
 537             servers are around. It also improves inter-operability
 538             with certain clients.
 539
 540             Make a pxe-service configuration with no filename or boot
 541             service type legal: this does a local boot. eg.
 542             pxe-service=x86PC, "Local boot"
 543
 544             Be more conservative in detecting "A for A"
 545             queries. Dnsmasq checks if the name in a type=A query looks
 546             like a dotted-quad IP address and answers the query itself
 547             if so, rather than forwarding it. Previously dnsmasq
 548             relied in the library function inet_addr() to convert
 549             addresses, and that will accept some things which are
 550             confusing in this context, like 1.2.3 or even just
 551             1234. Now we only do A for A processing for four decimal
 552             numbers delimited by dots.
 553
 554             A couple of tweaks to fix compilation on Solaris. Thanks
 555             to Joel Macklow for help with this.
 556
 557             Another Solaris compilation tweak, needed for Solaris
 558             2009.06. Thanks to Lee Essen for that.
 559
 560             Added extract packaging stuff from Lee Essen to
 561             contrib/Solaris10.
 562
 563             Increased the default limit on number of leases to 1000
 564             (from 150). This is mainly a defence against DoS attacks,
 565             and for the average "one for two class C networks"
 566             installation, IP address exhaustion does that just as
 567             well. Making the limit greater than the number of IP
 568             addresses available in such an installation removes a
 569             surprise which otherwise can catch people out.
 570
 571             Removed extraneous trailing space in the value of the
 572             DNSMASQ_TIME_REMAINING DNSMASQ_LEASE_LENGTH and
 573             DNSMASQ_LEASE_EXPIRES environment variables. Thanks to
 574             Gildas Le Nadan for spotting this.
 575
 576             Provide the network-id tags for a DHCP transaction to
 577             the lease-change script in the environment variable
 578             DNSMASQ_TAGS. A good suggestion from Gildas Le Nadan.
 579
 580             Add support for RFC3925 "Vendor-Identifying Vendor
 581             Options". The syntax looks like this:
 582             --dhcp-option=vi-encap:<enterprise number>, .........
 583
 584             Add support to --dhcp-match to allow matching against
 585             RFC3925 "Vendor-Identifying Vendor Classes". The syntax
 586             looks like this:
 587             --dhcp-match=tag,vi-encap<enterprise number>, <value>
 588
 589             Add some application specific code to assist in
 590             implementing the Broadband forum TR069 CPE-WAN
 591             specification. The details are in contrib/CPE-WAN/README
 592
 593             Increase the default DNS packet size limit to 4096, as
 594             recommended by RFC5625 section 4.4.3. This can be
 595             reconfigured using --edns-packet-max if needed. Thanks to
 596             Francis Dupont for pointing this out.
 597
 598             Rewrite query-ids even for TSIG signed packets, since
 599             this is allowed by RFC5625 section 4.5.
 600
 601             Use getopt_long by default on OS X. It has been supported
 602             since version 10.3.0. Thanks to Arek Dreyer for spotting
 603             this.
 604
 605             Added up-to-date startup configuration for MacOSX/launchd
 606             in contrib/MacOSX-launchd. Thanks to Arek Dreyer for
 607             providing this.
 608
 609             Fix link error when including Dbus but excluding DHCP.
 610             Thanks to Oschtan for the bug report.
 611
 612             Updated French translation. Thanks to Gildas Le Nadan.
 613
 614             Updated Polish translation. Thanks to Jan Psota.
 615
 616             Updated Spanish translation. Thanks to Chris Chatham.
 617
 618             Fixed confusion about domains, when looking up DHCP hosts
 619             in /etc/hosts. This could cause spurious "Ignoring
 620             domain..." messages. Thanks to Fedor Kozhevnikov for
 621             finding and analysing the problem.
 622
 623
 624 version 2.51
 625             Add support for internationalised DNS. Non-ASCII characters
 626             in domain names found in /etc/hosts, /etc/ethers and
 627             /etc/dnsmasq.conf will be correctly handled by translation to
 628             punycode, as specified in RFC3490. This function is only
 629             available if dnsmasq is compiled with internationalisation
 630             support, and adds a dependency on GNU libidn. Without i18n
 631             support, dnsmasq continues to be compilable with just
 632             standard tools. Thanks to Yves Dorfsman for the
 633             suggestion.
 634
 635             Add two more environment variables for lease-change scripts:
 636             First, DNSMASQ_SUPPLIED_HOSTNAME; this is set to the hostname
 637             supplied by a client, even if the actual hostname used is
 638             over-ridden by dhcp-host or dhcp-ignore-names directives.
 639             Also DNSMASQ_RELAY_ADDRESS which gives the address of
 640             a DHCP relay, if used.
 641             Suggestions from Michael Rack.
 642
 643             Fix regression which broke echo of relay-agent
 644             options. Thanks to Michael Rack for spotting this.
 645
 646             Don't treat option 67 as being interchangeable with
 647             dhcp-boot parameters if it's specified as
 648             dhcp-option-force.
 649
 650             Make the code to call scripts on lease-change compile-time
 651             optional. It can be switched off by editing src/config.h
 652             or building with "make COPTS=-DNO_SCRIPT".
 653
 654             Make the TFTP server cope with filenames from Windows/DOS
 655             which use '\' as pathname separator. Thanks to Ralf for
 656             the patch.
 657
 658             Updated Polish translation. Thanks to Jan Psota.
 659
 660             Warn if an IP address is duplicated in /etc/ethers. Thanks
 661             to Felix Schwarz for pointing this out.
 662
 663             Teach --conf-dir to take an option list of file suffices
 664             which will be ignored when scanning the directory. Useful
 665             for backup files etc. Thanks to Helmut Hullen for the
 666             suggestion.
 667
 668             Add new DHCP option named tftpserver-address, which
 669             corresponds to the third argument of dhcp-boot. This
 670             allows the complete functionality of dhcp-boot to be
 671             replicated with dhcp-option. Useful when using
 672             dhcp-optsfile.
 673
 674             Test which upstream nameserver to use every 10 seconds
 675             or 50 queries and not just when a query times out and
 676             is retried. This should improve performance when there
 677             is a slow nameserver in the list. Thanks to Joe for the
 678             suggestion.
 679
 680             Don't do any PXE processing, even for clients with the
 681             correct vendorclass, unless at least one pxe-prompt or
 682             pxe-service option is given. This stops dnsmasq
 683             interfering with proxy PXE subsystems when it is just
 684             the DHCP server. Thanks to Spencer Clark for spotting this.
 685
 686             Limit the blocksize used for TFTP transfers to a value
 687             which avoids packet fragmentation, based on the MTU of the
 688             local interface. Many netboot ROMs can't cope with
 689             fragmented packets.
 690
 691             Honour dhcp-ignore configuration for PXE and proxy-PXE
 692             requests. Thanks to Niels Basjes for the bug report.
 693
 694             Updated French translation. Thanks to Gildas Le Nadan.
 695
 696
 697 version 2.50
 698             Fix security problem which allowed any host permitted to
 699             do TFTP to possibly compromise dnsmasq by remote buffer
 700             overflow when TFTP enabled. Thanks to Core Security
 701             Technologies and Iván Arce, Pablo Hernán Jorge, Alejandro
 702             Pablo Rodriguez, Martín Coco, Alberto Soliño Testa and
 703             Pablo Annetta. This problem has Bugtraq id: 36121
 704             and CVE: 2009-2957
 705
 706             Fix a problem which allowed a malicious TFTP client to
 707             crash dnsmasq. Thanks to Steve Grubb at Red Hat for
 708             spotting this. This problem has Bugtraq id: 36120 and
 709             CVE: 2009-2958
 710
 711
 712 version 2.49
 713             Fix regression in 2.48 which disables the lease-change
 714             script. Thanks to Jose Luis Duran for spotting this.
 715
 716             Log TFTP "file not found" errors. These were not logged,
 717             since a normal PXELinux boot generates many of them, but
 718             the lack of the messages seems to be more confusing than
 719             routinely seeing them when there is no real error.
 720
 721             Update Spanish translation. Thanks to Chris Chatham.
 722
 723
 724 version 2.48
 725             Archived the extensive, backwards, changelog to
 726             CHANGELOG.archive. The current changelog now runs from
 727             version 2.43 and runs conventionally.
 728
 729             Fixed bug which broke binding of servers to physical
 730             interfaces when interface names were longer than four
 731             characters. Thanks to MURASE Katsunori for the patch.
 732
 733             Fixed netlink code to check that messages come from the
 734             correct source, and not another userspace process. Thanks
 735             to Steve Grubb for the patch.
 736
 737             Maintainability drive: removed bug and missing feature
 738             workarounds for some old platforms. Solaris 9, OpenBSD
 739             older than 4.1, Glibc older than 2.2, Linux 2.2.x and
 740             DBus older than 1.1.x are no longer supported.
 741
 742             Don't read included configuration files more than once:
 743             allows complex configuration structures without problems.
 744
 745             Mark log messages from the various subsystems in dnsmasq:
 746             messages from the DHCP subsystem now have the ident string
 747             "dnsmasq-dhcp" and messages from TFTP have ident
 748             "dnsmasq-tftp". Thanks to Olaf Westrik for the patch.
 749
 750             Fix possible infinite DHCP protocol loop when an IP
 751             address nailed to a hostname (not a MAC address)  and a
 752             host sometimes provides the name, sometimes not.
 753
 754             Allow --addn-hosts to take a directory: all the files
 755             in the directory are read. Thanks to Phil Cornelius for
 756             the suggestion.
 757
 758             Support --bridge-interface on all platforms, not just BSD.
 759
 760             Added support for advanced PXE functions. It's now
 761             possible to define a prompt and menu options which will
 762             be displayed when a client PXE boots. It's also possible to
 763             hand-off booting to other boot servers. Proxy-DHCP, where
 764             dnsmasq just supplies the PXE information and another DHCP
 765             server does address allocation, is also allowed. See the
 766             --pxe-prompt and --pxe-service keywords. Thanks to
 767             Alkis Georgopoulos for the suggestion and Guilherme Moro
 768             and Michael Brown for assistance.
 769
 770             Improvements to DHCP logging. Thanks to Tom Metro for
 771             useful suggestions.
 772
 773             Add ability to build dnsmasq without DHCP support. To do
 774             this, edit src/config.h or build with
 775             "make COPTS=-DNO_DHCP". Thanks to Mahavir Jain for the patch.
 776
 777             Added --test command-line switch - syntax check
 778             configuration files only.
 779
 780             Updated French translation. Thanks to Gildas Le Nadan.
 781
 782
 783 version 2.47
 784             Updated French translation. Thanks to Gildas Le Nadan.
 785
 786             Fixed interface enumeration code to work on NetBSD
 787             5.0. Thanks to Roy Marples for the patch.
 788
 789             Updated config.h to use the same location for the lease
 790             file on NetBSD as the other *BSD variants. Also allow
 791             LEASEFILE and CONFFILE symbols to be overriden in CFLAGS.
 792
 793             Handle duplicate address detection on IPv6 more
 794             intelligently. In IPv6, an interface can have an address
 795             which is not usable, because it is still undergoing DAD
 796             (such addresses are marked "tentative"). Attempting to
 797             bind to an address in this state returns an error,
 798             EADDRNOTAVAIL. Previously, on getting such an error,
 799             dnsmasq would silently abandon the address, and never
 800             listen on it. Now, it retries once per second for 20
 801             seconds before generating a fatal error. 20 seconds should
 802             be long enough for any DAD process to complete, but can be
 803             adjusted in src/config.h if necessary. Thanks to Martin
 804             Krafft for the bug report.
 805
 806             Add DBus introspection. Patch from Jeremy Laine.
 807
 808             Update Dbus configuration file. Patch from Colin Walters.
 809             Fix for this bug:
 810             http://bugs.freedesktop.org/show_bug.cgi?id=18961
 811
 812             Support arbitrarily encapsulated DHCP options, suggestion
 813             and initial patch from Samium Gromoff. This is useful for
 814             (eg) gPXE, which expect all its private options to be
 815             encapsulated inside a single option 175. So, eg,
 816
 817             dhcp-option = encap:175, 190, "iscsi-client0"
 818             dhcp-option = encap:175, 191, "iscsi-client0-secret"
 819
 820             will provide iSCSI parameters to gPXE.
 821
 822             Enhance --dhcp-match to allow testing of the contents of a
 823             client-sent option, as well as its presence. This
 824             application in mind for this is RFC 4578
 825             client-architecture specifiers, but it's generally useful.
 826             Joey Korkames suggested the enhancement.
 827
 828             Move from using the IP_XMIT_IF ioctl to IP_BOUND_IF on
 829             OpenSolaris. Thanks to Bastian Machek for the heads-up.
 830
 831             No longer complain about blank lines in
 832             /etc/ethers. Thanks to Jon Nelson for the patch.
 833
 834             Fix binding of servers to physical devices, eg
 835             --server=/domain/1.2.3.4@eth0 which was broken from 2.43
 836             onwards unless --query-port=0 set. Thanks to Peter Naulls
 837             for the bug report.
 838
 839             Reply to DHCPINFORM requests even when the supplied ciaddr
 840             doesn't fall in any dhcp-range. In this case it's not
 841             possible to supply a complete configuration, but
 842             individually-configured options (eg PAC) may be useful.
 843
 844             Allow the source address of an alias to be a range:
 845             --alias=192.168.0.0,10.0.0.0,255.255.255.0 maps the whole
 846             subnet 192.168.0.0->192.168.0.255 to 10.0.0.0->10.0.0.255,
 847             as before.
 848             --alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0
 849             maps only the 192.168.0.10->192.168.0.40 region. Thanks to
 850             Ib Uhrskov for the suggestion.
 851
 852             Don't dynamically allocate DHCP addresses which may break
 853             Windows.  Addresses which end in .255 or .0 are broken in
 854             Windows even when using supernetting.
 855             --dhcp-range=192.168.0.1,192.168.1.254,255,255,254.0 means
 856             192.168.0.255 is a valid IP address, but not for Windows.
 857             See Microsoft KB281579. We therefore no longer allocate
 858             these addresses to avoid hard-to-diagnose problems.
 859
 860             Update Polish translation. Thanks to Jan Psota.
 861
 862             Delete the PID-file when dnsmasq shuts down. Note that by
 863             this time, dnsmasq is normally not running as root, so
 864             this will fail if the PID-file is stored in a root-owned
 865             directory; such failure is silently ignored. To take
 866             advantage of this feature, the PID-file must be stored in a
 867             directory owned and write-able by the user running
 868             dnsmasq.
 869
 870
 871 version 2.46
 872             Allow --bootp-dynamic to take a netid tag, so that it may
 873             be selectively enabled. Thanks to Olaf Westrik for the
 874             suggestion.
 875
 876             Remove ISC-leasefile reading code. This has been
 877             deprecated for a long time, and last time I removed it, it
 878             ended up going back by request of one user. This time,
 879             it's gone for good; otherwise it would need to be
 880             re-worked to support multiple domains (see below).
 881
 882             Support DHCP clients in multiple DNS domains. This is a
 883             long-standing request. Clients are assigned to a domain
 884             based in their IP address.
 885
 886             Add --dhcp-fqdn flag, which changes behaviour if DNS names
 887             assigned to DHCP clients. When this is set, there must be
 888             a domain associated with each client, and only
 889             fully-qualified domain names are added to the DNS. The
 890             advantage is that the only the FQDN needs to be unique,
 891             so that two or more DHCP clients can share a hostname, as
 892             long as they are in different domains.
 893
 894             Set environment variable DNSMASQ_DOMAIN when invoking
 895             lease-change script. This may be useful information to
 896             have now that it's variable.
 897
 898             Tighten up data-checking code for DNS packet
 899             handling. Thanks to Steve Dodd who found certain illegal
 900             packets which could crash dnsmasq. No memory overwrite was
 901             possible, so this is not a security issue beyond the DoS
 902             potential.
 903
 904             Update example config dhcp option 47, the previous
 905             suggestion generated an illegal, zero-length,
 906             option. Thanks to Matthias Andree for finding this.
 907
 908             Rewrite hosts-file reading code to remove the limit of
 909             1024 characters per line. John C Meuser found this.
 910
 911             Create a net-id tag with the name of the interface on
 912             which the DHCP request was received.
 913
 914             Fixed minor memory leak in DBus code, thanks to Jeremy
 915             Laine for the patch.
 916
 917             Emit DBus signals as the DHCP lease database
 918             changes. Thanks to Jeremy Laine for the patch.
 919
 920             Allow for more that one MAC address in a dhcp-host
 921             line. This configuration tells dnsmasq that it's OK to
 922             abandon a DHCP lease of the fixed address to one MAC
 923             address, if another MAC address in the dhcp-host statement
 924             asks for an address. This is useful to give a fixed
 925             address to a host which has two network interfaces
 926             (say, a laptop with wired and wireless interfaces.)
 927             It's very important to ensure that only one interface
 928             at a time is up, since dnsmasq abandons the first lease
 929             and re-uses the address before the leased time has
 930             elapsed. John Gray suggested this.
 931
 932             Tweak the response to a DHCP request packet with a wrong
 933             server-id when --dhcp-authoritative is set; dnsmasq now
 934             returns a DHCPNAK, rather than silently ignoring the
 935             packet. Thanks to Chris Marget for spotting this
 936             improvement.
 937
 938             Add --cname option. This provides a limited alias
 939             function, usable for DHCP names. Thanks to AJ Weber for
 940             suggestions on this.
 941
 942             Updated contrib/webmin with latest version from Neil
 943             Fisher.
 944
 945             Updated Polish translation. Thanks to Jan Psota.
 946
 947             Correct the text names for DHCP options 64 and 65 to be
 948             "nis+-domain" and "nis+-servers".
 949
 950             Updated Spanish translation. Thanks to Chris Chatham.
 951
 952             Force re-reading of /etc/resolv.conf when an "interface
 953             up" event occurs.
 954
 955
 956 version 2.45
 957             Fix total DNS failure in release 2.44 unless --min-port
 958             specified. Thanks to Steven Barth and Grant Coady for
 959             bugreport. Also reject out-of-range port spec, which could
 960             break things too: suggestion from Gilles Espinasse.
 961
 962
 963 version 2.44
 964             Fix  crash when unknown client attempts to renew a DHCP
 965             lease, problem introduced in version 2.43. Thanks to
 966             Carlos Carvalho for help chasing this down.
 967
 968             Fix potential crash when a host which doesn't have a lease
 969             does DHCPINFORM. Again introduced in 2.43. This bug has
 970             never been reported in the wild.
 971
 972             Fix crash in netlink code introduced in 2.43. Thanks to
 973             Jean Wolter for finding this.
 974
 975             Change implementation of min_port to work even if min-port
 976             is large.
 977
 978             Patch to enable compilation of latest Mac OS X. Thanks to
 979             David Gilman.
 980
 981             Update Spanish translation. Thanks to Christopher Chatham.
 982
 983
 984 version 2.43
 985             Updated Polish translation. Thanks to Jan Psota.
 986
 987             Flag errors when configuration options are repeated
 988             illegally.
 989
 990             Further tweaks for GNU/kFreeBSD
 991
 992             Add --no-wrap to msgmerge call - provides nicer .po file
 993             format.
 994
 995             Honour lease-time spec in dhcp-host lines even for
 996             BOOTP. The user is assumed to known what they are doing in
 997             this case. (Hosts without the time spec still get infinite
 998             leases for BOOTP, over-riding the default in the
 999             dhcp-range.) Thanks to Peter Katzmann for uncovering this.
1000
1001             Fix problem matching relay-agent ids. Thanks to Michael
1002             Rack for the bug report.
1003
1004             Add --naptr-record option. Suggestion from Johan
1005             Bergquist.
1006
1007             Implement RFC 5107 server-id-override DHCP relay agent
1008             option.
1009
1010             Apply patches from Stefan Kruger for compilation on
1011             Solaris 10 under Sun studio.
1012
1013             Yet more tweaking of Linux capability code, to suppress
1014             pointless wingeing from kernel 2.6.25 and above.
1015
1016             Improve error checking during startup. Previously, some
1017             errors which occurred during startup would be worked
1018             around, with dnsmasq still starting up. Some were logged,
1019             some silent. Now, they all cause a fatal error and dnsmasq
1020             terminates with a non-zero exit code. The errors are those
1021             associated with changing uid and gid, setting process
1022             capabilities and writing the pidfile. Thanks to Uwe
1023             Gansert and the Suse security team for pointing out
1024             this improvement, and Bill Reimers for good implementation
1025             suggestions.
1026
1027             Provide NO_LARGEFILE compile option to switch off largefile
1028             support when compiling against versions of uclibc which
1029             don't support it. Thanks to Stephane Billiart for the patch.
1030
1031             Implement random source ports for interactions with
1032             upstream nameservers. New spoofing attacks have been found
1033             against nameservers which do not do this, though it is not
1034             clear if dnsmasq is vulnerable, since to doesn't implement
1035             recursion. By default dnsmasq will now use a different
1036             source port (and socket) for each query it sends
1037             upstream. This behaviour can suppressed using the
1038             --query-port option, and the old default behaviour
1039             restored using --query-port=0. Explicit source-port
1040             specifications in --server configs are still honoured.
1041
1042             Replace the random number generator, for better
1043             security. On most BSD systems, dnsmasq uses the
1044             arc4random() RNG, which is secure, but on other platforms,
1045             it relied on the C-library RNG, which may be
1046             guessable and therefore allow spoofing. This release
1047             replaces the libc RNG with the SURF RNG, from Daniel
1048             J. Berstein's DJBDNS package.
1049
1050             Don't attempt to change user or group or set capabilities
1051             if dnsmasq is run as a non-root user. Without this, the
1052             change from soft to hard errors when these fail causes
1053             problems for non-root daemons listening on high
1054             ports. Thanks to Patrick McLean for spotting this.
1055
1056             Updated French translation. Thanks to Gildas Le Nadan.
1057
1058
1059 version 2.42
1060             The changelog for version 2.42 and earlier is
1061             available in CHANGELOG.archive.