CHANGELOG

   1 version 2.59
   2             Fix regression in 2.58 which caused failure to start up
   3             with some combinations of dnsmasq config and IPv6 kernel
   4             network config. Thanks to Brielle Bruns for the bug
   5             report.
   6
   7             Improve dnsmasq's behaviour when network interfaces are
   8             still doing duplicate address detection (DAD). Previously,
   9             dnsmasq would wait up to 20 seconds at start-up for the
  10             DAD state to terminate. This is broken for bridge
  11             interfaces on recent Linux kernels, which don't start DAD
  12             until the bridge comes up, and so can take arbitrary
  13             time. The new behaviour lets dnsmasq poll for an arbitrary
  14             time whilst providing service on other interfaces. Thanks
  15             to Stephen Hemminger for pointing out the problem.
  16
  17
  18 version 2.58
  19             Provide a definition of the SA_SIZE macro where it's
  20             missing. Fixes build failure on openBSD.
  21
  22             Don't include a zero terminator at the end of messages
  23             sent to /dev/log when /dev/log is a datagram socket.
  24             Thanks to Didier Rabound for spotting the problem.
  25
  26             Add --dhcp-sequential-ip flag, to force allocation of IP
  27             addresses in ascending order. Note that the default
  28             pseudo-random mode is in general better but some
  29             server-deployment applications need this.
  30
  31             Fix problem where a server-id of 0.0.0.0 is sent to a
  32             client when a dhcp-relay is in use if a client renews a
  33             lease after dnsmasq restart and before any clients on the
  34             subnet get a new lease. Thanks to Mike Ruiz for assistance
  35             in chasing this one down.
  36
  37             Don't return NXDOMAIN to an AAAA query if we have CNAME
  38             which points to an A record only: NODATA is the correct
  39             reply in this case. Thanks to Tom Fernandes for spotting
  40             the problem.
  41
  42             Relax the need to supply a netmask in --dhcp-range for
  43             networks which use a DHCP relay. Whilst this is still
  44             desireable, in the absence of a netmask dnsmasq will use
  45             a default based on the class (A, B, or C) of the address.
  46             This should at least remove a cause of mysterious failure
  47             for people using RFC1918 addresses and relays.
  48
  49             Add support for Linux conntrack connection marking. If
  50             enabled with --conntrack, the connection mark for incoming
  51             DNS queries will be copied  to the outgoing connections
  52             used to answer those queries. This allows clever firewall
  53             and accounting stuff. Only available if dnsmasq is
  54             compiled with HAVE_CONNTRACK and adds a dependency on
  55             libnetfilter-conntrack. Thanks to Ed Wildgoose for the
  56             initial idea, testing and sponsorship of this function.
  57
  58             Provide a sane error message when someone attempts to
  59             match a tag in --dhcp-host.
  60
  61             Tweak the behaviour of --domain-needed, to avoid problems
  62             with recursive nameservers downstream of dnsmasq. The new
  63             behaviour only stops A and AAAA queries, and returns
  64             NODATA rather than NXDOMAIN replies.
  65
  66             Efficiency fix for very large DHCP configurations, thanks
  67             to James Gartrell and Mike Ruiz for help with this.
  68
  69             Allow the TFTP-server address in --dhcp-boot to be a
  70             domain-name which is looked up in /etc/hosts. This can
  71             give multiple IP addresses which are used round-robin,
  72             thus doing TFTP server load-balancing. Thanks to Sushil
  73             Agrawal for the patch.
  74
  75             When two tagged dhcp-options for a particular option
  76             number are both valid, use the one which is valid without
  77             a tag from the dhcp-range. Allows overriding of the value
  78             of a DHCP option for a particular host as well as
  79             per-network values.  So
  80             --dhcp-range=set:interface1,......
  81             --dhcp-host=set:myhost,.....
  82             --dhcp-option=tag:interface1,option:nis-domain,"domain1"
  83             --dhcp-option=tag:myhost,option:nis-domain,"domain2"
  84             will set the NIS-domain to domain1 for hosts in the range, but
  85             override that to domain2 for a particular host.
  86
  87             Fix bug which resulted in truncated files and timeouts for
  88             some TFTP transfers. The bug only occurs with netascii
  89             transfers and needs an unfortunate relationship between
  90             file size, blocksize and the number of newlines in the
  91             last block before it manifests itself. Many thanks to
  92             Alkis Georgopoulos for spotting the problem and providing
  93             a comprehensive test-case.
  94
  95             Fix regression in TFTP server on *BSD platforms introduced
  96             in version 2.56, due to confusion with sockaddr
  97             length. Many thanks to Loïc Pefferkorn for finding this.
  98
  99             Support scope-ids in IPv6 addresses of nameservers from
 100             /etc/resolv.conf and in --server options. Eg
 101             nameserver fe80::202:a412:4512:7bbf%eth0 or
 102             server=fe80::202:a412:4512:7bbf%eth0. Thanks to
 103             Michael Stapelberg for the suggestion.
 104
 105             Update Polish translation, thanks to Jan Psota.
 106
 107             Update French translation. Thanks to Gildas Le Nadan.
 108
 109
 110 version 2.57
 111             Add patches to allow build under Android.
 112
 113             Provide our own header for the DNS protocol, rather than
 114             relying on arpa/nameser.h. This has proved more or less
 115             defective over the years and the final straw is that it's
 116             effectively empty on Android.
 117
 118             Fix regression in 2.56 which caused hex constants in
 119             configuration to be rejected if they contain the '*'
 120             wildcard.
 121
 122             Correct wrong casts of arguments to ctype.h functions,
 123             isdigit(), isxdigit() etc. Thanks to Matthias Andree for
 124             spotting this.
 125
 126             Allow build with IDN support independently from i18n.
 127             IDN support continues to be included automatically
 128             when i18n is included.
 129             'make COPTS=-DHAVE_IDN' is the magic incantation.
 130
 131             Modify check on extraneous command line junk (added in
 132             2.56) so that it doesn't complain about extra _empty_
 133             arguments. Otherwise this breaks libvirt.
 134
 135
 136 version 2.56
 137             Add a patch to allow dnsmasq to get interface names right in a
 138             Solaris zone. Thanks to Dj Padzensky for this.
 139
 140             Improve data-type parsing heuristics so that
 141             --dhcp-option=option:domain-search,.
 142             treats the value as a string and not an IP address.
 143             Thanks to Clemens Fischer for spotting that.
 144
 145             Add IPv6 support to the TFTP server. Many thanks to Jan
 146             'RedBully' Seiffert for the patches.
 147
 148             Log DNS queries at level LOG_INFO, rather then
 149             LOG_DEBUG. This makes things consistent with DHCP
 150             logging. Thanks to Adam Pribyl for spotting the problem.
 151
 152             Ensure that dnsmasq terminates cleanly when using
 153             --syslog-async even if it cannot make a connection to the
 154             syslogd.
 155
 156             Add --add-mac option. This is to support currently
 157             experimental DNS filtering facilities. Thanks to Benjamin
 158             Petrin for the orignal patch.
 159
 160             Fix bug which meant that tags were ignored in dhcp-range
 161             configuration specifying PXE-proxy service. Thanks to
 162             Cristiano Cumer for spotting this.
 163
 164             Raise an error if there is extra junk, not part of an
 165             option, on the command line.
 166
 167             Flag a couple of log messages in cache.c as coming from
 168             the DHCP subsystem. Thanks to Olaf Westrik for the patch.
 169
 170             Omit timestamps from logs when a) logging to stderr and
 171             b) --keep-in-forground is set. The logging facility on the
 172             other end of stderr can be assumned to supply them. Thanks
 173             to John Hallam for the patch.
 174
 175             Don't complain about strings longer than 255 characters in
 176             --txt-record, just split the long strings into 255
 177             character chunks instead.
 178
 179             Fix crash on double-free. This bug can only happen when
 180             dhcp-script is in use and then only in rare circumstances
 181             triggered by high DHCP transaction rate and a slow
 182             script. Thanks to Ferenc Wagner for finding the problem.
 183
 184             Only log that a file has been sent by TFTP after the
 185             transfer has completed succesfully.
 186
 187             A good suggestion from Ferenc Wagner: extend
 188             the --domain option to allow this sort of thing:
 189             --domain=thekelleys.org.uk,192.168.0.0/24,local
 190             which automatically creates
 191             --local=/thekelleys.org.uk/
 192             --local=/0.168.192.in-addr.arpa/
 193
 194             Tighten up syntax checking of hex contants in the config
 195             file.  Thanks to Fred Damen for spotting this.
 196
 197             Add dnsmasq logo/icon, contributed by Justin Swift. Many
 198             thanks for that.
 199
 200             Never cache DNS replies which have the 'cd' bit set, or
 201             which result from queries forwarded with the 'cd' bit
 202             set. The 'cd' bit instructs a DNSSEC validating server
 203             upstream to ignore signature failures and return replies
 204             anyway. Without this change it's possible to pollute the
 205             dnsmasq cache with bad data by making a query with the
 206             'cd' bit set and subsequent queries would return this data
 207             without its being marked as suspect. Thanks to Anders
 208             Kaseorg for pointing out this problem.
 209
 210             Add --proxy-dnssec flag, for compliance with RFC
 211             4035. Dnsmasq will now clear the 'ad' bit in answers returned
 212             from upstream validating nameservers unless this option is
 213             set.
 214
 215             Allow a filename of "-" for --conf-file to read
 216             stdin. Suggestion from Timothy Redaelli.
 217
 218             Rotate the order of SRV records in replies, to provide
 219             round-robin load balancing when all the priorities are
 220             equal. Thanks to Peter McKinney for the suggestion.
 221
 222             Edit
 223             contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist
 224             so that it doesn't log all queries to a file by
 225             default. Thanks again to Peter McKinney.
 226
 227             By default, setting an IPv4 address for a domain but not
 228             an IPv6 address causes dnsmasq to return
 229             an NODATA reply for IPv6 (or vice-versa). So
 230             --address=/google.com/1.2.3.4 stops IPv6 queries for
 231             *google.com from being forwarded. Make it possible to
 232             override this behaviour by defining the sematics if the
 233             same domain appears in  both --server and --address.
 234             In that case, the --address has priority for the address
 235             family in which is appears, but the --server has priority
 236             of the address family which doesn't appear in --adddress
 237             So:
 238             --address=/google.com/1.2.3.4
 239             --server=/google.com/#
 240             will return 1.2.3.4 for IPv4 queries for *.google.com but
 241             forward IPv6 queries to the normal upstream nameserver.
 242             Similarly when setting an IPv6 address
 243             only this will allow forwarding of IPv4 queries. Thanks to
 244             William for pointing out the need for this.
 245
 246             Allow more than one --dhcp-optsfile and --dhcp-hostsfile
 247             and make them understand directories as arguments in the
 248             same way as --addn-hosts. Suggestion from John Hanks.
 249
 250             Ignore rebinding requests for leases we don't know
 251             about. Rebind is broadcast, so we might get to overhear a
 252             request meant for another DHCP server. NAKing this is
 253             wrong. Thanks to Brad D'Hondt for assistance with this.
 254
 255             Fix cosmetic bug which produced strange output when
 256             dumping cache statistics with some configurations. Thanks
 257             to Fedor Kozhevnikov for spotting this.
 258
 259
 260 version 2.55
 261             Fix crash when /etc/ethers is in use. Thanks to
 262             Gianluigi Tiesi for finding this.
 263
 264             Fix crash in netlink_multicast(). Thanks to Arno Wald for
 265             finding this one.
 266
 267             Allow the empty domain "." in dhcp domain-search (119)
 268             options.
 269
 270
 271 version 2.54
 272             There is no version 2.54 to avoid confusion with 2.53,
 273             which incorrectly identifies itself as 2.54.
 274
 275
 276 version 2.53
 277             Fix failure to compile on Debian/kFreeBSD. Thanks to
 278             Axel Beckert and Petr Salinger.
 279
 280             Fix code to avoid scary strict-aliasing warnings
 281             generated by gcc 4.4.
 282
 283             Added FAQ entry warning about DHCP failures with Vista
 284             when firewalls block 255.255.255.255.
 285
 286             Fixed bug which caused bad things to happen if a
 287             resolv.conf file which exists is subsequently removed.
 288             Thanks to Nikolai Saoukh for the patch.
 289
 290             Rationalised the DHCP tag system. Every configuration item
 291             which can set a tag does so by adding "set:<tag>" and
 292             every configuration item which is conditional on a tag is
 293             made so by "tag:<tag>". The NOT operator changes to '!',
 294             which is a bit more intuitive too. Dhcp-host directives
 295             can set more than one tag now. The old '#' NOT,
 296             "net:" prefix and no-prefixes are still honoured, so
 297             no existing config file needs to be changed, but
 298             the documentation and new-style config files should be
 299             much less confusing.
 300
 301             Added --tag-if to allow boolean operations on tags.
 302             This allows complicated logic to be clearer and more
 303             general. A great suggestion from Richard Voigt.
 304
 305             Add broadcast/unicast information to DHCP logging.
 306
 307             Allow --dhcp-broadcast to be unconditional.
 308
 309             Fixed incorrect behaviour with NOT <tag> conditionals in
 310             dhcp-options. Thanks to Max Turkewitz for assistance
 311             finding this.
 312
 313             If we send vendor-class encapsulated options based on the
 314             vendor-class supplied by the client, and no explicit
 315             vendor-class option is given, echo back the vendor-class
 316             from the client.
 317
 318             Fix bug which stopped dnsmasq from matching both a
 319             circuitid and a remoteid. Thanks to Ignacio Bravo for
 320             finding this.
 321
 322             Add --dhcp-proxy, which makes it possible to configure
 323             dnsmasq to use a DHCP relay agent as a full proxy, with
 324             all DHCP messages passing through the proxy. This is
 325             useful if the relay adds extra information to the packets
 326             it forwards, but cannot be configured with the RFC 5107
 327             server-override option.
 328
 329             Added interface:<iface name> part to dhcp-range. The
 330             semantics of this are very odd at first sight, but it
 331             allows a single line  of the form
 332                 dhcp-range=interface:virt0,192.168.0.4,192.168.0.200
 333             to be added to dnsmasq configuration which then supplies
 334             DHCP and DNS services to that interface, without affecting
 335             what services are supplied to other interfaces and
 336             irrespective of the existance or lack of
 337                 interface=<interface>
 338             lines elsewhere in the dnsmasq configuration. The idea is
 339             that such a line can be added automatically by libvirt
 340             or equivalent systems, without disturbing any manual
 341             configuration.
 342
 343             Similarly to the above, allow --enable-tftp=<interface>
 344
 345             Allow a TFTP root to be set separately for requests via
 346             different interfaces, --tftp-root=<path>,<interface>
 347
 348             Correctly handle and log clashes between CNAMES and
 349             DNS names being given to DHCP leases. This fixes a bug
 350             which caused nonsense IP addresses to be logged. Thanks to
 351             Sergei Zhirikov for finding and analysing the problem.
 352
 353             Tweak flush_log so as to avoid leaving the log
 354             file in non-blocking mode. O_NONBLOCK is a property of the
 355             file, not the process/descriptor.
 356
 357             Fix contrib/Solaris10/create_package
 358             (/usr/man -> /usr/share/man) Thanks to Vita Batrla.
 359
 360             Fix a problem where, if a client got a lease, then went
 361             to another subnet and got another lease, then moved back,
 362             it couldn't resume the old lease, but would instead get
 363             a new address. Thanks to Leonardo Rodrigues for spotting
 364             this and testing the fix.
 365
 366             Fix weird bug which sometimes omitted certain characters
 367             from the start of quoted strings in dhcp-options. Thanks
 368             to Dayton Turner for spotting the problem.
 369
 370             Add facility to redirect some domains to the standard
 371             upstream servers: this allows something like
 372             --server=/google.com/1.2.3.4 --server=/www.google.com/#
 373             which will send queries for *.google.com to 1.2.3.4,
 374             except *www.google.com which will be forwarded as usual.
 375             Thanks to AJ Weber for prompting this addition.
 376
 377             Improve the hash-algorithm used to generate IP addresses
 378             from MAC addresses during initial DHCP address
 379             allocation. This improves performance when large numbers
 380             of hosts with similar MAC addresses all try and get an IP
 381             address at the same time. Thanks to Paul Smith for his
 382             work on this.
 383
 384             Tweak DHCP code so that --bridge-interface can be used to
 385             select which IP alias of an interface should be used for
 386             DHCP purposes on Linux. If eth0 has an alias eth0:dhcp
 387             then adding  --bridge-interface=eth0:dhcp,eth0 will use
 388             the address of eth0:dhcp to determine the correct subnet
 389             for DHCP address allocation. Thanks to Pawel Golaszewski
 390             for prompting this and Eric Cooper for further testing.
 391
 392             Add --dhcp-generate-names. Suggestion by Ferenc Wagner.
 393
 394             Tweak DNS server selection algorithm when there is more
 395             than one server available for a domain, eg.
 396             --server=/mydomain/1.1.1.1
 397             --server=/mydomain/2.2.2.2
 398             Thanks to Alberto Cuesta-Canada for spotting a weakness
 399             here.
 400
 401             Add --max-ttl. Thanks to Fredrik Ringertz for the patch.
 402
 403             Allow --log-facility=- to force all logging to
 404             stderr. Suggestion from Clemens Fischer.
 405
 406             Fix regression which caused configuration like
 407             --address=/.domain.com/1.2.3.4 to be rejected. The dot to the
 408             left of the domain has been implied and not required for a
 409             long time, but it should be accepted for backward
 410             compatibility. Thanks to Andrew Burcin for spotting this.
 411
 412             Add --rebind-domain-ok and --rebind-localhost-ok.
 413             Suggestion from Clemens Fischer.
 414
 415             Log replies to queries of type TXT, when --log-queries
 416             is set.
 417
 418             Fix compiler warnings when compiled with -DNO_DHCP. Thanks
 419             to Shantanu Gadgil for the patch.
 420
 421             Updated French translation. Thanks to Gildas Le Nadan.
 422
 423             Updated Polish translation. Thanks to Jan Psota.
 424
 425             Updated German translation. Thanks to Matthias Andree.
 426
 427             Added contrib/static-arp, thanks to Darren Hoo.
 428
 429             Fix corruption of the domain when a name from /etc/hosts
 430             overrides one supplied by a DHCP client. Thanks to Fedor
 431             Kozhevnikov for spotting the problem.
 432
 433             Updated Spanish translation. Thanks to Chris Chatham.
 434
 435
 436 version 2.52
 437             Work around a Linux kernel bug which insists that the
 438             length of the option passed to setsockopt must be at least
 439             sizeof(int) bytes, even if we're calling SO_BINDTODEVICE
 440             and the device name is "lo".  Note that this is fixed
 441             in kernel 2.6.31, but the workaround is harmless and
 442             allows earlier kernels to be used. Also fix dnsmasq
 443             bug which reported the wrong address when this failed.
 444             Thanks to Fedor for finding this.
 445
 446             The API for IPv6 PKTINFO changed around Linux kernel
 447             2.6.14. Workaround the case where dnsmasq is compiled
 448             against newer headers, but then run on an old kernel:
 449             necessary for some *WRT distros.
 450
 451             Re-read the set of network interfaces when re-loading
 452             /etc/resolv.conf if --bind-interfaces is not set. This
 453             handles the case that loopback interfaces do not exist
 454             when dnsmasq is first started.
 455
 456             Tweak the PXE code to support port 4011. This should
 457             reduce broadcasts and make things more reliable when other
 458             servers are around. It also improves inter-operability
 459             with certain clients.
 460
 461             Make a pxe-service configuration with no filename or boot
 462             service type legal: this does a local boot. eg.
 463             pxe-service=x86PC, "Local boot"
 464
 465             Be more conservative in detecting "A for A"
 466             queries. Dnsmasq checks if the name in a type=A query looks
 467             like a dotted-quad IP address and answers the query itself
 468             if so, rather than forwarding it. Previously dnsmasq
 469             relied in the library function inet_addr() to convert
 470             addresses, and that will accept some things which are
 471             confusing in this context, like 1.2.3 or even just
 472             1234. Now we only do A for A processing for four decimal
 473             numbers delimited by dots.
 474
 475             A couple of tweaks to fix compilation on Solaris. Thanks
 476             to Joel Macklow for help with this.
 477
 478             Another Solaris compilation tweak, needed for Solaris
 479             2009.06. Thanks to Lee Essen for that.
 480
 481             Added extract packaging stuff from Lee Essen to
 482             contrib/Solaris10.
 483
 484             Increased the default limit on number of leases to 1000
 485             (from 150). This is mainly a defence against DoS attacks,
 486             and for the average "one for two class C networks"
 487             installation, IP address exhaustion does that just as
 488             well. Making the limit greater than the number of IP
 489             addresses available in such an installation removes a
 490             surprise which otherwise can catch people out.
 491
 492             Removed extraneous trailing space in the value of the
 493             DNSMASQ_TIME_REMAINING DNSMASQ_LEASE_LENGTH and
 494             DNSMASQ_LEASE_EXPIRES environment variables. Thanks to
 495             Gildas Le Nadan for spotting this.
 496
 497             Provide the network-id tags for a DHCP transaction to
 498             the lease-change script in the environment variable
 499             DNSMASQ_TAGS. A good suggestion from Gildas Le Nadan.
 500
 501             Add support for RFC3925 "Vendor-Identifying Vendor
 502             Options". The syntax looks like this:
 503             --dhcp-option=vi-encap:<enterprise number>, .........
 504
 505             Add support to --dhcp-match to allow matching against
 506             RFC3925 "Vendor-Identifying Vendor Classes". The syntax
 507             looks like this:
 508             --dhcp-match=tag,vi-encap<enterprise number>, <value>
 509
 510             Add some application specific code to assist in
 511             implementing the Broadband forum TR069 CPE-WAN
 512             specification. The details are in contrib/CPE-WAN/README
 513
 514             Increase the default DNS packet size limit to 4096, as
 515             recommended by RFC5625 section 4.4.3. This can be
 516             reconfigured using --edns-packet-max if needed. Thanks to
 517             Francis Dupont for pointing this out.
 518
 519             Rewrite query-ids even for TSIG signed packets, since
 520             this is allowed by RFC5625 section 4.5.
 521
 522             Use getopt_long by default on OS X. It has been supported
 523             since version 10.3.0. Thanks to Arek Dreyer for spotting
 524             this.
 525
 526             Added up-to-date startup configuration for MacOSX/launchd
 527             in contrib/MacOSX-launchd. Thanks to Arek Dreyer for
 528             providing this.
 529
 530             Fix link error when including Dbus but excluding DHCP.
 531             Thanks to Oschtan for the bug report.
 532
 533             Updated French translation. Thanks to Gildas Le Nadan.
 534
 535             Updated Polish translation. Thanks to Jan Psota.
 536
 537             Updated Spanish translation. Thanks to Chris Chatham.
 538
 539             Fixed confusion about domains, when looking up DHCP hosts
 540             in /etc/hosts. This could cause spurious "Ignoring
 541             domain..." messages. Thanks to Fedor Kozhevnikov for
 542             finding and analysing the problem.
 543
 544
 545 version 2.51
 546             Add support for internationalised DNS. Non-ASCII characters
 547             in domain names found in /etc/hosts, /etc/ethers and
 548             /etc/dnsmasq.conf will be correctly handled by translation to
 549             punycode, as specified in RFC3490. This function is only
 550             available if dnsmasq is compiled with internationalisation
 551             support, and adds a dependency on GNU libidn. Without i18n
 552             support, dnsmasq continues to be compilable with just
 553             standard tools. Thanks to Yves Dorfsman for the
 554             suggestion.
 555
 556             Add two more environment variables for lease-change scripts:
 557             First, DNSMASQ_SUPPLIED_HOSTNAME; this is set to the hostname
 558             supplied by a client, even if the actual hostname used is
 559             over-ridden by dhcp-host or dhcp-ignore-names directives.
 560             Also DNSMASQ_RELAY_ADDRESS which gives the address of
 561             a DHCP relay, if used.
 562             Suggestions from Michael Rack.
 563
 564             Fix regression which broke echo of relay-agent
 565             options. Thanks to Michael Rack for spotting this.
 566
 567             Don't treat option 67 as being interchangeable with
 568             dhcp-boot parameters if it's specified as
 569             dhcp-option-force.
 570
 571             Make the code to call scripts on lease-change compile-time
 572             optional. It can be switched off by editing src/config.h
 573             or building with "make COPTS=-DNO_SCRIPT".
 574
 575             Make the TFTP server cope with filenames from Windows/DOS
 576             which use '\' as pathname separator. Thanks to Ralf for
 577             the patch.
 578
 579             Updated Polish translation. Thanks to Jan Psota.
 580
 581             Warn if an IP address is duplicated in /etc/ethers. Thanks
 582             to Felix Schwarz for pointing this out.
 583
 584             Teach --conf-dir to take an option list of file suffices
 585             which will be ignored when scanning the directory. Useful
 586             for backup files etc. Thanks to Helmut Hullen for the
 587             suggestion.
 588
 589             Add new DHCP option named tftpserver-address, which
 590             corresponds to the third argument of dhcp-boot. This
 591             allows the complete functionality of dhcp-boot to be
 592             replicated with dhcp-option. Useful when using
 593             dhcp-optsfile.
 594
 595             Test which upstream nameserver to use every 10 seconds
 596             or 50 queries and not just when a query times out and
 597             is retried. This should improve performance when there
 598             is a slow nameserver in the list. Thanks to Joe for the
 599             suggestion.
 600
 601             Don't do any PXE processing, even for clients with the
 602             correct vendorclass, unless at least one pxe-prompt or
 603             pxe-service option is given. This stops dnsmasq
 604             interfering with proxy PXE subsystems when it is just
 605             the DHCP server. Thanks to Spencer Clark for spotting this.
 606
 607             Limit the blocksize used for TFTP transfers to a value
 608             which avoids packet fragmentation, based on the MTU of the
 609             local interface. Many netboot ROMs can't cope with
 610             fragmented packets.
 611
 612             Honour dhcp-ignore configuration for PXE and proxy-PXE
 613             requests. Thanks to Niels Basjes for the bug report.
 614
 615             Updated French translation. Thanks to Gildas Le Nadan.
 616
 617
 618 version 2.50
 619             Fix security problem which allowed any host permitted to
 620             do TFTP to possibly compromise dnsmasq by remote buffer
 621             overflow when TFTP enabled. Thanks to Core Security
 622             Technologies and Iván Arce, Pablo Hernán Jorge, Alejandro
 623             Pablo Rodriguez, Martín Coco, Alberto Soliño Testa and
 624             Pablo Annetta. This problem has Bugtraq id: 36121
 625             and CVE: 2009-2957
 626
 627             Fix a problem which allowed a malicious TFTP client to
 628             crash dnsmasq. Thanks to Steve Grubb at Red Hat for
 629             spotting this. This problem has Bugtraq id: 36120 and
 630             CVE: 2009-2958
 631
 632
 633 version 2.49
 634             Fix regression in 2.48 which disables the lease-change
 635             script. Thanks to Jose Luis Duran for spotting this.
 636
 637             Log TFTP "file not found" errors. These were not logged,
 638             since a normal PXELinux boot generates many of them, but
 639             the lack of the messages seems to be more confusing than
 640             routinely seeing them when there is no real error.
 641
 642             Update Spanish translation. Thanks to Chris Chatham.
 643
 644
 645 version 2.48
 646             Archived the extensive, backwards, changelog to
 647             CHANGELOG.archive. The current changelog now runs from
 648             version 2.43 and runs conventionally.
 649
 650             Fixed bug which broke binding of servers to physical
 651             interfaces when interface names were longer than four
 652             characters. Thanks to MURASE Katsunori for the patch.
 653
 654             Fixed netlink code to check that messages come from the
 655             correct source, and not another userspace process. Thanks
 656             to Steve Grubb for the patch.
 657
 658             Maintainability drive: removed bug and missing feature
 659             workarounds for some old platforms. Solaris 9, OpenBSD
 660             older than 4.1, Glibc older than 2.2, Linux 2.2.x and
 661             DBus older than 1.1.x are no longer supported.
 662
 663             Don't read included configuration files more than once:
 664             allows complex configuration structures without problems.
 665
 666             Mark log messages from the various subsystems in dnsmasq:
 667             messages from the DHCP subsystem now have the ident string
 668             "dnsmasq-dhcp" and messages from TFTP have ident
 669             "dnsmasq-tftp". Thanks to Olaf Westrik for the patch.
 670
 671             Fix possible infinite DHCP protocol loop when an IP
 672             address nailed to a hostname (not a MAC address)  and a
 673             host sometimes provides the name, sometimes not.
 674
 675             Allow --addn-hosts to take a directory: all the files
 676             in the directory are read. Thanks to Phil Cornelius for
 677             the suggestion.
 678
 679             Support --bridge-interface on all platforms, not just BSD.
 680
 681             Added support for advanced PXE functions. It's now
 682             possible to define a prompt and menu options which will
 683             be displayed when a client PXE boots. It's also possible to
 684             hand-off booting to other boot servers. Proxy-DHCP, where
 685             dnsmasq just supplies the PXE information and another DHCP
 686             server does address allocation, is also allowed. See the
 687             --pxe-prompt and --pxe-service keywords. Thanks to
 688             Alkis Georgopoulos for the suggestion and Guilherme Moro
 689             and Michael Brown for assistance.
 690
 691             Improvements to DHCP logging. Thanks to Tom Metro for
 692             useful suggestions.
 693
 694             Add ability to build dnsmasq without DHCP support. To do
 695             this, edit src/config.h or build with
 696             "make COPTS=-DNO_DHCP". Thanks to Mahavir Jain for the patch.
 697
 698             Added --test command-line switch - syntax check
 699             configuration files only.
 700
 701             Updated French translation. Thanks to Gildas Le Nadan.
 702
 703
 704 version 2.47
 705             Updated French translation. Thanks to Gildas Le Nadan.
 706
 707             Fixed interface enumeration code to work on NetBSD
 708             5.0. Thanks to Roy Marples for the patch.
 709
 710             Updated config.h to use the same location for the lease
 711             file on NetBSD as the other *BSD variants. Also allow
 712             LEASEFILE and CONFFILE symbols to be overriden in CFLAGS.
 713
 714             Handle duplicate address detection on IPv6 more
 715             intelligently. In IPv6, an interface can have an address
 716             which is not usable, because it is still undergoing DAD
 717             (such addresses are marked "tentative"). Attempting to
 718             bind to an address in this state returns an error,
 719             EADDRNOTAVAIL. Previously, on getting such an error,
 720             dnsmasq would silently abandon the address, and never
 721             listen on it. Now, it retries once per second for 20
 722             seconds before generating a fatal error. 20 seconds should
 723             be long enough for any DAD process to complete, but can be
 724             adjusted in src/config.h if necessary. Thanks to Martin
 725             Krafft for the bug report.
 726
 727             Add DBus introspection. Patch from Jeremy Laine.
 728
 729             Update Dbus configuration file. Patch from Colin Walters.
 730             Fix for this bug:
 731             http://bugs.freedesktop.org/show_bug.cgi?id=18961
 732
 733             Support arbitrarily encapsulated DHCP options, suggestion
 734             and initial patch from Samium Gromoff. This is useful for
 735             (eg) gPXE, which expect all its private options to be
 736             encapsulated inside a single option 175. So, eg,
 737
 738             dhcp-option = encap:175, 190, "iscsi-client0"
 739             dhcp-option = encap:175, 191, "iscsi-client0-secret"
 740
 741             will provide iSCSI parameters to gPXE.
 742
 743             Enhance --dhcp-match to allow testing of the contents of a
 744             client-sent option, as well as its presence. This
 745             application in mind for this is RFC 4578
 746             client-architecture specifiers, but it's generally useful.
 747             Joey Korkames suggested the enhancement.
 748
 749             Move from using the IP_XMIT_IF ioctl to IP_BOUND_IF on
 750             OpenSolaris. Thanks to Bastian Machek for the heads-up.
 751
 752             No longer complain about blank lines in
 753             /etc/ethers. Thanks to Jon Nelson for the patch.
 754
 755             Fix binding of servers to physical devices, eg
 756             --server=/domain/1.2.3.4@eth0 which was broken from 2.43
 757             onwards unless --query-port=0 set. Thanks to Peter Naulls
 758             for the bug report.
 759
 760             Reply to DHCPINFORM requests even when the supplied ciaddr
 761             doesn't fall in any dhcp-range. In this case it's not
 762             possible to supply a complete configuration, but
 763             individually-configured options (eg PAC) may be useful.
 764
 765             Allow the source address of an alias to be a range:
 766             --alias=192.168.0.0,10.0.0.0,255.255.255.0 maps the whole
 767             subnet 192.168.0.0->192.168.0.255 to 10.0.0.0->10.0.0.255,
 768             as before.
 769             --alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0
 770             maps only the 192.168.0.10->192.168.0.40 region. Thanks to
 771             Ib Uhrskov for the suggestion.
 772
 773             Don't dynamically allocate DHCP addresses which may break
 774             Windows.  Addresses which end in .255 or .0 are broken in
 775             Windows even when using supernetting.
 776             --dhcp-range=192.168.0.1,192.168.1.254,255,255,254.0 means
 777             192.168.0.255 is a valid IP address, but not for Windows.
 778             See Microsoft KB281579. We therefore no longer allocate
 779             these addresses to avoid hard-to-diagnose problems.
 780
 781             Update Polish translation. Thanks to Jan Psota.
 782
 783             Delete the PID-file when dnsmasq shuts down. Note that by
 784             this time, dnsmasq is normally not running as root, so
 785             this will fail if the PID-file is stored in a root-owned
 786             directory; such failure is silently ignored. To take
 787             advantage of this feature, the PID-file must be stored in a
 788             directory owned and write-able by the user running
 789             dnsmasq.
 790
 791
 792 version 2.46
 793             Allow --bootp-dynamic to take a netid tag, so that it may
 794             be selectively enabled. Thanks to Olaf Westrik for the
 795             suggestion.
 796
 797             Remove ISC-leasefile reading code. This has been
 798             deprecated for a long time, and last time I removed it, it
 799             ended up going back by request of one user. This time,
 800             it's gone for good; otherwise it would need to be
 801             re-worked to support multiple domains (see below).
 802
 803             Support DHCP clients in multiple DNS domains. This is a
 804             long-standing request. Clients are assigned to a domain
 805             based in their IP address.
 806
 807             Add --dhcp-fqdn flag, which changes behaviour if DNS names
 808             assigned to DHCP clients. When this is set, there must be
 809             a domain associated with each client, and only
 810             fully-qualified domain names are added to the DNS. The
 811             advantage is that the only the FQDN needs to be unique,
 812             so that two or more DHCP clients can share a hostname, as
 813             long as they are in different domains.
 814
 815             Set environment variable DNSMASQ_DOMAIN when invoking
 816             lease-change script. This may be useful information to
 817             have now that it's variable.
 818
 819             Tighten up data-checking code for DNS packet
 820             handling. Thanks to Steve Dodd who found certain illegal
 821             packets which could crash dnsmasq. No memory overwrite was
 822             possible, so this is not a security issue beyond the DoS
 823             potential.
 824
 825             Update example config dhcp option 47, the previous
 826             suggestion generated an illegal, zero-length,
 827             option. Thanks to Matthias Andree for finding this.
 828
 829             Rewrite hosts-file reading code to remove the limit of
 830             1024 characters per line. John C Meuser found this.
 831
 832             Create a net-id tag with the name of the interface on
 833             which the DHCP request was received.
 834
 835             Fixed minor memory leak in DBus code, thanks to Jeremy
 836             Laine for the patch.
 837
 838             Emit DBus signals as the DHCP lease database
 839             changes. Thanks to Jeremy Laine for the patch.
 840
 841             Allow for more that one MAC address in a dhcp-host
 842             line. This configuration tells dnsmasq that it's OK to
 843             abandon a DHCP lease of the fixed address to one MAC
 844             address, if another MAC address in the dhcp-host statement
 845             asks for an address. This is useful to give a fixed
 846             address to a host which has two network interfaces
 847             (say, a laptop with wired and wireless interfaces.)
 848             It's very important to ensure that only one interface
 849             at a time is up, since dnsmasq abandons the first lease
 850             and re-uses the address before the leased time has
 851             elapsed. John Gray suggested this.
 852
 853             Tweak the response to a DHCP request packet with a wrong
 854             server-id when --dhcp-authoritative is set; dnsmasq now
 855             returns a DHCPNAK, rather than silently ignoring the
 856             packet. Thanks to Chris Marget for spotting this
 857             improvement.
 858
 859             Add --cname option. This provides a limited alias
 860             function, usable for DHCP names. Thanks to AJ Weber for
 861             suggestions on this.
 862
 863             Updated contrib/webmin with latest version from Neil
 864             Fisher.
 865
 866             Updated Polish translation. Thanks to Jan Psota.
 867
 868             Correct the text names for DHCP options 64 and 65 to be
 869             "nis+-domain" and "nis+-servers".
 870
 871             Updated Spanish translation. Thanks to Chris Chatham.
 872
 873             Force re-reading of /etc/resolv.conf when an "interface
 874             up" event occurs.
 875
 876
 877 version 2.45
 878             Fix total DNS failure in release 2.44 unless --min-port
 879             specified. Thanks to Steven Barth and Grant Coady for
 880             bugreport. Also reject out-of-range port spec, which could
 881             break things too: suggestion from Gilles Espinasse.
 882
 883
 884 version 2.44
 885             Fix  crash when unknown client attempts to renew a DHCP
 886             lease, problem introduced in version 2.43. Thanks to
 887             Carlos Carvalho for help chasing this down.
 888
 889             Fix potential crash when a host which doesn't have a lease
 890             does DHCPINFORM. Again introduced in 2.43. This bug has
 891             never been reported in the wild.
 892
 893             Fix crash in netlink code introduced in 2.43. Thanks to
 894             Jean Wolter for finding this.
 895
 896             Change implementation of min_port to work even if min-port
 897             is large.
 898
 899             Patch to enable compilation of latest Mac OS X. Thanks to
 900             David Gilman.
 901
 902             Update Spanish translation. Thanks to Christopher Chatham.
 903
 904
 905 version 2.43
 906             Updated Polish translation. Thanks to Jan Psota.
 907
 908             Flag errors when configuration options are repeated
 909             illegally.
 910
 911             Further tweaks for GNU/kFreeBSD
 912
 913             Add --no-wrap to msgmerge call - provides nicer .po file
 914             format.
 915
 916             Honour lease-time spec in dhcp-host lines even for
 917             BOOTP. The user is assumed to known what they are doing in
 918             this case. (Hosts without the time spec still get infinite
 919             leases for BOOTP, over-riding the default in the
 920             dhcp-range.) Thanks to Peter Katzmann for uncovering this.
 921
 922             Fix problem matching relay-agent ids. Thanks to Michael
 923             Rack for the bug report.
 924
 925             Add --naptr-record option. Suggestion from Johan
 926             Bergquist.
 927
 928             Implement RFC 5107 server-id-override DHCP relay agent
 929             option.
 930
 931             Apply patches from Stefan Kruger for compilation on
 932             Solaris 10 under Sun studio.
 933
 934             Yet more tweaking of Linux capability code, to suppress
 935             pointless wingeing from kernel 2.6.25 and above.
 936
 937             Improve error checking during startup. Previously, some
 938             errors which occurred during startup would be worked
 939             around, with dnsmasq still starting up. Some were logged,
 940             some silent. Now, they all cause a fatal error and dnsmasq
 941             terminates with a non-zero exit code. The errors are those
 942             associated with changing uid and gid, setting process
 943             capabilities and writing the pidfile. Thanks to Uwe
 944             Gansert and the Suse security team for pointing out
 945             this improvement, and Bill Reimers for good implementation
 946             suggestions.
 947
 948             Provide NO_LARGEFILE compile option to switch off largefile
 949             support when compiling against versions of uclibc which
 950             don't support it. Thanks to Stephane Billiart for the patch.
 951
 952             Implement random source ports for interactions with
 953             upstream nameservers. New spoofing attacks have been found
 954             against nameservers which do not do this, though it is not
 955             clear if dnsmasq is vulnerable, since to doesn't implement
 956             recursion. By default dnsmasq will now use a different
 957             source port (and socket) for each query it sends
 958             upstream. This behaviour can suppressed using the
 959             --query-port option, and the old default behaviour
 960             restored using --query-port=0. Explicit source-port
 961             specifications in --server configs are still honoured.
 962
 963             Replace the random number generator, for better
 964             security. On most BSD systems, dnsmasq uses the
 965             arc4random() RNG, which is secure, but on other platforms,
 966             it relied on the C-library RNG, which may be
 967             guessable and therefore allow spoofing. This release
 968             replaces the libc RNG with the SURF RNG, from Daniel
 969             J. Berstein's DJBDNS package.
 970
 971             Don't attempt to change user or group or set capabilities
 972             if dnsmasq is run as a non-root user. Without this, the
 973             change from soft to hard errors when these fail causes
 974             problems for non-root daemons listening on high
 975             ports. Thanks to Patrick McLean for spotting this.
 976
 977             Updated French translation. Thanks to Gildas Le Nadan.
 978
 979
 980 version 2.42
 981             The changelog for version 2.42 and earlier is
 982             available in CHANGELOG.archive.