]>
Commit | Line | Data |
---|---|---|
90cb2225 SK |
1 | version 2.74 |
2 | Fix reversion in 2.73 where --conf-file would attempt to | |
3 | read the default file, rather than no file. | |
4 | ||
362c9303 SK |
5 | Fix inotify code to handle dangling symlinks better and |
6 | not SEGV in some circumstances. | |
7 | ||
8 | ||
00cd9d55 SK |
9 | version 2.73 |
10 | Fix crash at startup when an empty suffix is supplied to | |
11 | --conf-dir, also trivial memory leak. Thanks to | |
12 | Tomas Hozza for spotting this. | |
800c5cc1 SK |
13 | |
14 | Remove floor of 4096 on advertised EDNS0 packet size when | |
15 | DNSSEC in use, the original rationale for this has long gone. | |
16 | Thanks to Anders Kaseorg for spotting this. | |
17 | ||
ad946d55 SK |
18 | Use inotify for checking on updates to /etc/resolv.conf and |
19 | friends under Linux. This fixes race conditions when the files are | |
0491805d SK |
20 | updated rapidly and saves CPU by noy polling. To build |
21 | a binary that runs on old Linux kernels without inotify, | |
22 | use make COPTS=-DNO_INOTIFY | |
3ad3f3bb SK |
23 | |
24 | Fix breakage of --domain=<domain>,<subnet>,local - only reverse | |
25 | queries were intercepted. THis appears to have been broken | |
26 | since 2.69. Thanks to Josh Stone for finding the bug. | |
47669367 SK |
27 | |
28 | Eliminate IPv6 privacy addresses and deprecated addresses from | |
29 | the answers given by --interface-name. Note that reverse queries | |
30 | (ie looking for names, given addresses) are not affected. | |
31 | Thanks to Michael Gorbach for the suggestion. | |
094b5c3d SK |
32 | |
33 | Fix crash in DNSSEC code with long RRs. Thanks to Marco Davids | |
34 | for the bug report. | |
32fc6dbe GH |
35 | |
36 | Add --ignore-address option. Ignore replies to A-record | |
37 | queries which include the specified address. No error is | |
38 | generated, dnsmasq simply continues to listen for another | |
39 | reply. This is useful to defeat blocking strategies which | |
40 | rely on quickly supplying a forged answer to a DNS | |
41 | request for certain domains, before the correct answer can | |
42 | arrive. Thanks to Glen Huang for the patch. | |
ad946d55 | 43 | |
97e618a0 SK |
44 | Revisit the part of DNSSEC validation which determines if an |
45 | unsigned answer is legit, or is in some part of the DNS | |
46 | tree which should be signed. Dnsmasq now works from the | |
47 | DNS root downward looking for the limit of signed | |
48 | delegations, rather than working bottom up. This is | |
49 | both more correct, and less likely to trip over broken | |
50 | nameservers in the unsigned parts of the DNS tree | |
51 | which don't respond well to DNSSEC queries. | |
00cd9d55 | 52 | |
25cf5e37 SK |
53 | Add --log-queries=extra option, which makes logs easier |
54 | to search automatically. | |
55 | ||
28de3876 R |
56 | Add --min-cache-ttl option. I've resisted this for a long |
57 | time, on the grounds that disbelieving TTLs is never a | |
58 | good idea, but I've been persuaded that there are | |
59 | sometimes reasons to do it. (Step forward, GFW). | |
60 | To avoid misuse, there's a hard limit on the TTL | |
61 | floor of one hour. Thansk to RinSatsuki for the patch. | |
39341559 SK |
62 | |
63 | Cope with multiple interfaces with the same link-local | |
64 | address. (IPv6 addresses are scoped, so this is allowed.) | |
65 | Thanks to Cory Benfield for help with this. | |
5f4dc5c6 SK |
66 | |
67 | Add --dhcp-hostsdir. This allows addition of new host | |
68 | configurations to a running dnsmasq instance much more | |
69 | cheaply than having dnsmasq re-read all its existing | |
70 | configuration each time. | |
28de3876 | 71 | |
61b838dd WKW |
72 | Don't reply to DHCPv6 SOLICIT messages if we're not |
73 | configured to do stateful DHCPv6. Thanks to Win King Wan | |
74 | for the patch. | |
75 | ||
6ef15b34 | 76 | Fix broken DNSSEC validation of ECDSA signatures. |
f6e62e2a SK |
77 | |
78 | Add --dnssec-timestamp option, which provides an automatic | |
38440b20 SK |
79 | way to detect when the system time becomes valid after |
80 | boot on systems without an RTC, whilst allowing DNS | |
81 | queries before the clock is valid so that NTP can run. | |
82 | Thanks to Kevin Darbyshire-Bryant for developing this idea. | |
30d0879e ST |
83 | |
84 | Add --tftp-no-fail option. Thanks to Stefan Tomanek for | |
85 | the patch. | |
04b0ac05 | 86 | |
38440b20 SK |
87 | Fix crash caused by looking up servers.bind, CHAOS text |
88 | record, when more than about five --servers= lines are | |
89 | in the dnsmasq config. This causes memory corruption | |
90 | which causes a crash later. Thanks to Matt Coddington for | |
91 | sterling work chasing this down. | |
92 | ||
93 | Fix crash on receipt of certain malformed DNS requests. | |
94 | Thanks to Nick Sampanis for spotting the problem. | |
0df29f5e SK |
95 | Note that this is could allow the dnsmasq process's |
96 | memory to be read by an attacker under certain | |
97 | circumstances, so it has a CVE, CVE-2015-3294 | |
38440b20 SK |
98 | |
99 | Fix crash in authoritative DNS code, if a .arpa zone | |
100 | is declared as authoritative, and then a PTR query which | |
101 | is not to be treated as authoritative arrived. Normally, | |
102 | directly declaring .arpa zone as authoritative is not | |
103 | done, so this crash wouldn't be seen. Instead the | |
104 | relevant .arpa zone should be specified as a subnet | |
105 | in the auth-zone declaration. Thanks to Johnny S. Lee | |
106 | for the bugreport and initial patch. | |
04b0ac05 | 107 | |
78c61847 SK |
108 | Fix authoritative DNS code to correctly reply to NS |
109 | and SOA queries for .arpa zones for which we are | |
110 | declared authoritative by means of a subnet in auth-zone. | |
111 | Previously we provided correct answers to PTR queries | |
112 | in such zones (including NS and SOA) but not direct | |
113 | NS and SOA queries. Thanks to Johnny S. Lee for | |
a5ae1f85 SK |
114 | pointing out the problem. |
115 | ||
116 | Fix logging of DHCPREPLY which should be suppressed | |
117 | by quiet-dhcp6. Thanks to J. Pablo Abonia for | |
118 | spotting the problem. | |
78c61847 | 119 | |
a77cec8d SK |
120 | Try and handle net connections with broken fragmentation |
121 | that lose large UDP packets. If a server times out, | |
122 | reduce the maximum UDP packet size field in the EDNS0 | |
123 | header to 1280 bytes. If it then answers, make that | |
124 | change permanent. | |
125 | ||
b059c96d SK |
126 | Check IPv4-mapped IPv6 addresses when --stop-rebind |
127 | is active. Thanks to Jordan Milne for spotting this. | |
128 | ||
ca85a282 SK |
129 | Allow DHCPv4 options T1 and T2 to be set using --dhcp-option. |
130 | Thanks to Kevin Benton for patches and work on this. | |
131 | ||
89130d91 SK |
132 | Fix code for DHCPCONFIRM DHCPv6 messages to confirm addresses |
133 | in the correct subnet, even of not in dynamic address | |
134 | allocation range. Thanks to Steve Hirsch for spotting | |
135 | the problem. | |
c6d82c9b NC |
136 | |
137 | Add AddDhcpLease and DeleteDhcpLease DBus methods. Thanks | |
138 | to Nicolas Cavallari for the patch. | |
4918bd55 NJ |
139 | |
140 | Allow configuration of router advertisements without the | |
141 | "on-link" bit set. Thanks to Neil Jerram for the patch. | |
142 | ||
143 | Extend --bridge-interface to DHCPv6 and router | |
144 | advertisements. Thanks to Neil Jerram for the patch. | |
89130d91 | 145 | |
97e618a0 | 146 | |
8e9ffba6 | 147 | version 2.72 |
c4a09376 SK |
148 | Add ra-advrouter mode, for RFC-3775 mobile IPv6 support. |
149 | ||
150 | Add support for "ipsets" in *BSD, using pf. Thanks to | |
151 | Sven Falempim for the patch. | |
8e9ffba6 | 152 | |
a0358e5d SK |
153 | Fix race condition which could lock up dnsmasq when an |
154 | interface goes down and up rapidly. Thanks to Conrad | |
155 | Kostecki for helping to chase this down. | |
c4638f9e DC |
156 | |
157 | Add DBus methods SetFilterWin2KOption and SetBogusPrivOption | |
158 | Thanks to the Smoothwall project for the patch. | |
cdb755c5 SK |
159 | |
160 | Fix failure to build against Nettle-3.0. Thanks to Steven | |
161 | Barth for spotting this and finding the fix. | |
a0358e5d | 162 | |
6d8e8ac0 SK |
163 | When assigning existing DHCP leases to intefaces by comparing |
164 | networks, handle the case that two or more interfaces have the | |
165 | same network part, but different prefix lengths (favour the | |
166 | longer prefix length.) Thanks to Lung-Pin Chang for the | |
167 | patch. | |
168 | ||
b5ea1cc2 SK |
169 | Add a mode which detects and removes DNS forwarding loops, ie |
170 | a query sent to an upstream server returns as a new query to | |
171 | dnsmasq, and would therefore be forwarded again, resulting in | |
172 | a query which loops many times before being dropped. Upstream | |
173 | servers which loop back are disabled and this event is logged. | |
174 | Thanks to Smoothwall for their sponsorship of this feature. | |
175 | ||
3e1551a1 SK |
176 | Extend --conf-dir to allow filtering of files. So |
177 | --conf-dir=/etc/dnsmasq.d,\*.conf | |
178 | will load all the files in /etc/dnsmasq.d which end in .conf | |
5bf50af2 | 179 | |
288df49c SK |
180 | Fix bug when resulted in NXDOMAIN answers instead of NODATA in |
181 | some circumstances. | |
5782649a SK |
182 | |
183 | Fix bug which caused dnsmasq to become unresponsive if it | |
184 | failed to send packets due to a network interface disappearing. | |
185 | Thanks to Niels Peen for spotting this. | |
bf2db4b0 SK |
186 | |
187 | Fix problem with --local-service option on big-endian platforms | |
188 | Thanks to Richard Genoud for the patch. | |
189 | ||
ad4a8ff7 | 190 | |
9d1b22aa SK |
191 | version 2.71 |
192 | Subtle change to error handling to help DNSSEC validation | |
193 | when servers fail to provide NODATA answers for | |
194 | non-existent DS records. | |
195 | ||
196 | Tweak code which removes DNSSEC records from answers when | |
197 | not required. Fixes broken answers when additional section | |
198 | has real records in it. Thanks to Marco Davids for the bug | |
199 | report. | |
200 | ||
201 | Fix DNSSEC validation of ANY queries. Thanks to Marco Davids | |
202 | for spotting that too. | |
203 | ||
b692f234 SK |
204 | Fix total DNS failure and 100% CPU use if cachesize set to zero, |
205 | regression introduced in 2.69. Thanks to James Hunt and | |
206 | the Ubuntu crowd for assistance in fixing this. | |
207 | ||
9d1b22aa | 208 | |
63758384 SK |
209 | version 2.70 |
210 | Fix crash, introduced in 2.69, on TCP request when dnsmasq | |
211 | compiled with DNSSEC support, but running without DNSSEC | |
212 | enabled. Thanks to Manish Sing for spotting that one. | |
213 | ||
3b1b3e9d SK |
214 | Fix regression which broke ipset functionality. Thanks to |
215 | Wang Jian for the bug report. | |
216 | ||
63758384 | 217 | |
1ee9be4c SK |
218 | version 2.69 |
219 | Implement dynamic interface discovery on *BSD. This allows | |
220 | the contructor: syntax to be used in dhcp-range for DHCPv6 | |
221 | on the BSD platform. Thanks to Matthias Andree for | |
222 | valuable research on how to implement this. | |
223 | ||
8db957df | 224 | Fix infinite loop associated with some --bogus-nxdomain |
74e6b520 | 225 | configs. Thanks fogobogo for the bug report. |
8db957df | 226 | |
ae76242f SK |
227 | Fix missing RA RDNS option with configuration like |
228 | --dhcp-option=option6:23,[::] Thanks to Tsachi Kimeldorfer | |
229 | for spotting the problem. | |
230 | ||
c3a04081 SK |
231 | Add [fd00::] and [fe80::] as special addresses in DHCPv6 |
232 | options, analogous to [::]. [fd00::] is replaced with the | |
233 | actual ULA of the interface on the machine running | |
234 | dnsmasq, [fe80::] with the link-local address. | |
235 | Thanks to Tsachi Kimeldorfer for championing this. | |
236 | ||
613d6c52 SK |
237 | DNSSEC validation and caching. Dnsmasq needs to be |
238 | compiled with this enabled, with | |
239 | ||
240 | make dnsmasq COPTS=-DHAVE_DNSSEC | |
241 | ||
242 | this add dependencies on the nettle crypto library and the | |
243 | gmp maths library. It's possible to have these linked | |
244 | statically with | |
245 | ||
246 | make dnsmasq COPTS='-DHAVE_DNSSEC -DHAVE_DNSSEC_STATIC' | |
247 | ||
198d940a SK |
248 | which bloats the dnsmasq binary, but saves the size of |
249 | the shared libraries which are much bigger. | |
250 | ||
613d6c52 SK |
251 | To enable, DNSSEC, you will need a set of |
252 | trust-anchors. Now that the TLDs are signed, this can be | |
253 | the keys for the root zone, and for convenience they are | |
254 | included in trust-anchors.conf in the dnsmasq | |
255 | distribution. You should of course check that these are | |
256 | legitimate and up-to-date. So, adding | |
257 | ||
258 | conf-file=/path/to/trust-anchors.conf | |
259 | dnssec | |
1ee9be4c | 260 | |
613d6c52 SK |
261 | to your config is all thats needed to get things |
262 | working. The upstream nameservers have to be DNSSEC-capable | |
263 | too, of course. Many ISP nameservers aren't, but the | |
264 | Google public nameservers (8.8.8.8 and 8.8.4.4) are. | |
265 | When DNSSEC is configured, dnsmasq validates any queries | |
266 | for domains which are signed. Query results which are | |
267 | bogus are replaced with SERVFAIL replies, and results | |
268 | which are correctly signed have the AD bit set. In | |
269 | addition, and just as importantly, dnsmasq supplies | |
270 | correct DNSSEC information to clients which are doing | |
271 | their own validation, and caches DNSKEY, DS and RRSIG | |
272 | records, which significantly improve the performance of | |
273 | downstream validators. Setting --log-queries will show | |
274 | DNSSEC in action. | |
275 | ||
198d940a SK |
276 | If a domain is returned from an upstream nameserver without |
277 | DNSSEC signature, dnsmasq by default trusts this. This | |
278 | means that for unsigned zone (still the majority) there | |
279 | is effectively no cost for having DNSSEC enabled. Of course | |
280 | this allows an attacker to replace a signed record with a | |
281 | false unsigned record. This is addressed by the | |
282 | --dnssec-check-unsigned flag, which instructs dnsmasq | |
283 | to prove that an unsigned record is legitimate, by finding | |
284 | a secure proof that the zone containing the record is not | |
285 | signed. Doing this has costs (typically one or two extra | |
286 | upstream queries). It also has a nasty failure mode if | |
287 | dnsmasq's upstream nameservers are not DNSSEC capable. | |
288 | Without --dnssec-check-unsigned using such an upstream | |
289 | server will simply result in not queries being validated; | |
290 | with --dnssec-check-unsigned enabled and a | |
291 | DNSSEC-ignorant upstream server, _all_ queries will fail. | |
292 | ||
293 | Note that DNSSEC requires that the local time is valid and | |
294 | accurate, if not then DNSSEC validation will fail. NTP | |
295 | should be running. This presents a problem for routers | |
296 | without a battery-backed clock. To set the time needs NTP | |
297 | to do DNS lookups, but lookups will fail until NTP has run. | |
298 | To address this, there's a flag, --dnssec-no-timecheck | |
299 | which disables the time checks (only) in DNSSEC. When dnsmasq | |
300 | is started and the clock is not synced, this flag should | |
301 | be used. As soon as the clock is synced, SIGHUP dnsmasq. | |
302 | The SIGHUP clears the cache of partially-validated data and | |
303 | resets the no-timecheck flag, so that all DNSSEC checks | |
304 | henceforward will be complete. | |
305 | ||
613d6c52 SK |
306 | The development of DNSSEC in dnsmasq was started by |
307 | Giovanni Bajo, to whom huge thanks are owed. It has been | |
308 | supported by Comcast, whose techfund grant has allowed for | |
309 | an invaluable period of full-time work to get it to | |
310 | a workable state. | |
311 | ||
de73a497 | 312 | Add --rev-server. Thanks to Dave Taht for suggesting this. |
7b1eae4f SK |
313 | |
314 | Add --servers-file. Allows dynamic update of upstream servers | |
315 | full access to configuration. | |
de73a497 | 316 | |
c8a80487 SK |
317 | Add --local-service. Accept DNS queries only from hosts |
318 | whose address is on a local subnet, ie a subnet for which | |
319 | an interface exists on the server. This option | |
f00690f9 | 320 | only has effect if there are no --interface --except-interface, |
c8a80487 SK |
321 | --listen-address or --auth-server options. It is intended |
322 | to be set as a default on installation, to allow | |
323 | unconfigured installations to be useful but also safe from | |
324 | being used for DNS amplification attacks. | |
325 | ||
604f7598 SK |
326 | Fix crashes in cache_get_cname_target() when dangling CNAMEs |
327 | encountered. Thanks to Andy and the rt-n56u project for | |
328 | find this and helping to chase it down. | |
329 | ||
10068600 SK |
330 | Fix wrong RCODE in authoritative DNS replies to PTR queries. The |
331 | correct answer was included, but the RCODE was set to NXDOMAIN. | |
332 | Thanks to Craig McQueen for spotting this. | |
333 | ||
198d940a SK |
334 | Make statistics available as DNS queries in the .bind TLD as |
335 | well as logging them. | |
336 | ||
c8a80487 | 337 | |
376d48c7 SK |
338 | version 2.68 |
339 | Use random addresses for DHCPv6 temporary address | |
340 | allocations, instead of algorithmically determined stable | |
341 | addresses. | |
342 | ||
343 | Fix bug which meant that the DHCPv6 DUID was not available | |
344 | in DHCP script runs during the lifetime of the dnsmasq | |
345 | process which created the DUID de-novo. Once the DUID was | |
346 | created and stored in the lease file and dnsmasq | |
347 | restarted, this bug disappeared. | |
348 | ||
349 | Fix bug introduced in 2.67 which could result in erroneous | |
350 | NXDOMAIN returns to CNAME queries. | |
351 | ||
352 | Fix build failures on MacOS X and openBSD. | |
353 | ||
354 | Allow subnet specifications in --auth-zone to be interface | |
355 | names as well as address literals. This makes it possible | |
356 | to configure authoritative DNS when local address ranges | |
357 | are dynamic and works much better than the previous | |
358 | work-around which exempted contructed DHCP ranges from the | |
359 | IP address filtering. As a consequence, that work-around | |
360 | is removed. Under certain circumstances, this change wil | |
361 | break existing configuration: if you're relying on the | |
362 | contructed-range exception, you need to change --auth-zone | |
363 | to specify the same interface as is used to construct your | |
364 | DHCP ranges, probably with a trailing "/6" like this: | |
365 | --auth-zone=example.com,eth0/6 to limit the addresses to | |
366 | IPv6 addresses of eth0. | |
dd9d9ce5 SK |
367 | |
368 | Fix problems when advertising deleted IPv6 prefixes. If | |
369 | the prefix is deleted (rather than replaced), it doesn't | |
370 | get advertised with zero preferred time. Thanks to Tsachi | |
371 | for the bug report. | |
25439064 SK |
372 | |
373 | Fix segfault with some locally configured CNAMEs. Thanks | |
374 | to Andrew Childs for spotting the problem. | |
375 | ||
376 | Fix memory leak on re-reading /etc/hosts and friends, | |
377 | introduced in 2.67. | |
2329bef5 SK |
378 | |
379 | Check the arrival interface of incoming DNS and TFTP | |
380 | requests via IPv6, even in --bind-interfaces mode. This | |
381 | isn't possible for IPv4 and can generate scary warnings, | |
382 | but as it's always possible for IPv6 (the API always | |
383 | exists) then we should do it always. | |
4c82efc5 VG |
384 | |
385 | Tweak the rules on prefix-lengths in --dhcp-range for | |
386 | IPv6. The new rule is that the specified prefix length | |
387 | must be larger than or equal to the prefix length of the | |
388 | corresponding address on the local interface. | |
389 | ||
376d48c7 | 390 | |
797a7afb GT |
391 | version 2.67 |
392 | Fix crash if upstream server returns SERVFAIL when | |
393 | --conntrack in use. Thanks to Giacomo Tazzari for finding | |
394 | this and supplying the patch. | |
aa63a21c SK |
395 | |
396 | Repair regression in 2.64. That release stopped sending | |
397 | lease-time information in the reply to DHCPINFORM | |
398 | requests, on the correct grounds that it was a standards | |
399 | violation. However, this broke the dnsmasq-specific | |
400 | dhcp_lease_time utility. Now, DHCPINFORM returns | |
401 | lease-time only if it's specifically requested | |
402 | (maintaining standards) and the dhcp_lease_time utility | |
403 | has been taught to ask for it (restoring functionality). | |
86e92f99 SK |
404 | |
405 | Fix --dhcp-match, --dhcp-vendorclass and --dhcp-userclass | |
406 | to work with BOOTP and well as DHCP. Thanks to Peter | |
407 | Korsgaard for spotting the problem. | |
2bb73af7 SK |
408 | |
409 | Add --synth-domain. Thanks to Vishvananda Ishaya for | |
410 | suggesting this. | |
d5052fb2 SK |
411 | |
412 | Fix failure to compile ipset.c if old kernel headers are | |
413 | in use. Thanks to Eugene Rudoy for pointing this out. | |
3f2873d4 SK |
414 | |
415 | Handle IPv4 interface-address labels in Linux. These are | |
416 | often used to emulate the old IP-alias addresses. Before, | |
417 | using --interface=eth0 would service all the addresses of | |
418 | eth0, including ones configured as aliases, which appear | |
419 | in ifconfig as eth0:0. Now, only addresses with the label | |
420 | eth0 are active. This is not backwards compatible: if you | |
421 | want to continue to bind the aliases too, you need to add | |
422 | eg. --interface=eth0:0 to the config. | |
797a7afb | 423 | |
cfcad42f SK |
424 | Fix "failed to set SO_BINDTODEVICE on DHCP socket: Socket |
425 | operation on non-socket" error on startup with | |
426 | configurations which have exactly one --interface option | |
427 | and do RA but _not_ DHCPv6. Thanks to Trever Adams for the | |
428 | bug report. | |
797a7afb | 429 | |
115ac3e4 SK |
430 | Generalise --interface-name to cope with IPv6 addresses |
431 | and multiple addresses per interface per address family. | |
432 | ||
3e8ed78b SK |
433 | Fix option parsing for --dhcp-host, which was generating a |
434 | spurious error when all seven possible items were | |
435 | included. Thanks to Zhiqiang Wang for the bug report. | |
baa80ae5 SK |
436 | |
437 | Remove restriction on prefix-length in --auth-zone. Thanks | |
438 | to Toke Hoiland-Jorgensen for suggesting this. | |
439 | ||
0da5e897 MSB |
440 | Log when the maximum number of concurrent DNS queries is |
441 | reached. Thanks to Marcelo Salhab Brogliato for the patch. | |
442 | ||
e2ba0df2 SK |
443 | If wildcards are used in --interface, don't assume that |
444 | there will only ever be one available interface for DHCP | |
445 | just because there is one at start-up. More may appear, so | |
446 | we can't use SO_BINDTODEVICE. Thanks to Natrio for the bug | |
447 | report. | |
448 | ||
b4b93080 SK |
449 | Increase timeout/number of retries in TFTP to accomodate |
450 | AudioCodes Voice Gateways doing streaming writes to flash. | |
451 | Thanks to Damian Kaczkowski for spotting the problem. | |
452 | ||
625ac28c | 453 | Fix crash with empty DHCP string options when adding zero |
3953dcc7 | 454 | terminator. Thanks to Patrick McLean for the bug report. |
625ac28c | 455 | |
d859ca2f KM |
456 | Allow hostnames to start with a number, as allowed in |
457 | RFC-1123. Thanks to Kyle Mestery for the patch. | |
458 | ||
3f3adae6 RM |
459 | Fixes to DHCP FQDN option handling: don't terminate FQDN |
460 | if domain not known and allow a FQDN option with blank | |
461 | name to request that a FQDN option is returned in the | |
462 | reply. Thanks to Roy Marples for the patch. | |
463 | ||
d9fb0be8 SK |
464 | Make --clear-on-reload apply to setting upstream servers |
465 | via DBus too. | |
466 | ||
ef1a94ab SK |
467 | When the address which triggered the construction of an |
468 | advertised IPv6 prefix disappears, continue to advertise | |
469 | the prefix for up to 2 hours, with the preferred lifetime | |
470 | set to zero. This satisfies RFC 6204 4.3 L-13 and makes | |
471 | things work better if a prefix disappears without being | |
472 | deprecated first. Thanks to Uwe Schindler for persuasively | |
473 | arguing for this. | |
474 | ||
fc4c4fda SK |
475 | Fix MAC address enumeration on *BSD. Thanks to Brad Smith |
476 | for the bug report. | |
b4b93080 | 477 | |
871d4562 SK |
478 | Support RFC-4242 information-refresh-time options in the |
479 | reply to DHCPv6 information-request. The lease time of the | |
480 | smallest valid dhcp-range is sent. Thanks to Uwe Schindler | |
481 | for suggesting this. | |
482 | ||
edf0bde0 SK |
483 | Make --listen-address higher priority than --except-interface |
484 | in all circumstances. Thanks to Thomas Hood for the bugreport. | |
485 | ||
2937f8a0 SK |
486 | Provide independent control over which interfaces get TFTP |
487 | service. If enable-tftp is given a list of interfaces, then TFTP | |
488 | is provided on those. Without the list, the previous behaviour | |
489 | (provide TFTP to the same interfaces we provide DHCP to) | |
490 | is retained. Thanks to Lonnie Abelbeck for the suggestion. | |
491 | ||
6acef730 SK |
492 | Add --dhcp-relay config option. Many thanks to vtsl.net |
493 | for sponsoring this development. | |
ff7eea27 | 494 | |
0932f9c0 SK |
495 | Fix crash with empty tag: in --dhcp-range. Thanks to |
496 | Kaspar Schleiser for the bug report. | |
497 | ||
ceae52df SK |
498 | Add "baseline" and "bloatcheck" makefile targets, for |
499 | revealing size changes during development. Thanks to | |
500 | Vladislav Grishenko for the patch. | |
501 | ||
c8f2dd8b SK |
502 | Cope with DHCPv6 clients which send REQUESTs without |
503 | address options - treat them as SOLICIT with rapid commit. | |
504 | ||
89500e31 SK |
505 | Support identification of clients by MAC address in |
506 | DHCPv6. When using a relay, the relay must support RFC | |
507 | 6939 for this to work. It always works for directly | |
508 | connected clients. Thanks to Vladislav Grishenko | |
509 | for prompting this feature. | |
861c8914 SK |
510 | |
511 | Remove the rule for constructed DHCP ranges that the local | |
512 | address must be either the first or last address in the | |
513 | range. This was originally to avoid SLAAC addresses, but | |
514 | we now explicitly autoconfig and privacy addresses instead. | |
89500e31 | 515 | |
889d8a15 SK |
516 | Update Polish translation. Thanks to Jan Psota. |
517 | ||
ef1d7425 TB |
518 | Fix problem in DHCPv6 vendorclass/userclass matching |
519 | code. Thanks to Tanguy Bouzeloc for the patch. | |
520 | ||
043c271f | 521 | Update Spanish transalation. Thanks to Vicente Soriano. |
871d4562 | 522 | |
c4cd95df SK |
523 | Add --ra-param option. Thanks to Vladislav Grishenko for |
524 | inspiration on this. | |
525 | ||
ed4c0767 | 526 | Add --add-subnet configuration, to tell upstream DNS |
f65b0e54 SK |
527 | servers where the original client is. Thanks to DNSthingy |
528 | for sponsoring this feature. | |
ed4c0767 | 529 | |
8c0b73d3 KDB |
530 | Add --quiet-dhcp, --quiet-dhcp6 and --quiet-ra. Thanks to |
531 | Kevin Darbyshire-Bryant for the initial patch. | |
532 | ||
d56a604a SK |
533 | Allow A/AAAA records created by --interface-name to be the |
534 | target of --cname. Thanks to Hadmut Danisch for the | |
535 | suggestion. | |
536 | ||
24b5a5d5 SK |
537 | Avoid treating a --dhcp-host which has an IPv6 address |
538 | as eligable for use with DHCPv4 on the grounds that it has | |
539 | no address, and vice-versa. Thanks to Yury Konovalov for | |
540 | spotting the problem. | |
541 | ||
45cca585 SK |
542 | Do a better job caching dangling CNAMEs. Thanks to Yves |
543 | Dorfsman for spotting the problem. | |
544 | ||
043c271f | 545 | |
333b2ceb SK |
546 | version 2.66 |
547 | Add the ability to act as an authoritative DNS | |
548 | server. Dnsmasq can now answer queries from the wider 'net | |
549 | with local data, as long as the correct NS records are set | |
550 | up. Only local data is provided, to avoid creating an open | |
551 | DNS relay. Zone transfer is supported, to allow secondary | |
552 | servers to be configured. | |
553 | ||
554 | Add "constructed DHCP ranges" for DHCPv6. This is intended | |
555 | for IPv6 routers which get prefixes dynamically via prefix | |
556 | delegation. With suitable configuration, stateful DHCPv6 | |
557 | and RA can happen automatically as prefixes are delegated | |
558 | and then deprecated, without having to re-write the | |
559 | dnsmasq configuration file or restart the daemon. Thanks to | |
560 | Steven Barth for extensive testing and development work on | |
561 | this idea. | |
71c73ac1 SK |
562 | |
563 | Fix crash on startup on Solaris 11. Regression probably | |
22ce550e SK |
564 | introduced in 2.61. Thanks to Geoff Johnstone for the |
565 | patch. | |
566 | ||
567 | Add code to make behaviour for TCP DNS requests that same | |
568 | as for UDP requests, when a request arrives for an allowed | |
569 | address, but via a banned interface. This change is only | |
570 | active on Linux, since the relevant API is missing (AFAIK) | |
571 | on other platforms. Many thanks to Tomas Hozza for | |
572 | spotting the problem, and doing invaluable discovery of | |
573 | the obscure and undocumented API required for the solution. | |
a21e27bc SK |
574 | |
575 | Don't send the default DHCP option advertising dnsmasq as | |
576 | the local DNS server if dnsmasq is configured to not act | |
577 | as DNS server, or it's configured to a non-standard port. | |
dd1721c7 SK |
578 | |
579 | Add DNSMASQ_CIRCUIT_ID, DNSMASQ_SUBCRIBER_ID, | |
580 | DNSMASQ_REMOTE_ID variables to the environment of the | |
3d77c046 | 581 | lease-change script (and the corresponding Lua). These hold |
dd1721c7 SK |
582 | information inserted into the DHCP request by a DHCP relay |
583 | agent. Thanks to Lakefield Communications for providing a | |
584 | bounty for this addition. | |
585 | ||
4038ae20 SK |
586 | Fixed crash, introduced in 2.64, whilst handling DHCPv6 |
587 | information-requests with some common configurations. | |
588 | Thanks to Robert M. Albrecht for the bug report and | |
589 | chasing the problem. | |
590 | ||
13d86c73 JD |
591 | Add --ipset option. Thanks to Jason A. Donenfeld for the |
592 | patch. | |
593 | ||
c7961075 | 594 | Don't erroneously reject some option names in --dhcp-match |
3d77c046 | 595 | options. Thanks to Benedikt Hochstrasser for the bug report. |
49333cbd SK |
596 | |
597 | Allow a trailing '*' wildcard in all interface-name | |
598 | configurations. Thanks to Christian Parpart for the patch. | |
c7961075 | 599 | |
56a1142f SK |
600 | Handle the situation where libc headers define |
601 | SO_REUSEPORT, but the kernel in use doesn't, to cope with | |
602 | the introduction of this option to Linux. Thanks to Rich | |
603 | Felker for the bug report. | |
604 | ||
cd1e04a2 | 605 | Update Polish translation. Thanks to Jan Psota. |
0b0a73c1 SK |
606 | |
607 | Fix crash if the configured DHCP lease limit is | |
608 | reached. Regression occurred in 2.61. Thanks to Tsachi for | |
609 | the bug report. | |
cd1e04a2 | 610 | |
834f36fe SK |
611 | Update the French translation. Thanks to Gildas le Nadan. |
612 | ||
49333cbd | 613 | |
ee86ce68 SK |
614 | version 2.65 |
615 | Fix regression which broke forwarding of queries sent via | |
616 | TCP which are not for A and AAAA and which were directed to | |
617 | non-default servers. Thanks to Niax for the bug report. | |
618 | ||
b5a8dd1d SK |
619 | Fix failure to build with DHCP support excluded. Thanks to |
620 | Gustavo Zacarias for the patch. | |
1d6c6393 SK |
621 | |
622 | Fix nasty regression in 2.64 which completely broke cacheing. | |
b5a8dd1d SK |
623 | |
624 | ||
2e34ac14 SK |
625 | version 2.64 |
626 | Handle DHCP FQDN options with all flag bits zero and | |
627 | --dhcp-client-update set. Thanks to Bernd Krumbroeck for | |
628 | spotting the problem. | |
629 | ||
12d71ed2 SK |
630 | Finesse the check for /etc/hosts names which conflict with |
631 | DHCP names. Previously a name/address pair in /etc/hosts | |
632 | which didn't match the name/address of a DHCP lease would | |
633 | generate a warning. Now that only happesn if there is not | |
634 | also a match. This allows multiple addresses for a name in | |
635 | /etc/hosts with one of them assigned via DHCP. | |
636 | ||
4d0f5b4c SK |
637 | Fix broken vendor-option processing for BOOTP. Thanks to |
638 | Hans-Joachim Baader for the bug report. | |
639 | ||
dfb23b3f SK |
640 | Don't report spurious netlink errors, regression in |
641 | 2.63. Thanks to Vladislav Grishenko for the patch. | |
642 | ||
2b127a1e SK |
643 | Flag DHCP or DHCPv6 in starup logging. Thanks to |
644 | Vladislav Grishenko for the patch. | |
645 | ||
295a54ee | 646 | Add SetServersEx method in DBus interface. Thanks to Dan |
faafb3f7 SK |
647 | Williams for the patch. |
648 | ||
295a54ee SK |
649 | Add SetDomainServers method in DBus interface. Thanks to |
650 | Roy Marples for the patch. | |
651 | ||
289a2535 SK |
652 | Fix build with later Lua libraries. Thansk to Cristian |
653 | Rodriguez for the patch. | |
2e34ac14 | 654 | |
1d860415 SK |
655 | Add --max-cache-ttl option. Thanks to Dennis Kaarsemaker |
656 | for the patch. | |
657 | ||
e4807d8b SK |
658 | Fix breakage of --host-record parsing, resulting in |
659 | infinte loop at startup. Regression in 2.63. Thanks to | |
660 | Haim Gelfenbeyn for spotting this. | |
661 | ||
2022310f SK |
662 | Set SO_REUSEADDRESS and SO_V6ONLY options on the DHCPv6 |
663 | socket, this allows multiple instances of dnsmasq on a | |
664 | single machine, in the same way as for DHCPv4. Thanks to | |
665 | Gene Czarcinski and Vladislav Grishenko for work on this. | |
666 | ||
be6cfb42 SK |
667 | Fix DHCPv6 to do access control correctly when it's |
668 | configured with --listen-address. Thanks to | |
669 | Gene Czarcinski for sorting this out. | |
670 | ||
819ff4dd SK |
671 | Add a "wildcard" dhcp-range which works for any IPv6 |
672 | subnet, --dhcp-range=::,static Useful for Stateless | |
673 | DHCPv6. Thanks to Vladislav Grishenko for the patch. | |
674 | ||
d1a5975f SK |
675 | Don't include lease-time in DHCPACK replies to DHCPINFORM |
676 | queries, since RFC-2131 says we shouldn't. Thanks to | |
677 | Wouter Ibens for pointing this out. | |
8e4b8791 SK |
678 | |
679 | Makefile tweak to do dependency checking on header files. | |
680 | Thanks to Johan Peeters for the patch. | |
d89fb4ed SK |
681 | |
682 | Check interface for outgoing unsolicited router | |
683 | advertisements, rather than relying on interface address | |
684 | configuration. Thanks to Gene Czarinski for the patch. | |
29d28dda SK |
685 | |
686 | Handle better attempts to transmit on interfaces which are | |
687 | still doing DAD, and specifically do not just transmit | |
688 | without setting source address and interface, since this | |
689 | can cause very puzzling effects when a router | |
690 | advertisement goes astray. Thanks again to Gene Czarinski. | |
691 | ||
692 | Get RA timers right when there is more than one | |
693 | dhcp-range on a subnet. | |
289a2535 | 694 | |
d1a5975f | 695 | |
078a630b SK |
696 | version 2.63 |
697 | Do duplicate dhcp-host address check in --test mode. | |
698 | ||
8b3ae2fd SK |
699 | Check that tftp-root directories are accessible before |
700 | start-up. Thanks to Daniel Veillard for the initial patch. | |
701 | ||
702 | Allow more than one --tfp-root flag. The per-interface | |
703 | stuff is pointless without that. | |
704 | ||
54dd393f SK |
705 | Add --bind-dynamic. A hybrid mode between the default and |
706 | --bind-interfaces which copes with dynamically created | |
707 | interfaces. | |
6b617c0d SK |
708 | |
709 | A couple of fixes to the build system for Android. Thanks | |
710 | to Metin Kaya for the patches. | |
54dd393f | 711 | |
8bc4cece SK |
712 | Remove the interface:<interface> argument in --dhcp-range, and |
713 | the interface argument to --enable-tftp. These were a | |
714 | still-born attempt to allow automatic isolated | |
715 | configuration by libvirt, but have never (to my knowledge) | |
716 | been used, had very strange semantics, and have been | |
717 | superceded by other mechanisms. | |
718 | ||
c4a7f90e SK |
719 | Fixed bug logging filenames when duplicate dhcp-host |
720 | addresses are found. Thanks to John Hanks for the patch. | |
721 | ||
611ebc5f SK |
722 | Fix regression in 2.61 which broke caching of CNAME |
723 | chains. Thanks to Atul Gupta for the bug report. | |
724 | ||
b271446f | 725 | Allow the target of a --cname flag to be another --cname. |
611ebc5f | 726 | |
42243214 SK |
727 | Teach DHCPv6 about the RFC 4242 information-refresh-time |
728 | option, and add parsing if the minutes, hours and days | |
729 | format for options. Thanks to Francois-Xavier Le Bail for | |
730 | the suggestion. | |
731 | ||
732 | Allow "w" (for week) as multiplier in lease times, as well | |
733 | as seconds, minutes, hours and days. Álvaro Gámez Machado | |
734 | spotted the ommission. | |
c4c0488a SK |
735 | |
736 | Update French translation. Thanks to Gildas Le Nadan. | |
42243214 | 737 | |
ad094275 SK |
738 | Allow a DBus service name to be given with --enable-dbus |
739 | which overrides the default, | |
740 | uk.org.thekelleys.dnsmasq. Thanks to Mathieu | |
741 | Trudel-Lapierre for the patch. | |
742 | ||
fd05f127 SK |
743 | Set the "prefix on-link" bit in Router |
744 | Advertisements. Thanks to Gui Iribarren for the patch. | |
745 | ||
078a630b | 746 | |
8358e0f4 SK |
747 | version 2.62 |
748 | Update German translation. Thanks to Conrad Kostecki. | |
749 | ||
f632e567 SK |
750 | Cope with router-solict packets wich don't have a valid |
751 | source address. Thanks to Vladislav Grishenko for the patch. | |
752 | ||
919dd7cf SK |
753 | Fixed bug which caused missing periodic router |
754 | advertisements with some configurations. Thanks to | |
755 | Vladislav Grishenko for the patch. | |
756 | ||
c64b7f6a SK |
757 | Fixed bug which broke DHCPv6/RA with prefix lengths |
758 | which are not divisible by 8. Thanks to Andre Coetzee | |
759 | for spotting this. | |
760 | ||
18c63eff SK |
761 | Fix non-response to router-solicitations when |
762 | router-advertisement configured, but DHCPv6 not | |
763 | configured. Thanks to Marien Zwart for the patch. | |
764 | ||
9f7f3b12 SK |
765 | Add --dns-rr, to allow arbitrary DNS resource records. |
766 | ||
5ae34bf3 SK |
767 | Fixed bug which broke RA scheduling when an interface had |
768 | two addresses in the same network. Thanks to Jim Bos for | |
769 | his help nailing this. | |
770 | ||
eabc6dd7 SK |
771 | version 2.61 |
772 | Re-write interface discovery code on *BSD to use | |
773 | getifaddrs. This is more portable, more straightforward, | |
774 | and allows us to find the prefix length for IPv6 | |
775 | addresses. | |
776 | ||
01d1b8dd SK |
777 | Add ra-names, ra-stateless and slaac keywords for DHCPv6. |
778 | Dnsmasq can now synthesise AAAA records for dual-stack | |
779 | hosts which get IPv6 addresses via SLAAC. It is also now | |
780 | possible to use SLAAC and stateless DHCPv6, and to | |
781 | tell clients to use SLAAC addresses as well as DHCP ones. | |
782 | Thanks to Dave Taht for help with this. | |
7023e382 | 783 | |
8b372704 SK |
784 | Add --dhcp-duid to allow DUID-EN uids to be used. |
785 | ||
8643ec7f SK |
786 | Explicity send DHCPv6 replies to the correct port, instead |
787 | of relying on clients to send requests with the correct | |
788 | source address, since at least one client in the wild gets | |
8358e0f4 | 789 | this wrong. Thanks to Conrad Kostecki for help tracking |
8643ec7f | 790 | this down. |
eabc6dd7 | 791 | |
8643ec7f SK |
792 | Send a preference value of 255 in DHCPv6 replies when |
793 | --dhcp-authoritative is in effect. This tells clients not | |
794 | to wait around for other DHCP servers. | |
795 | ||
796 | Better logging of DHCPv6 options. | |
797 | ||
e759d426 SK |
798 | Add --host-record. Thanks to Rob Zwissler for the |
799 | suggestion. | |
800 | ||
a9530964 SK |
801 | Invoke the DHCP script with action "tftp" when a TFTP file |
802 | transfer completes. The size of the file, address to which | |
803 | it was sent and complete pathname are supplied. Note that | |
804 | version 2.60 introduced some script incompatibilties | |
805 | associated with DHCPv6, and this is a further change. To | |
806 | be safe, scripts should ignore unknown actions, and if | |
807 | not IPv6-aware, should exit if the environment | |
808 | variable DNSMASQ_IAID is set. The use-case for this is | |
809 | to track netboot/install. Suggestion from Shantanu | |
810 | Gadgil. | |
811 | ||
812 | Update contrib/port-forward/dnsmasq-portforward to reflect | |
813 | the above. | |
814 | ||
815 | Set the environment variable DNSMASQ_LOG_DHCP when running | |
816 | the script id --log-dhcp is in effect, so that script can | |
52d4abf2 SK |
817 | taylor their logging verbosity. Suggestion from Malte |
818 | Forkel. | |
819 | ||
820 | Arrange that addresses specified with --listen-address | |
821 | work even if there is no interface carrying the | |
822 | address. This is chiefly useful for IPv4 loopback | |
823 | addresses, where any address in 127.0.0.0/8 is a valid | |
824 | loopback address, but normally only 127.0.0.1 appears on | |
825 | the lo interface. Thanks to Mathieu Trudel-Lapierre for | |
826 | the idea and initial patch. | |
a9530964 | 827 | |
7d2b5c95 SK |
828 | Fix crash, introduced in 2.60, when a DHCPINFORM is |
829 | received from a network which has no valid dhcp-range. | |
830 | Thanks to Stephane Glondu for the bug report. | |
831 | ||
c8257540 SK |
832 | Add a new DHCP lease time keyword, "deprecated" for |
833 | --dhcp-range. This is only valid for IPv6, and sets the | |
834 | preffered lease time for both DHCP and RA to zero. The | |
835 | effect is that clients can continue to use the address | |
836 | for existing connections, but new connections will use | |
837 | other addresses, if they exist. This makes hitless | |
838 | renumbering at least possible. | |
839 | ||
840 | Fix bug in address6_available() which caused DHCPv6 lease | |
8358e0f4 | 841 | aquisition to fail if more than one dhcp-range in use. |
18f0fb05 SK |
842 | |
843 | Provide RDNSS and DNSSL data in router advertisements, | |
844 | using the settings provided for DHCP options | |
845 | option6:domain-search and option6:dns-server. | |
6c559c34 SK |
846 | |
847 | Tweak logo/favicon.ico to add some transparency. Thanks to | |
848 | SamLT for work on this. | |
c8257540 | 849 | |
1023dcbc SK |
850 | Don't cache data from non-recursive nameservers, since it |
851 | may erroneously look like a valid CNAME to a non-exitant | |
852 | name. Thanks to Ben Winslow for finding this. | |
9380ba70 SK |
853 | |
854 | Call SO_BINDTODEVICE on the DHCP socket(s) when doing DHCP | |
8358e0f4 | 855 | on exactly one interface and --bind-interfaces is set. This |
9380ba70 SK |
856 | makes the OpenStack use-case of one dnsmasq per virtual |
857 | interface work. This is only available on Linux; it's not | |
858 | supported on other platforms. Thanks to Vishvananda Ishaya | |
e46164e0 SK |
859 | and the OpenStack team for the suggestion. |
860 | ||
861 | Updated French translation. Thanks to Gildas Le Nadan. | |
d1c759c5 SK |
862 | |
863 | Give correct from-cache answers to explict CNAME queries. | |
864 | Thanks to Rob Zwissler for spotting this. | |
1023dcbc | 865 | |
fc92ead0 | 866 | Add --tftp-lowercase option. Thanks to Oliver Rath for the |
61ce600b | 867 | patch. |
dcffad2a SK |
868 | |
869 | Ensure that the DBus DhcpLeaseUpdated events are generated | |
870 | when a lease goes through INIT_REBOOT state, even if the | |
8358e0f4 | 871 | dhcp-script is not in use. Thanks to Antoaneta-Ecaterina |
dcffad2a | 872 | Ene for the patch. |
19d69be2 SK |
873 | |
874 | Fix failure of TFTP over IPv4 on OpenBSD platform. Thanks | |
875 | to Brad Smith for spotting this. | |
61ce600b | 876 | |
c8257540 | 877 | |
c72daea8 SK |
878 | version 2.60 |
879 | Fix compilation problem in Mac OS X Lion. Thanks to Olaf | |
880 | Flebbe for the patch. | |
881 | ||
882 | Fix DHCP when using --listen-address with an IP address | |
883 | which is not the primary address of an interface. | |
884 | ||
885 | Add --dhcp-client-update option. | |
886 | ||
887 | Add Lua integration. Dnsmasq can now execute a DHCP | |
888 | lease-change script written in Lua. This needs to be | |
889 | enabled at compile time by setting HAVE_LUASCRIPT in | |
890 | src/config.h or running "make COPTS=-DHAVE_LUASCRIPT" | |
891 | Thanks to Jan-Piet Mens for the idea and proof-of-concept | |
892 | implementation. | |
893 | ||
894 | Tidied src/config.h to distinguish between | |
895 | platform-dependent compile-time options which are selected | |
896 | automatically, and builder-selectable compile time | |
897 | options. Document the latter better, and describe how to | |
898 | set them from the make command line. | |
899 | ||
900 | Tidied up IPPROTO_IP/SOL_IP (and IPv6 equivalent) | |
901 | confusion. IPPROTO_IP works everywhere now. | |
902 | ||
903 | Set TOS on DHCP sockets, this improves things on busy | |
904 | wireless networks. Thanks to Dave Taht for the patch. | |
905 | ||
984d2fde SK |
906 | Determine VERSION automatically based on git magic: |
907 | release tags or hash values. | |
c72daea8 | 908 | |
a2761754 SK |
909 | Improve start-up speed when reading large hosts files |
910 | containing many distinct addresses. | |
911 | ||
912 | Fix problem if dnsmasq is started without the stdin, | |
913 | stdout and stderr file descriptors open. This can manifest | |
914 | itself as 100% CPU use. Thanks to Chris Moore for finding | |
915 | this. | |
916 | ||
9bbc8876 SK |
917 | Fix shell-scripting bug in bld/pkg-wrapper. Thanks to |
918 | Mark Mitchell for the patch. | |
919 | ||
751d6f4a SK |
920 | Allow the TFP server or boot server in --pxe-service, to |
921 | be a domain name instead of an IP address. This allows for | |
922 | round-robin to multiple servers, in the same way as | |
923 | --dhcp-boot. A good suggestion from Cristiano Cumer. | |
924 | ||
fdacfb01 SK |
925 | Support BUILDDIR variable in the Makefile. Allows builds |
926 | for multiple archs from the same source tree with eg. | |
927 | make BUILDDIR=linux (relative to dnsmasq tree) | |
928 | make BUILDDIR=/tmp/openbsd (absolute path) | |
e5ffdb9c | 929 | If BUILDDIR is not set, compilation happens in the src |
b36ae194 SK |
930 | directory, as before. Suggestion from Mark Mitchell. |
931 | ||
fdacfb01 SK |
932 | Support DHCPv6. Support is there for the sort of things |
933 | the existing v4 server does, including tags, options, | |
934 | static addresses and relay support. Missing is prefix | |
935 | delegation, which is probably not required in the dnsmasq | |
936 | niche, and an easy way to accept prefix delegations from | |
937 | an upstream DHCPv6 server, which is. Future plans include | |
938 | support for DHCPv6 router option and MAC address option | |
939 | (to make selecting clients by MAC address work like IPv4). | |
940 | These will be added as the standards mature. | |
941 | This code has been tested, but this is the first release, | |
942 | so don't bet the farm on it just yet. Many thanks to all | |
943 | testers who have got it this far. | |
1adadf58 | 944 | |
ac8540c3 SK |
945 | Support IPv6 router advertisements. This is a |
946 | simple-minded implementation, aimed at providing the | |
947 | vestigial RA needed to go alongside IPv6. Is picks up | |
948 | configuration from the DHCPv6 conf, and should just need | |
949 | enabling with --enable-ra. | |
950 | ||
552af8b9 SK |
951 | Fix long-standing wrinkle with --localise-queries that |
952 | could result in wrong answers when DNS packets arrive | |
953 | via an interface other than the expected one. Thanks to | |
954 | Lorenzo Milesi and John Hanks for spotting this one. | |
71ee7ee2 SK |
955 | |
956 | Update French translation. Thanks to Gildas Le Nadan. | |
552af8b9 | 957 | |
df66e341 SK |
958 | Update Polish translation. Thanks to Jan Psota. |
959 | ||
960 | ||
74c95c25 | 961 | version 2.59 |
c72daea8 SK |
962 | Fix regression in 2.58 which caused failure to start up |
963 | with some combinations of dnsmasq config and IPv6 kernel | |
964 | network config. Thanks to Brielle Bruns for the bug | |
965 | report. | |
966 | ||
967 | Improve dnsmasq's behaviour when network interfaces are | |
968 | still doing duplicate address detection (DAD). Previously, | |
969 | dnsmasq would wait up to 20 seconds at start-up for the | |
970 | DAD state to terminate. This is broken for bridge | |
971 | interfaces on recent Linux kernels, which don't start DAD | |
972 | until the bridge comes up, and so can take arbitrary | |
973 | time. The new behaviour lets dnsmasq poll for an arbitrary | |
974 | time whilst providing service on other interfaces. Thanks | |
975 | to Stephen Hemminger for pointing out the problem. | |
74c95c25 SK |
976 | |
977 | ||
7de060b0 SK |
978 | version 2.58 |
979 | Provide a definition of the SA_SIZE macro where it's | |
980 | missing. Fixes build failure on openBSD. | |
981 | ||
982 | Don't include a zero terminator at the end of messages | |
983 | sent to /dev/log when /dev/log is a datagram socket. | |
984 | Thanks to Didier Rabound for spotting the problem. | |
985 | ||
986 | Add --dhcp-sequential-ip flag, to force allocation of IP | |
987 | addresses in ascending order. Note that the default | |
988 | pseudo-random mode is in general better but some | |
989 | server-deployment applications need this. | |
990 | ||
991 | Fix problem where a server-id of 0.0.0.0 is sent to a | |
992 | client when a dhcp-relay is in use if a client renews a | |
993 | lease after dnsmasq restart and before any clients on the | |
994 | subnet get a new lease. Thanks to Mike Ruiz for assistance | |
995 | in chasing this one down. | |
996 | ||
997 | Don't return NXDOMAIN to an AAAA query if we have CNAME | |
998 | which points to an A record only: NODATA is the correct | |
999 | reply in this case. Thanks to Tom Fernandes for spotting | |
1000 | the problem. | |
1001 | ||
1002 | Relax the need to supply a netmask in --dhcp-range for | |
1003 | networks which use a DHCP relay. Whilst this is still | |
1004 | desireable, in the absence of a netmask dnsmasq will use | |
1005 | a default based on the class (A, B, or C) of the address. | |
1006 | This should at least remove a cause of mysterious failure | |
1007 | for people using RFC1918 addresses and relays. | |
1008 | ||
1009 | Add support for Linux conntrack connection marking. If | |
1010 | enabled with --conntrack, the connection mark for incoming | |
1011 | DNS queries will be copied to the outgoing connections | |
1012 | used to answer those queries. This allows clever firewall | |
1013 | and accounting stuff. Only available if dnsmasq is | |
1014 | compiled with HAVE_CONNTRACK and adds a dependency on | |
1015 | libnetfilter-conntrack. Thanks to Ed Wildgoose for the | |
1016 | initial idea, testing and sponsorship of this function. | |
1017 | ||
1018 | Provide a sane error message when someone attempts to | |
1019 | match a tag in --dhcp-host. | |
1020 | ||
1021 | Tweak the behaviour of --domain-needed, to avoid problems | |
1022 | with recursive nameservers downstream of dnsmasq. The new | |
1023 | behaviour only stops A and AAAA queries, and returns | |
1024 | NODATA rather than NXDOMAIN replies. | |
1025 | ||
1026 | Efficiency fix for very large DHCP configurations, thanks | |
1027 | to James Gartrell and Mike Ruiz for help with this. | |
1028 | ||
1029 | Allow the TFTP-server address in --dhcp-boot to be a | |
1030 | domain-name which is looked up in /etc/hosts. This can | |
1031 | give multiple IP addresses which are used round-robin, | |
1032 | thus doing TFTP server load-balancing. Thanks to Sushil | |
1033 | Agrawal for the patch. | |
1034 | ||
1035 | When two tagged dhcp-options for a particular option | |
1036 | number are both valid, use the one which is valid without | |
1037 | a tag from the dhcp-range. Allows overriding of the value | |
1038 | of a DHCP option for a particular host as well as | |
1039 | per-network values. So | |
1040 | --dhcp-range=set:interface1,...... | |
1041 | --dhcp-host=set:myhost,..... | |
1042 | --dhcp-option=tag:interface1,option:nis-domain,"domain1" | |
1043 | --dhcp-option=tag:myhost,option:nis-domain,"domain2" | |
1044 | will set the NIS-domain to domain1 for hosts in the range, but | |
1045 | override that to domain2 for a particular host. | |
1046 | ||
1047 | Fix bug which resulted in truncated files and timeouts for | |
1048 | some TFTP transfers. The bug only occurs with netascii | |
1049 | transfers and needs an unfortunate relationship between | |
1050 | file size, blocksize and the number of newlines in the | |
1051 | last block before it manifests itself. Many thanks to | |
1052 | Alkis Georgopoulos for spotting the problem and providing | |
1053 | a comprehensive test-case. | |
1054 | ||
1055 | Fix regression in TFTP server on *BSD platforms introduced | |
1056 | in version 2.56, due to confusion with sockaddr | |
de604c18 | 1057 | length. Many thanks to Loic Pefferkorn for finding this. |
7de060b0 SK |
1058 | |
1059 | Support scope-ids in IPv6 addresses of nameservers from | |
1060 | /etc/resolv.conf and in --server options. Eg | |
1061 | nameserver fe80::202:a412:4512:7bbf%eth0 or | |
1062 | server=fe80::202:a412:4512:7bbf%eth0. Thanks to | |
1063 | Michael Stapelberg for the suggestion. | |
1064 | ||
1065 | Update Polish translation, thanks to Jan Psota. | |
1066 | ||
1067 | Update French translation. Thanks to Gildas Le Nadan. | |
1068 | ||
1069 | ||
572b41eb SK |
1070 | version 2.57 |
1071 | Add patches to allow build under Android. | |
1072 | ||
1073 | Provide our own header for the DNS protocol, rather than | |
1074 | relying on arpa/nameser.h. This has proved more or less | |
1075 | defective over the years and the final straw is that it's | |
1076 | effectively empty on Android. | |
1077 | ||
1078 | Fix regression in 2.56 which caused hex constants in | |
1079 | configuration to be rejected if they contain the '*' | |
1080 | wildcard. | |
1081 | ||
1082 | Correct wrong casts of arguments to ctype.h functions, | |
1083 | isdigit(), isxdigit() etc. Thanks to Matthias Andree for | |
1084 | spotting this. | |
1085 | ||
1086 | Allow build with IDN support independently from i18n. | |
1087 | IDN support continues to be included automatically | |
1088 | when i18n is included. | |
1089 | 'make COPTS=-DHAVE_IDN' is the magic incantation. | |
1090 | ||
1091 | Modify check on extraneous command line junk (added in | |
1092 | 2.56) so that it doesn't complain about extra _empty_ | |
1093 | arguments. Otherwise this breaks libvirt. | |
1094 | ||
1095 | ||
28866e95 SK |
1096 | version 2.56 |
1097 | Add a patch to allow dnsmasq to get interface names right in a | |
1098 | Solaris zone. Thanks to Dj Padzensky for this. | |
1099 | ||
1100 | Improve data-type parsing heuristics so that | |
1101 | --dhcp-option=option:domain-search,. | |
1102 | treats the value as a string and not an IP address. | |
1103 | Thanks to Clemens Fischer for spotting that. | |
1104 | ||
1105 | Add IPv6 support to the TFTP server. Many thanks to Jan | |
1106 | 'RedBully' Seiffert for the patches. | |
1107 | ||
1108 | Log DNS queries at level LOG_INFO, rather then | |
1109 | LOG_DEBUG. This makes things consistent with DHCP | |
1110 | logging. Thanks to Adam Pribyl for spotting the problem. | |
1111 | ||
1112 | Ensure that dnsmasq terminates cleanly when using | |
1113 | --syslog-async even if it cannot make a connection to the | |
1114 | syslogd. | |
1115 | ||
1116 | Add --add-mac option. This is to support currently | |
1117 | experimental DNS filtering facilities. Thanks to Benjamin | |
1118 | Petrin for the orignal patch. | |
1119 | ||
1120 | Fix bug which meant that tags were ignored in dhcp-range | |
1121 | configuration specifying PXE-proxy service. Thanks to | |
1122 | Cristiano Cumer for spotting this. | |
1123 | ||
1124 | Raise an error if there is extra junk, not part of an | |
1125 | option, on the command line. | |
1126 | ||
1127 | Flag a couple of log messages in cache.c as coming from | |
1128 | the DHCP subsystem. Thanks to Olaf Westrik for the patch. | |
1129 | ||
1130 | Omit timestamps from logs when a) logging to stderr and | |
1131 | b) --keep-in-forground is set. The logging facility on the | |
1132 | other end of stderr can be assumned to supply them. Thanks | |
1133 | to John Hallam for the patch. | |
1134 | ||
1135 | Don't complain about strings longer than 255 characters in | |
1136 | --txt-record, just split the long strings into 255 | |
1137 | character chunks instead. | |
1138 | ||
1139 | Fix crash on double-free. This bug can only happen when | |
1140 | dhcp-script is in use and then only in rare circumstances | |
1141 | triggered by high DHCP transaction rate and a slow | |
1142 | script. Thanks to Ferenc Wagner for finding the problem. | |
1143 | ||
1144 | Only log that a file has been sent by TFTP after the | |
1145 | transfer has completed succesfully. | |
1146 | ||
1147 | A good suggestion from Ferenc Wagner: extend | |
1148 | the --domain option to allow this sort of thing: | |
1149 | --domain=thekelleys.org.uk,192.168.0.0/24,local | |
1150 | which automatically creates | |
1151 | --local=/thekelleys.org.uk/ | |
1152 | --local=/0.168.192.in-addr.arpa/ | |
1153 | ||
1154 | Tighten up syntax checking of hex contants in the config | |
1155 | file. Thanks to Fred Damen for spotting this. | |
1156 | ||
1157 | Add dnsmasq logo/icon, contributed by Justin Swift. Many | |
1158 | thanks for that. | |
1159 | ||
1160 | Never cache DNS replies which have the 'cd' bit set, or | |
1161 | which result from queries forwarded with the 'cd' bit | |
1162 | set. The 'cd' bit instructs a DNSSEC validating server | |
1163 | upstream to ignore signature failures and return replies | |
1164 | anyway. Without this change it's possible to pollute the | |
1165 | dnsmasq cache with bad data by making a query with the | |
1166 | 'cd' bit set and subsequent queries would return this data | |
1167 | without its being marked as suspect. Thanks to Anders | |
1168 | Kaseorg for pointing out this problem. | |
1169 | ||
1170 | Add --proxy-dnssec flag, for compliance with RFC | |
1171 | 4035. Dnsmasq will now clear the 'ad' bit in answers returned | |
1172 | from upstream validating nameservers unless this option is | |
1173 | set. | |
1174 | ||
1175 | Allow a filename of "-" for --conf-file to read | |
1176 | stdin. Suggestion from Timothy Redaelli. | |
1177 | ||
1178 | Rotate the order of SRV records in replies, to provide | |
1179 | round-robin load balancing when all the priorities are | |
1180 | equal. Thanks to Peter McKinney for the suggestion. | |
1181 | ||
1182 | Edit | |
1183 | contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist | |
1184 | so that it doesn't log all queries to a file by | |
1185 | default. Thanks again to Peter McKinney. | |
1186 | ||
1187 | By default, setting an IPv4 address for a domain but not | |
1188 | an IPv6 address causes dnsmasq to return | |
1189 | an NODATA reply for IPv6 (or vice-versa). So | |
1190 | --address=/google.com/1.2.3.4 stops IPv6 queries for | |
1191 | *google.com from being forwarded. Make it possible to | |
1192 | override this behaviour by defining the sematics if the | |
1193 | same domain appears in both --server and --address. | |
1194 | In that case, the --address has priority for the address | |
1195 | family in which is appears, but the --server has priority | |
1196 | of the address family which doesn't appear in --adddress | |
1197 | So: | |
1198 | --address=/google.com/1.2.3.4 | |
1199 | --server=/google.com/# | |
1200 | will return 1.2.3.4 for IPv4 queries for *.google.com but | |
1201 | forward IPv6 queries to the normal upstream nameserver. | |
1202 | Similarly when setting an IPv6 address | |
1203 | only this will allow forwarding of IPv4 queries. Thanks to | |
1204 | William for pointing out the need for this. | |
1205 | ||
1206 | Allow more than one --dhcp-optsfile and --dhcp-hostsfile | |
1207 | and make them understand directories as arguments in the | |
1208 | same way as --addn-hosts. Suggestion from John Hanks. | |
1209 | ||
1210 | Ignore rebinding requests for leases we don't know | |
1211 | about. Rebind is broadcast, so we might get to overhear a | |
1212 | request meant for another DHCP server. NAKing this is | |
1213 | wrong. Thanks to Brad D'Hondt for assistance with this. | |
1214 | ||
572b41eb SK |
1215 | Fix cosmetic bug which produced strange output when |
1216 | dumping cache statistics with some configurations. Thanks | |
1217 | to Fedor Kozhevnikov for spotting this. | |
28866e95 SK |
1218 | |
1219 | ||
c52e1897 | 1220 | version 2.55 |
28866e95 SK |
1221 | Fix crash when /etc/ethers is in use. Thanks to |
1222 | Gianluigi Tiesi for finding this. | |
c52e1897 | 1223 | |
28866e95 SK |
1224 | Fix crash in netlink_multicast(). Thanks to Arno Wald for |
1225 | finding this one. | |
c52e1897 | 1226 | |
28866e95 SK |
1227 | Allow the empty domain "." in dhcp domain-search (119) |
1228 | options. | |
c52e1897 SK |
1229 | |
1230 | ||
1231 | version 2.54 | |
28866e95 SK |
1232 | There is no version 2.54 to avoid confusion with 2.53, |
1233 | which incorrectly identifies itself as 2.54. | |
c52e1897 SK |
1234 | |
1235 | ||
8ef5ada2 SK |
1236 | version 2.53 |
1237 | Fix failure to compile on Debian/kFreeBSD. Thanks to | |
1238 | Axel Beckert and Petr Salinger. | |
1239 | ||
1240 | Fix code to avoid scary strict-aliasing warnings | |
1241 | generated by gcc 4.4. | |
1242 | ||
1243 | Added FAQ entry warning about DHCP failures with Vista | |
1244 | when firewalls block 255.255.255.255. | |
1245 | ||
1246 | Fixed bug which caused bad things to happen if a | |
1247 | resolv.conf file which exists is subsequently removed. | |
1248 | Thanks to Nikolai Saoukh for the patch. | |
1249 | ||
1250 | Rationalised the DHCP tag system. Every configuration item | |
1251 | which can set a tag does so by adding "set:<tag>" and | |
1252 | every configuration item which is conditional on a tag is | |
1253 | made so by "tag:<tag>". The NOT operator changes to '!', | |
1254 | which is a bit more intuitive too. Dhcp-host directives | |
1255 | can set more than one tag now. The old '#' NOT, | |
1256 | "net:" prefix and no-prefixes are still honoured, so | |
1257 | no existing config file needs to be changed, but | |
1258 | the documentation and new-style config files should be | |
1259 | much less confusing. | |
1260 | ||
1261 | Added --tag-if to allow boolean operations on tags. | |
1262 | This allows complicated logic to be clearer and more | |
1263 | general. A great suggestion from Richard Voigt. | |
1264 | ||
1265 | Add broadcast/unicast information to DHCP logging. | |
1266 | ||
1267 | Allow --dhcp-broadcast to be unconditional. | |
1268 | ||
1269 | Fixed incorrect behaviour with NOT <tag> conditionals in | |
1270 | dhcp-options. Thanks to Max Turkewitz for assistance | |
1271 | finding this. | |
1272 | ||
1273 | If we send vendor-class encapsulated options based on the | |
1274 | vendor-class supplied by the client, and no explicit | |
1275 | vendor-class option is given, echo back the vendor-class | |
1276 | from the client. | |
1277 | ||
1278 | Fix bug which stopped dnsmasq from matching both a | |
1279 | circuitid and a remoteid. Thanks to Ignacio Bravo for | |
1280 | finding this. | |
1281 | ||
1282 | Add --dhcp-proxy, which makes it possible to configure | |
1283 | dnsmasq to use a DHCP relay agent as a full proxy, with | |
1284 | all DHCP messages passing through the proxy. This is | |
1285 | useful if the relay adds extra information to the packets | |
1286 | it forwards, but cannot be configured with the RFC 5107 | |
1287 | server-override option. | |
1288 | ||
1289 | Added interface:<iface name> part to dhcp-range. The | |
1290 | semantics of this are very odd at first sight, but it | |
1291 | allows a single line of the form | |
1292 | dhcp-range=interface:virt0,192.168.0.4,192.168.0.200 | |
1293 | to be added to dnsmasq configuration which then supplies | |
1294 | DHCP and DNS services to that interface, without affecting | |
1295 | what services are supplied to other interfaces and | |
1296 | irrespective of the existance or lack of | |
1297 | interface=<interface> | |
1298 | lines elsewhere in the dnsmasq configuration. The idea is | |
1299 | that such a line can be added automatically by libvirt | |
1300 | or equivalent systems, without disturbing any manual | |
1301 | configuration. | |
1302 | ||
1303 | Similarly to the above, allow --enable-tftp=<interface> | |
1304 | ||
1305 | Allow a TFTP root to be set separately for requests via | |
1306 | different interfaces, --tftp-root=<path>,<interface> | |
1307 | ||
1308 | Correctly handle and log clashes between CNAMES and | |
1309 | DNS names being given to DHCP leases. This fixes a bug | |
1310 | which caused nonsense IP addresses to be logged. Thanks to | |
1311 | Sergei Zhirikov for finding and analysing the problem. | |
1312 | ||
1313 | Tweak flush_log so as to avoid leaving the log | |
1314 | file in non-blocking mode. O_NONBLOCK is a property of the | |
1315 | file, not the process/descriptor. | |
1316 | ||
1317 | Fix contrib/Solaris10/create_package | |
1318 | (/usr/man -> /usr/share/man) Thanks to Vita Batrla. | |
1319 | ||
1320 | Fix a problem where, if a client got a lease, then went | |
1321 | to another subnet and got another lease, then moved back, | |
1322 | it couldn't resume the old lease, but would instead get | |
1323 | a new address. Thanks to Leonardo Rodrigues for spotting | |
1324 | this and testing the fix. | |
1325 | ||
1326 | Fix weird bug which sometimes omitted certain characters | |
1327 | from the start of quoted strings in dhcp-options. Thanks | |
1328 | to Dayton Turner for spotting the problem. | |
1329 | ||
1330 | Add facility to redirect some domains to the standard | |
1331 | upstream servers: this allows something like | |
1332 | --server=/google.com/1.2.3.4 --server=/www.google.com/# | |
1333 | which will send queries for *.google.com to 1.2.3.4, | |
1334 | except *www.google.com which will be forwarded as usual. | |
1335 | Thanks to AJ Weber for prompting this addition. | |
1336 | ||
1337 | Improve the hash-algorithm used to generate IP addresses | |
1338 | from MAC addresses during initial DHCP address | |
1339 | allocation. This improves performance when large numbers | |
1340 | of hosts with similar MAC addresses all try and get an IP | |
1341 | address at the same time. Thanks to Paul Smith for his | |
1342 | work on this. | |
1343 | ||
1344 | Tweak DHCP code so that --bridge-interface can be used to | |
1345 | select which IP alias of an interface should be used for | |
1346 | DHCP purposes on Linux. If eth0 has an alias eth0:dhcp | |
1347 | then adding --bridge-interface=eth0:dhcp,eth0 will use | |
1348 | the address of eth0:dhcp to determine the correct subnet | |
1349 | for DHCP address allocation. Thanks to Pawel Golaszewski | |
1350 | for prompting this and Eric Cooper for further testing. | |
1351 | ||
1352 | Add --dhcp-generate-names. Suggestion by Ferenc Wagner. | |
1353 | ||
1354 | Tweak DNS server selection algorithm when there is more | |
1355 | than one server available for a domain, eg. | |
1356 | --server=/mydomain/1.1.1.1 | |
1357 | --server=/mydomain/2.2.2.2 | |
1358 | Thanks to Alberto Cuesta-Canada for spotting a weakness | |
1359 | here. | |
1360 | ||
1361 | Add --max-ttl. Thanks to Fredrik Ringertz for the patch. | |
1362 | ||
1363 | Allow --log-facility=- to force all logging to | |
1364 | stderr. Suggestion from Clemens Fischer. | |
1365 | ||
1366 | Fix regression which caused configuration like | |
1367 | --address=/.domain.com/1.2.3.4 to be rejected. The dot to the | |
1368 | left of the domain has been implied and not required for a | |
1369 | long time, but it should be accepted for backward | |
1370 | compatibility. Thanks to Andrew Burcin for spotting this. | |
1371 | ||
1372 | Add --rebind-domain-ok and --rebind-localhost-ok. | |
1373 | Suggestion from Clemens Fischer. | |
1374 | ||
1375 | Log replies to queries of type TXT, when --log-queries | |
1376 | is set. | |
1377 | ||
1378 | Fix compiler warnings when compiled with -DNO_DHCP. Thanks | |
1379 | to Shantanu Gadgil for the patch. | |
1380 | ||
1381 | Updated French translation. Thanks to Gildas Le Nadan. | |
1382 | ||
1383 | Updated Polish translation. Thanks to Jan Psota. | |
1384 | ||
1385 | Updated German translation. Thanks to Matthias Andree. | |
1386 | ||
1387 | Added contrib/static-arp, thanks to Darren Hoo. | |
1388 | ||
1389 | Fix corruption of the domain when a name from /etc/hosts | |
1390 | overrides one supplied by a DHCP client. Thanks to Fedor | |
1391 | Kozhevnikov for spotting the problem. | |
1392 | ||
1393 | Updated Spanish translation. Thanks to Chris Chatham. | |
1394 | ||
1395 | ||
316e2730 SK |
1396 | version 2.52 |
1397 | Work around a Linux kernel bug which insists that the | |
1398 | length of the option passed to setsockopt must be at least | |
1399 | sizeof(int) bytes, even if we're calling SO_BINDTODEVICE | |
1400 | and the device name is "lo". Note that this is fixed | |
1401 | in kernel 2.6.31, but the workaround is harmless and | |
1402 | allows earlier kernels to be used. Also fix dnsmasq | |
1403 | bug which reported the wrong address when this failed. | |
1404 | Thanks to Fedor for finding this. | |
1405 | ||
1406 | The API for IPv6 PKTINFO changed around Linux kernel | |
1407 | 2.6.14. Workaround the case where dnsmasq is compiled | |
1408 | against newer headers, but then run on an old kernel: | |
1409 | necessary for some *WRT distros. | |
1410 | ||
1411 | Re-read the set of network interfaces when re-loading | |
1412 | /etc/resolv.conf if --bind-interfaces is not set. This | |
1413 | handles the case that loopback interfaces do not exist | |
1414 | when dnsmasq is first started. | |
1415 | ||
1416 | Tweak the PXE code to support port 4011. This should | |
1417 | reduce broadcasts and make things more reliable when other | |
1418 | servers are around. It also improves inter-operability | |
1419 | with certain clients. | |
1420 | ||
1421 | Make a pxe-service configuration with no filename or boot | |
1422 | service type legal: this does a local boot. eg. | |
1423 | pxe-service=x86PC, "Local boot" | |
1424 | ||
1425 | Be more conservative in detecting "A for A" | |
1426 | queries. Dnsmasq checks if the name in a type=A query looks | |
1427 | like a dotted-quad IP address and answers the query itself | |
1428 | if so, rather than forwarding it. Previously dnsmasq | |
1429 | relied in the library function inet_addr() to convert | |
1430 | addresses, and that will accept some things which are | |
1431 | confusing in this context, like 1.2.3 or even just | |
1432 | 1234. Now we only do A for A processing for four decimal | |
1433 | numbers delimited by dots. | |
1434 | ||
1435 | A couple of tweaks to fix compilation on Solaris. Thanks | |
1436 | to Joel Macklow for help with this. | |
1437 | ||
1438 | Another Solaris compilation tweak, needed for Solaris | |
1439 | 2009.06. Thanks to Lee Essen for that. | |
1440 | ||
1441 | Added extract packaging stuff from Lee Essen to | |
1442 | contrib/Solaris10. | |
1443 | ||
1444 | Increased the default limit on number of leases to 1000 | |
1445 | (from 150). This is mainly a defence against DoS attacks, | |
1446 | and for the average "one for two class C networks" | |
1447 | installation, IP address exhaustion does that just as | |
1448 | well. Making the limit greater than the number of IP | |
1449 | addresses available in such an installation removes a | |
1450 | surprise which otherwise can catch people out. | |
1451 | ||
1452 | Removed extraneous trailing space in the value of the | |
1453 | DNSMASQ_TIME_REMAINING DNSMASQ_LEASE_LENGTH and | |
1454 | DNSMASQ_LEASE_EXPIRES environment variables. Thanks to | |
1455 | Gildas Le Nadan for spotting this. | |
1456 | ||
1457 | Provide the network-id tags for a DHCP transaction to | |
1458 | the lease-change script in the environment variable | |
1459 | DNSMASQ_TAGS. A good suggestion from Gildas Le Nadan. | |
1460 | ||
1461 | Add support for RFC3925 "Vendor-Identifying Vendor | |
1462 | Options". The syntax looks like this: | |
1463 | --dhcp-option=vi-encap:<enterprise number>, ......... | |
1464 | ||
1465 | Add support to --dhcp-match to allow matching against | |
1466 | RFC3925 "Vendor-Identifying Vendor Classes". The syntax | |
1467 | looks like this: | |
1468 | --dhcp-match=tag,vi-encap<enterprise number>, <value> | |
1469 | ||
1470 | Add some application specific code to assist in | |
1471 | implementing the Broadband forum TR069 CPE-WAN | |
1472 | specification. The details are in contrib/CPE-WAN/README | |
1473 | ||
1474 | Increase the default DNS packet size limit to 4096, as | |
1475 | recommended by RFC5625 section 4.4.3. This can be | |
1476 | reconfigured using --edns-packet-max if needed. Thanks to | |
1477 | Francis Dupont for pointing this out. | |
1478 | ||
8ef5ada2 | 1479 | Rewrite query-ids even for TSIG signed packets, since |
316e2730 SK |
1480 | this is allowed by RFC5625 section 4.5. |
1481 | ||
1482 | Use getopt_long by default on OS X. It has been supported | |
1483 | since version 10.3.0. Thanks to Arek Dreyer for spotting | |
1484 | this. | |
1485 | ||
1486 | Added up-to-date startup configuration for MacOSX/launchd | |
1487 | in contrib/MacOSX-launchd. Thanks to Arek Dreyer for | |
1488 | providing this. | |
1489 | ||
1490 | Fix link error when including Dbus but excluding DHCP. | |
1491 | Thanks to Oschtan for the bug report. | |
1492 | ||
1493 | Updated French translation. Thanks to Gildas Le Nadan. | |
1494 | ||
1495 | Updated Polish translation. Thanks to Jan Psota. | |
1496 | ||
1497 | Updated Spanish translation. Thanks to Chris Chatham. | |
1498 | ||
8ef5ada2 SK |
1499 | Fixed confusion about domains, when looking up DHCP hosts |
1500 | in /etc/hosts. This could cause spurious "Ignoring | |
1501 | domain..." messages. Thanks to Fedor Kozhevnikov for | |
1502 | finding and analysing the problem. | |
316e2730 | 1503 | |
8ef5ada2 | 1504 | |
1f15b81d SK |
1505 | version 2.51 |
1506 | Add support for internationalised DNS. Non-ASCII characters | |
1507 | in domain names found in /etc/hosts, /etc/ethers and | |
1508 | /etc/dnsmasq.conf will be correctly handled by translation to | |
1509 | punycode, as specified in RFC3490. This function is only | |
1510 | available if dnsmasq is compiled with internationalisation | |
1511 | support, and adds a dependency on GNU libidn. Without i18n | |
1512 | support, dnsmasq continues to be compilable with just | |
1513 | standard tools. Thanks to Yves Dorfsman for the | |
1514 | suggestion. | |
1515 | ||
1516 | Add two more environment variables for lease-change scripts: | |
1517 | First, DNSMASQ_SUPPLIED_HOSTNAME; this is set to the hostname | |
1518 | supplied by a client, even if the actual hostname used is | |
1519 | over-ridden by dhcp-host or dhcp-ignore-names directives. | |
1520 | Also DNSMASQ_RELAY_ADDRESS which gives the address of | |
1521 | a DHCP relay, if used. | |
1522 | Suggestions from Michael Rack. | |
1523 | ||
1524 | Fix regression which broke echo of relay-agent | |
1525 | options. Thanks to Michael Rack for spotting this. | |
1526 | ||
1527 | Don't treat option 67 as being interchangeable with | |
1528 | dhcp-boot parameters if it's specified as | |
1529 | dhcp-option-force. | |
1530 | ||
1531 | Make the code to call scripts on lease-change compile-time | |
1532 | optional. It can be switched off by editing src/config.h | |
1533 | or building with "make COPTS=-DNO_SCRIPT". | |
1534 | ||
1535 | Make the TFTP server cope with filenames from Windows/DOS | |
1536 | which use '\' as pathname separator. Thanks to Ralf for | |
1537 | the patch. | |
1538 | ||
1539 | Updated Polish translation. Thanks to Jan Psota. | |
1540 | ||
1541 | Warn if an IP address is duplicated in /etc/ethers. Thanks | |
1542 | to Felix Schwarz for pointing this out. | |
1543 | ||
1544 | Teach --conf-dir to take an option list of file suffices | |
1545 | which will be ignored when scanning the directory. Useful | |
1546 | for backup files etc. Thanks to Helmut Hullen for the | |
1547 | suggestion. | |
1548 | ||
1549 | Add new DHCP option named tftpserver-address, which | |
1550 | corresponds to the third argument of dhcp-boot. This | |
1551 | allows the complete functionality of dhcp-boot to be | |
1552 | replicated with dhcp-option. Useful when using | |
1553 | dhcp-optsfile. | |
1554 | ||
1555 | Test which upstream nameserver to use every 10 seconds | |
1556 | or 50 queries and not just when a query times out and | |
1557 | is retried. This should improve performance when there | |
1558 | is a slow nameserver in the list. Thanks to Joe for the | |
1559 | suggestion. | |
1560 | ||
1561 | Don't do any PXE processing, even for clients with the | |
1562 | correct vendorclass, unless at least one pxe-prompt or | |
1563 | pxe-service option is given. This stops dnsmasq | |
1564 | interfering with proxy PXE subsystems when it is just | |
1565 | the DHCP server. Thanks to Spencer Clark for spotting this. | |
1566 | ||
1567 | Limit the blocksize used for TFTP transfers to a value | |
1568 | which avoids packet fragmentation, based on the MTU of the | |
1569 | local interface. Many netboot ROMs can't cope with | |
1570 | fragmented packets. | |
1571 | ||
1572 | Honour dhcp-ignore configuration for PXE and proxy-PXE | |
1573 | requests. Thanks to Niels Basjes for the bug report. | |
1574 | ||
1575 | Updated French translation. Thanks to Gildas Le Nadan. | |
1576 | ||
1577 | ||
77e94da7 | 1578 | version 2.50 |
1f15b81d | 1579 | Fix security problem which allowed any host permitted to |
77e94da7 SK |
1580 | do TFTP to possibly compromise dnsmasq by remote buffer |
1581 | overflow when TFTP enabled. Thanks to Core Security | |
1582 | Technologies and Iván Arce, Pablo Hernán Jorge, Alejandro | |
1583 | Pablo Rodriguez, Martín Coco, Alberto Soliño Testa and | |
1584 | Pablo Annetta. This problem has Bugtraq id: 36121 | |
1585 | and CVE: 2009-2957 | |
1586 | ||
1587 | Fix a problem which allowed a malicious TFTP client to | |
1588 | crash dnsmasq. Thanks to Steve Grubb at Red Hat for | |
1589 | spotting this. This problem has Bugtraq id: 36120 and | |
1590 | CVE: 2009-2958 | |
1591 | ||
1592 | ||
03a97b61 SK |
1593 | version 2.49 |
1594 | Fix regression in 2.48 which disables the lease-change | |
1595 | script. Thanks to Jose Luis Duran for spotting this. | |
1596 | ||
1597 | Log TFTP "file not found" errors. These were not logged, | |
1598 | since a normal PXELinux boot generates many of them, but | |
1599 | the lack of the messages seems to be more confusing than | |
1600 | routinely seeing them when there is no real error. | |
1601 | ||
1602 | Update Spanish translation. Thanks to Chris Chatham. | |
1603 | ||
1604 | ||
7622fc06 SK |
1605 | version 2.48 |
1606 | Archived the extensive, backwards, changelog to | |
1607 | CHANGELOG.archive. The current changelog now runs from | |
1608 | version 2.43 and runs conventionally. | |
9e4abcb5 | 1609 | |
7622fc06 SK |
1610 | Fixed bug which broke binding of servers to physical |
1611 | interfaces when interface names were longer than four | |
1612 | characters. Thanks to MURASE Katsunori for the patch. | |
9e4abcb5 | 1613 | |
7622fc06 SK |
1614 | Fixed netlink code to check that messages come from the |
1615 | correct source, and not another userspace process. Thanks | |
1616 | to Steve Grubb for the patch. | |
9e4abcb5 | 1617 | |
7622fc06 SK |
1618 | Maintainability drive: removed bug and missing feature |
1619 | workarounds for some old platforms. Solaris 9, OpenBSD | |
1620 | older than 4.1, Glibc older than 2.2, Linux 2.2.x and | |
1621 | DBus older than 1.1.x are no longer supported. | |
9e4abcb5 | 1622 | |
7622fc06 SK |
1623 | Don't read included configuration files more than once: |
1624 | allows complex configuration structures without problems. | |
9e4abcb5 | 1625 | |
7622fc06 SK |
1626 | Mark log messages from the various subsystems in dnsmasq: |
1627 | messages from the DHCP subsystem now have the ident string | |
1628 | "dnsmasq-dhcp" and messages from TFTP have ident | |
1629 | "dnsmasq-tftp". Thanks to Olaf Westrik for the patch. | |
9e4abcb5 | 1630 | |
7622fc06 SK |
1631 | Fix possible infinite DHCP protocol loop when an IP |
1632 | address nailed to a hostname (not a MAC address) and a | |
1633 | host sometimes provides the name, sometimes not. | |
9e4abcb5 | 1634 | |
7622fc06 SK |
1635 | Allow --addn-hosts to take a directory: all the files |
1636 | in the directory are read. Thanks to Phil Cornelius for | |
1637 | the suggestion. | |
9e4abcb5 | 1638 | |
7622fc06 | 1639 | Support --bridge-interface on all platforms, not just BSD. |
1ab84e2f | 1640 | |
7622fc06 SK |
1641 | Added support for advanced PXE functions. It's now |
1642 | possible to define a prompt and menu options which will | |
1643 | be displayed when a client PXE boots. It's also possible to | |
1644 | hand-off booting to other boot servers. Proxy-DHCP, where | |
1645 | dnsmasq just supplies the PXE information and another DHCP | |
1646 | server does address allocation, is also allowed. See the | |
1647 | --pxe-prompt and --pxe-service keywords. Thanks to | |
1648 | Alkis Georgopoulos for the suggestion and Guilherme Moro | |
1649 | and Michael Brown for assistance. | |
1650 | ||
1651 | Improvements to DHCP logging. Thanks to Tom Metro for | |
1652 | useful suggestions. | |
3be34541 | 1653 | |
7622fc06 SK |
1654 | Add ability to build dnsmasq without DHCP support. To do |
1655 | this, edit src/config.h or build with | |
1656 | "make COPTS=-DNO_DHCP". Thanks to Mahavir Jain for the patch. | |
36717eee | 1657 | |
7622fc06 SK |
1658 | Added --test command-line switch - syntax check |
1659 | configuration files only. | |
36717eee | 1660 | |
7622fc06 | 1661 | Updated French translation. Thanks to Gildas Le Nadan. |
fd9fa481 | 1662 | |
3d8df260 | 1663 | |
7622fc06 SK |
1664 | version 2.47 |
1665 | Updated French translation. Thanks to Gildas Le Nadan. | |
3d8df260 | 1666 | |
7622fc06 SK |
1667 | Fixed interface enumeration code to work on NetBSD |
1668 | 5.0. Thanks to Roy Marples for the patch. | |
3d8df260 | 1669 | |
7622fc06 SK |
1670 | Updated config.h to use the same location for the lease |
1671 | file on NetBSD as the other *BSD variants. Also allow | |
1672 | LEASEFILE and CONFFILE symbols to be overriden in CFLAGS. | |
3d8df260 | 1673 | |
7622fc06 SK |
1674 | Handle duplicate address detection on IPv6 more |
1675 | intelligently. In IPv6, an interface can have an address | |
1676 | which is not usable, because it is still undergoing DAD | |
1677 | (such addresses are marked "tentative"). Attempting to | |
1678 | bind to an address in this state returns an error, | |
1679 | EADDRNOTAVAIL. Previously, on getting such an error, | |
1680 | dnsmasq would silently abandon the address, and never | |
1681 | listen on it. Now, it retries once per second for 20 | |
1682 | seconds before generating a fatal error. 20 seconds should | |
1683 | be long enough for any DAD process to complete, but can be | |
1684 | adjusted in src/config.h if necessary. Thanks to Martin | |
1685 | Krafft for the bug report. | |
3d8df260 | 1686 | |
7622fc06 | 1687 | Add DBus introspection. Patch from Jeremy Laine. |
b8187c80 | 1688 | |
7622fc06 SK |
1689 | Update Dbus configuration file. Patch from Colin Walters. |
1690 | Fix for this bug: | |
1691 | http://bugs.freedesktop.org/show_bug.cgi?id=18961 | |
b8187c80 | 1692 | |
7622fc06 SK |
1693 | Support arbitrarily encapsulated DHCP options, suggestion |
1694 | and initial patch from Samium Gromoff. This is useful for | |
1695 | (eg) gPXE, which expect all its private options to be | |
1696 | encapsulated inside a single option 175. So, eg, | |
b8187c80 | 1697 | |
7622fc06 SK |
1698 | dhcp-option = encap:175, 190, "iscsi-client0" |
1699 | dhcp-option = encap:175, 191, "iscsi-client0-secret" | |
b8187c80 | 1700 | |
7622fc06 | 1701 | will provide iSCSI parameters to gPXE. |
b8187c80 | 1702 | |
7622fc06 SK |
1703 | Enhance --dhcp-match to allow testing of the contents of a |
1704 | client-sent option, as well as its presence. This | |
1705 | application in mind for this is RFC 4578 | |
1706 | client-architecture specifiers, but it's generally useful. | |
1707 | Joey Korkames suggested the enhancement. | |
b8187c80 | 1708 | |
7622fc06 SK |
1709 | Move from using the IP_XMIT_IF ioctl to IP_BOUND_IF on |
1710 | OpenSolaris. Thanks to Bastian Machek for the heads-up. | |
b8187c80 | 1711 | |
7622fc06 SK |
1712 | No longer complain about blank lines in |
1713 | /etc/ethers. Thanks to Jon Nelson for the patch. | |
b8187c80 | 1714 | |
7622fc06 SK |
1715 | Fix binding of servers to physical devices, eg |
1716 | --server=/domain/1.2.3.4@eth0 which was broken from 2.43 | |
1717 | onwards unless --query-port=0 set. Thanks to Peter Naulls | |
cdeda28f SK |
1718 | for the bug report. |
1719 | ||
7622fc06 SK |
1720 | Reply to DHCPINFORM requests even when the supplied ciaddr |
1721 | doesn't fall in any dhcp-range. In this case it's not | |
1722 | possible to supply a complete configuration, but | |
1723 | individually-configured options (eg PAC) may be useful. | |
5aabfc78 | 1724 | |
7622fc06 SK |
1725 | Allow the source address of an alias to be a range: |
1726 | --alias=192.168.0.0,10.0.0.0,255.255.255.0 maps the whole | |
1727 | subnet 192.168.0.0->192.168.0.255 to 10.0.0.0->10.0.0.255, | |
1728 | as before. | |
1729 | --alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0 | |
1730 | maps only the 192.168.0.10->192.168.0.40 region. Thanks to | |
1731 | Ib Uhrskov for the suggestion. | |
5aabfc78 | 1732 | |
7622fc06 SK |
1733 | Don't dynamically allocate DHCP addresses which may break |
1734 | Windows. Addresses which end in .255 or .0 are broken in | |
1735 | Windows even when using supernetting. | |
1736 | --dhcp-range=192.168.0.1,192.168.1.254,255,255,254.0 means | |
1737 | 192.168.0.255 is a valid IP address, but not for Windows. | |
1738 | See Microsoft KB281579. We therefore no longer allocate | |
1739 | these addresses to avoid hard-to-diagnose problems. | |
5aabfc78 | 1740 | |
7622fc06 | 1741 | Update Polish translation. Thanks to Jan Psota. |
5aabfc78 | 1742 | |
7622fc06 SK |
1743 | Delete the PID-file when dnsmasq shuts down. Note that by |
1744 | this time, dnsmasq is normally not running as root, so | |
1745 | this will fail if the PID-file is stored in a root-owned | |
1746 | directory; such failure is silently ignored. To take | |
1747 | advantage of this feature, the PID-file must be stored in a | |
1748 | directory owned and write-able by the user running | |
1749 | dnsmasq. | |
5aabfc78 | 1750 | |
5aabfc78 | 1751 | |
7622fc06 SK |
1752 | version 2.46 |
1753 | Allow --bootp-dynamic to take a netid tag, so that it may | |
1754 | be selectively enabled. Thanks to Olaf Westrik for the | |
1755 | suggestion. | |
5aabfc78 | 1756 | |
7622fc06 SK |
1757 | Remove ISC-leasefile reading code. This has been |
1758 | deprecated for a long time, and last time I removed it, it | |
1759 | ended up going back by request of one user. This time, | |
1760 | it's gone for good; otherwise it would need to be | |
1761 | re-worked to support multiple domains (see below). | |
5aabfc78 | 1762 | |
7622fc06 SK |
1763 | Support DHCP clients in multiple DNS domains. This is a |
1764 | long-standing request. Clients are assigned to a domain | |
1765 | based in their IP address. | |
5aabfc78 | 1766 | |
7622fc06 SK |
1767 | Add --dhcp-fqdn flag, which changes behaviour if DNS names |
1768 | assigned to DHCP clients. When this is set, there must be | |
1769 | a domain associated with each client, and only | |
1770 | fully-qualified domain names are added to the DNS. The | |
1771 | advantage is that the only the FQDN needs to be unique, | |
1772 | so that two or more DHCP clients can share a hostname, as | |
1773 | long as they are in different domains. | |
5aabfc78 | 1774 | |
7622fc06 SK |
1775 | Set environment variable DNSMASQ_DOMAIN when invoking |
1776 | lease-change script. This may be useful information to | |
1777 | have now that it's variable. | |
5aabfc78 | 1778 | |
7622fc06 SK |
1779 | Tighten up data-checking code for DNS packet |
1780 | handling. Thanks to Steve Dodd who found certain illegal | |
1781 | packets which could crash dnsmasq. No memory overwrite was | |
1782 | possible, so this is not a security issue beyond the DoS | |
1783 | potential. | |
824af85b | 1784 | |
7622fc06 SK |
1785 | Update example config dhcp option 47, the previous |
1786 | suggestion generated an illegal, zero-length, | |
1787 | option. Thanks to Matthias Andree for finding this. | |
824af85b | 1788 | |
7622fc06 SK |
1789 | Rewrite hosts-file reading code to remove the limit of |
1790 | 1024 characters per line. John C Meuser found this. | |
824af85b | 1791 | |
7622fc06 SK |
1792 | Create a net-id tag with the name of the interface on |
1793 | which the DHCP request was received. | |
824af85b | 1794 | |
7622fc06 SK |
1795 | Fixed minor memory leak in DBus code, thanks to Jeremy |
1796 | Laine for the patch. | |
824af85b | 1797 | |
7622fc06 SK |
1798 | Emit DBus signals as the DHCP lease database |
1799 | changes. Thanks to Jeremy Laine for the patch. | |
824af85b | 1800 | |
7622fc06 SK |
1801 | Allow for more that one MAC address in a dhcp-host |
1802 | line. This configuration tells dnsmasq that it's OK to | |
1803 | abandon a DHCP lease of the fixed address to one MAC | |
1804 | address, if another MAC address in the dhcp-host statement | |
1805 | asks for an address. This is useful to give a fixed | |
1806 | address to a host which has two network interfaces | |
1807 | (say, a laptop with wired and wireless interfaces.) | |
1808 | It's very important to ensure that only one interface | |
1809 | at a time is up, since dnsmasq abandons the first lease | |
1810 | and re-uses the address before the leased time has | |
1811 | elapsed. John Gray suggested this. | |
824af85b | 1812 | |
7622fc06 SK |
1813 | Tweak the response to a DHCP request packet with a wrong |
1814 | server-id when --dhcp-authoritative is set; dnsmasq now | |
1815 | returns a DHCPNAK, rather than silently ignoring the | |
1816 | packet. Thanks to Chris Marget for spotting this | |
1817 | improvement. | |
824af85b | 1818 | |
7622fc06 SK |
1819 | Add --cname option. This provides a limited alias |
1820 | function, usable for DHCP names. Thanks to AJ Weber for | |
1821 | suggestions on this. | |
824af85b | 1822 | |
7622fc06 SK |
1823 | Updated contrib/webmin with latest version from Neil |
1824 | Fisher. | |
824af85b | 1825 | |
7622fc06 | 1826 | Updated Polish translation. Thanks to Jan Psota. |
824af85b | 1827 | |
7622fc06 SK |
1828 | Correct the text names for DHCP options 64 and 65 to be |
1829 | "nis+-domain" and "nis+-servers". | |
9e038946 | 1830 | |
7622fc06 | 1831 | Updated Spanish translation. Thanks to Chris Chatham. |
9e038946 | 1832 | |
7622fc06 SK |
1833 | Force re-reading of /etc/resolv.conf when an "interface |
1834 | up" event occurs. | |
9e038946 | 1835 | |
824af85b | 1836 | |
7622fc06 SK |
1837 | version 2.45 |
1838 | Fix total DNS failure in release 2.44 unless --min-port | |
1839 | specified. Thanks to Steven Barth and Grant Coady for | |
1840 | bugreport. Also reject out-of-range port spec, which could | |
1841 | break things too: suggestion from Gilles Espinasse. | |
824af85b | 1842 | |
9e038946 | 1843 | |
7622fc06 SK |
1844 | version 2.44 |
1845 | Fix crash when unknown client attempts to renew a DHCP | |
1846 | lease, problem introduced in version 2.43. Thanks to | |
1847 | Carlos Carvalho for help chasing this down. | |
9e038946 | 1848 | |
7622fc06 SK |
1849 | Fix potential crash when a host which doesn't have a lease |
1850 | does DHCPINFORM. Again introduced in 2.43. This bug has | |
1851 | never been reported in the wild. | |
9e038946 | 1852 | |
7622fc06 SK |
1853 | Fix crash in netlink code introduced in 2.43. Thanks to |
1854 | Jean Wolter for finding this. | |
9e038946 | 1855 | |
7622fc06 SK |
1856 | Change implementation of min_port to work even if min-port |
1857 | is large. | |
9e038946 | 1858 | |
7622fc06 SK |
1859 | Patch to enable compilation of latest Mac OS X. Thanks to |
1860 | David Gilman. | |
9e038946 | 1861 | |
7622fc06 | 1862 | Update Spanish translation. Thanks to Christopher Chatham. |
1a6bca81 SK |
1863 | |
1864 | ||
1865 | version 2.43 | |
1866 | Updated Polish translation. Thanks to Jan Psota. | |
1867 | ||
1868 | Flag errors when configuration options are repeated | |
1869 | illegally. | |
1870 | ||
1871 | Further tweaks for GNU/kFreeBSD | |
1872 | ||
1873 | Add --no-wrap to msgmerge call - provides nicer .po file | |
1874 | format. | |
1875 | ||
1876 | Honour lease-time spec in dhcp-host lines even for | |
1877 | BOOTP. The user is assumed to known what they are doing in | |
1878 | this case. (Hosts without the time spec still get infinite | |
1879 | leases for BOOTP, over-riding the default in the | |
1880 | dhcp-range.) Thanks to Peter Katzmann for uncovering this. | |
1881 | ||
1882 | Fix problem matching relay-agent ids. Thanks to Michael | |
1883 | Rack for the bug report. | |
1884 | ||
1885 | Add --naptr-record option. Suggestion from Johan | |
1886 | Bergquist. | |
1887 | ||
1888 | Implement RFC 5107 server-id-override DHCP relay agent | |
1889 | option. | |
1890 | ||
1891 | Apply patches from Stefan Kruger for compilation on | |
1892 | Solaris 10 under Sun studio. | |
1893 | ||
1894 | Yet more tweaking of Linux capability code, to suppress | |
1895 | pointless wingeing from kernel 2.6.25 and above. | |
1896 | ||
1897 | Improve error checking during startup. Previously, some | |
1898 | errors which occurred during startup would be worked | |
1899 | around, with dnsmasq still starting up. Some were logged, | |
1900 | some silent. Now, they all cause a fatal error and dnsmasq | |
1901 | terminates with a non-zero exit code. The errors are those | |
1902 | associated with changing uid and gid, setting process | |
1903 | capabilities and writing the pidfile. Thanks to Uwe | |
1904 | Gansert and the Suse security team for pointing out | |
1905 | this improvement, and Bill Reimers for good implementation | |
1906 | suggestions. | |
1907 | ||
1908 | Provide NO_LARGEFILE compile option to switch off largefile | |
1909 | support when compiling against versions of uclibc which | |
1910 | don't support it. Thanks to Stephane Billiart for the patch. | |
1911 | ||
1912 | Implement random source ports for interactions with | |
1913 | upstream nameservers. New spoofing attacks have been found | |
1914 | against nameservers which do not do this, though it is not | |
1915 | clear if dnsmasq is vulnerable, since to doesn't implement | |
1916 | recursion. By default dnsmasq will now use a different | |
1917 | source port (and socket) for each query it sends | |
1918 | upstream. This behaviour can suppressed using the | |
1919 | --query-port option, and the old default behaviour | |
1920 | restored using --query-port=0. Explicit source-port | |
1921 | specifications in --server configs are still honoured. | |
1922 | ||
1923 | Replace the random number generator, for better | |
1924 | security. On most BSD systems, dnsmasq uses the | |
1925 | arc4random() RNG, which is secure, but on other platforms, | |
1926 | it relied on the C-library RNG, which may be | |
1927 | guessable and therefore allow spoofing. This release | |
1928 | replaces the libc RNG with the SURF RNG, from Daniel | |
1929 | J. Berstein's DJBDNS package. | |
1930 | ||
1931 | Don't attempt to change user or group or set capabilities | |
1932 | if dnsmasq is run as a non-root user. Without this, the | |
1933 | change from soft to hard errors when these fail causes | |
1934 | problems for non-root daemons listening on high | |
1935 | ports. Thanks to Patrick McLean for spotting this. | |
1936 | ||
1937 | Updated French translation. Thanks to Gildas Le Nadan. | |
1f15b81d SK |
1938 | |
1939 | ||
1940 | version 2.42 | |
1941 | The changelog for version 2.42 and earlier is | |
1942 | available in CHANGELOG.archive. |