2 Fix crash at startup when an empty suffix is supplied to
3 --conf-dir, also trivial memory leak. Thanks to
4 Tomas Hozza for spotting this.
6 Remove floor of 4096 on advertised EDNS0 packet size when
7 DNSSEC in use, the original rationale for this has long gone.
8 Thanks to Anders Kaseorg for spotting this.
10 Use inotify for checking on updates to /etc/resolv.conf and
11 friends under Linux. This fixes race conditions when the files are
12 updated rapidly and saves CPU by noy polling. To build
13 a binary that runs on old Linux kernels without inotify,
14 use make COPTS=-DNO_INOTIFY
16 Fix breakage of --domain=<domain>,<subnet>,local - only reverse
17 queries were intercepted. THis appears to have been broken
18 since 2.69. Thanks to Josh Stone for finding the bug.
20 Eliminate IPv6 privacy addresses and deprecated addresses from
21 the answers given by --interface-name. Note that reverse queries
22 (ie looking for names, given addresses) are not affected.
23 Thanks to Michael Gorbach for the suggestion.
25 Fix crash in DNSSEC code with long RRs. Thanks to Marco Davids
28 Add --ignore-address option. Ignore replies to A-record
29 queries which include the specified address. No error is
30 generated, dnsmasq simply continues to listen for another
31 reply. This is useful to defeat blocking strategies which
32 rely on quickly supplying a forged answer to a DNS
33 request for certain domains, before the correct answer can
34 arrive. Thanks to Glen Huang for the patch.
36 Revisit the part of DNSSEC validation which determines if an
37 unsigned answer is legit, or is in some part of the DNS
38 tree which should be signed. Dnsmasq now works from the
39 DNS root downward looking for the limit of signed
40 delegations, rather than working bottom up. This is
41 both more correct, and less likely to trip over broken
42 nameservers in the unsigned parts of the DNS tree
43 which don't respond well to DNSSEC queries.
45 Add --log-queries=extra option, which makes logs easier
46 to search automatically.
48 Add --min-cache-ttl option. I've resisted this for a long
49 time, on the grounds that disbelieving TTLs is never a
50 good idea, but I've been persuaded that there are
51 sometimes reasons to do it. (Step forward, GFW).
52 To avoid misuse, there's a hard limit on the TTL
53 floor of one hour. Thansk to RinSatsuki for the patch.
55 Cope with multiple interfaces with the same link-local
56 address. (IPv6 addresses are scoped, so this is allowed.)
57 Thanks to Cory Benfield for help with this.
59 Add --dhcp-hostsdir. This allows addition of new host
60 configurations to a running dnsmasq instance much more
61 cheaply than having dnsmasq re-read all its existing
62 configuration each time.
64 Don't reply to DHCPv6 SOLICIT messages if we're not
65 configured to do stateful DHCPv6. Thanks to Win King Wan
68 Fix broken DNSSEC validation of ECDSA signatures.
70 Add --dnssec-timestamp option, which provides an automatic
71 way to detect when the system time becomes valid after boot
72 on systems without an RTC, whilst allowing DNS queries before the
73 clock is valid so that NTP can run. Thanks to
74 Kevin Darbyshire-Bryant for developing this idea.
78 Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.
80 Add support for "ipsets" in *BSD, using pf. Thanks to
81 Sven Falempim for the patch.
83 Fix race condition which could lock up dnsmasq when an
84 interface goes down and up rapidly. Thanks to Conrad
85 Kostecki for helping to chase this down.
87 Add DBus methods SetFilterWin2KOption and SetBogusPrivOption
88 Thanks to the Smoothwall project for the patch.
90 Fix failure to build against Nettle-3.0. Thanks to Steven
91 Barth for spotting this and finding the fix.
93 When assigning existing DHCP leases to intefaces by comparing
94 networks, handle the case that two or more interfaces have the
95 same network part, but different prefix lengths (favour the
96 longer prefix length.) Thanks to Lung-Pin Chang for the
99 Add a mode which detects and removes DNS forwarding loops, ie
100 a query sent to an upstream server returns as a new query to
101 dnsmasq, and would therefore be forwarded again, resulting in
102 a query which loops many times before being dropped. Upstream
103 servers which loop back are disabled and this event is logged.
104 Thanks to Smoothwall for their sponsorship of this feature.
106 Extend --conf-dir to allow filtering of files. So
107 --conf-dir=/etc/dnsmasq.d,\*.conf
108 will load all the files in /etc/dnsmasq.d which end in .conf
110 Fix bug when resulted in NXDOMAIN answers instead of NODATA in
113 Fix bug which caused dnsmasq to become unresponsive if it
114 failed to send packets due to a network interface disappearing.
115 Thanks to Niels Peen for spotting this.
117 Fix problem with --local-service option on big-endian platforms
118 Thanks to Richard Genoud for the patch.
122 Subtle change to error handling to help DNSSEC validation
123 when servers fail to provide NODATA answers for
124 non-existent DS records.
126 Tweak code which removes DNSSEC records from answers when
127 not required. Fixes broken answers when additional section
128 has real records in it. Thanks to Marco Davids for the bug
131 Fix DNSSEC validation of ANY queries. Thanks to Marco Davids
132 for spotting that too.
134 Fix total DNS failure and 100% CPU use if cachesize set to zero,
135 regression introduced in 2.69. Thanks to James Hunt and
136 the Ubuntu crowd for assistance in fixing this.
140 Fix crash, introduced in 2.69, on TCP request when dnsmasq
141 compiled with DNSSEC support, but running without DNSSEC
142 enabled. Thanks to Manish Sing for spotting that one.
144 Fix regression which broke ipset functionality. Thanks to
145 Wang Jian for the bug report.
149 Implement dynamic interface discovery on *BSD. This allows
150 the contructor: syntax to be used in dhcp-range for DHCPv6
151 on the BSD platform. Thanks to Matthias Andree for
152 valuable research on how to implement this.
154 Fix infinite loop associated with some --bogus-nxdomain
155 configs. Thanks fogobogo for the bug report.
157 Fix missing RA RDNS option with configuration like
158 --dhcp-option=option6:23,[::] Thanks to Tsachi Kimeldorfer
159 for spotting the problem.
161 Add [fd00::] and [fe80::] as special addresses in DHCPv6
162 options, analogous to [::]. [fd00::] is replaced with the
163 actual ULA of the interface on the machine running
164 dnsmasq, [fe80::] with the link-local address.
165 Thanks to Tsachi Kimeldorfer for championing this.
167 DNSSEC validation and caching. Dnsmasq needs to be
168 compiled with this enabled, with
170 make dnsmasq COPTS=-DHAVE_DNSSEC
172 this add dependencies on the nettle crypto library and the
173 gmp maths library. It's possible to have these linked
176 make dnsmasq COPTS='-DHAVE_DNSSEC -DHAVE_DNSSEC_STATIC'
178 which bloats the dnsmasq binary, but saves the size of
179 the shared libraries which are much bigger.
181 To enable, DNSSEC, you will need a set of
182 trust-anchors. Now that the TLDs are signed, this can be
183 the keys for the root zone, and for convenience they are
184 included in trust-anchors.conf in the dnsmasq
185 distribution. You should of course check that these are
186 legitimate and up-to-date. So, adding
188 conf-file=/path/to/trust-anchors.conf
191 to your config is all thats needed to get things
192 working. The upstream nameservers have to be DNSSEC-capable
193 too, of course. Many ISP nameservers aren't, but the
194 Google public nameservers (8.8.8.8 and 8.8.4.4) are.
195 When DNSSEC is configured, dnsmasq validates any queries
196 for domains which are signed. Query results which are
197 bogus are replaced with SERVFAIL replies, and results
198 which are correctly signed have the AD bit set. In
199 addition, and just as importantly, dnsmasq supplies
200 correct DNSSEC information to clients which are doing
201 their own validation, and caches DNSKEY, DS and RRSIG
202 records, which significantly improve the performance of
203 downstream validators. Setting --log-queries will show
206 If a domain is returned from an upstream nameserver without
207 DNSSEC signature, dnsmasq by default trusts this. This
208 means that for unsigned zone (still the majority) there
209 is effectively no cost for having DNSSEC enabled. Of course
210 this allows an attacker to replace a signed record with a
211 false unsigned record. This is addressed by the
212 --dnssec-check-unsigned flag, which instructs dnsmasq
213 to prove that an unsigned record is legitimate, by finding
214 a secure proof that the zone containing the record is not
215 signed. Doing this has costs (typically one or two extra
216 upstream queries). It also has a nasty failure mode if
217 dnsmasq's upstream nameservers are not DNSSEC capable.
218 Without --dnssec-check-unsigned using such an upstream
219 server will simply result in not queries being validated;
220 with --dnssec-check-unsigned enabled and a
221 DNSSEC-ignorant upstream server, _all_ queries will fail.
223 Note that DNSSEC requires that the local time is valid and
224 accurate, if not then DNSSEC validation will fail. NTP
225 should be running. This presents a problem for routers
226 without a battery-backed clock. To set the time needs NTP
227 to do DNS lookups, but lookups will fail until NTP has run.
228 To address this, there's a flag, --dnssec-no-timecheck
229 which disables the time checks (only) in DNSSEC. When dnsmasq
230 is started and the clock is not synced, this flag should
231 be used. As soon as the clock is synced, SIGHUP dnsmasq.
232 The SIGHUP clears the cache of partially-validated data and
233 resets the no-timecheck flag, so that all DNSSEC checks
234 henceforward will be complete.
236 The development of DNSSEC in dnsmasq was started by
237 Giovanni Bajo, to whom huge thanks are owed. It has been
238 supported by Comcast, whose techfund grant has allowed for
239 an invaluable period of full-time work to get it to
242 Add --rev-server. Thanks to Dave Taht for suggesting this.
244 Add --servers-file. Allows dynamic update of upstream servers
245 full access to configuration.
247 Add --local-service. Accept DNS queries only from hosts
248 whose address is on a local subnet, ie a subnet for which
249 an interface exists on the server. This option
250 only has effect if there are no --interface --except-interface,
251 --listen-address or --auth-server options. It is intended
252 to be set as a default on installation, to allow
253 unconfigured installations to be useful but also safe from
254 being used for DNS amplification attacks.
256 Fix crashes in cache_get_cname_target() when dangling CNAMEs
257 encountered. Thanks to Andy and the rt-n56u project for
258 find this and helping to chase it down.
260 Fix wrong RCODE in authoritative DNS replies to PTR queries. The
261 correct answer was included, but the RCODE was set to NXDOMAIN.
262 Thanks to Craig McQueen for spotting this.
264 Make statistics available as DNS queries in the .bind TLD as
265 well as logging them.
269 Use random addresses for DHCPv6 temporary address
270 allocations, instead of algorithmically determined stable
273 Fix bug which meant that the DHCPv6 DUID was not available
274 in DHCP script runs during the lifetime of the dnsmasq
275 process which created the DUID de-novo. Once the DUID was
276 created and stored in the lease file and dnsmasq
277 restarted, this bug disappeared.
279 Fix bug introduced in 2.67 which could result in erroneous
280 NXDOMAIN returns to CNAME queries.
282 Fix build failures on MacOS X and openBSD.
284 Allow subnet specifications in --auth-zone to be interface
285 names as well as address literals. This makes it possible
286 to configure authoritative DNS when local address ranges
287 are dynamic and works much better than the previous
288 work-around which exempted contructed DHCP ranges from the
289 IP address filtering. As a consequence, that work-around
290 is removed. Under certain circumstances, this change wil
291 break existing configuration: if you're relying on the
292 contructed-range exception, you need to change --auth-zone
293 to specify the same interface as is used to construct your
294 DHCP ranges, probably with a trailing "/6" like this:
295 --auth-zone=example.com,eth0/6 to limit the addresses to
296 IPv6 addresses of eth0.
298 Fix problems when advertising deleted IPv6 prefixes. If
299 the prefix is deleted (rather than replaced), it doesn't
300 get advertised with zero preferred time. Thanks to Tsachi
303 Fix segfault with some locally configured CNAMEs. Thanks
304 to Andrew Childs for spotting the problem.
306 Fix memory leak on re-reading /etc/hosts and friends,
309 Check the arrival interface of incoming DNS and TFTP
310 requests via IPv6, even in --bind-interfaces mode. This
311 isn't possible for IPv4 and can generate scary warnings,
312 but as it's always possible for IPv6 (the API always
313 exists) then we should do it always.
315 Tweak the rules on prefix-lengths in --dhcp-range for
316 IPv6. The new rule is that the specified prefix length
317 must be larger than or equal to the prefix length of the
318 corresponding address on the local interface.
322 Fix crash if upstream server returns SERVFAIL when
323 --conntrack in use. Thanks to Giacomo Tazzari for finding
324 this and supplying the patch.
326 Repair regression in 2.64. That release stopped sending
327 lease-time information in the reply to DHCPINFORM
328 requests, on the correct grounds that it was a standards
329 violation. However, this broke the dnsmasq-specific
330 dhcp_lease_time utility. Now, DHCPINFORM returns
331 lease-time only if it's specifically requested
332 (maintaining standards) and the dhcp_lease_time utility
333 has been taught to ask for it (restoring functionality).
335 Fix --dhcp-match, --dhcp-vendorclass and --dhcp-userclass
336 to work with BOOTP and well as DHCP. Thanks to Peter
337 Korsgaard for spotting the problem.
339 Add --synth-domain. Thanks to Vishvananda Ishaya for
342 Fix failure to compile ipset.c if old kernel headers are
343 in use. Thanks to Eugene Rudoy for pointing this out.
345 Handle IPv4 interface-address labels in Linux. These are
346 often used to emulate the old IP-alias addresses. Before,
347 using --interface=eth0 would service all the addresses of
348 eth0, including ones configured as aliases, which appear
349 in ifconfig as eth0:0. Now, only addresses with the label
350 eth0 are active. This is not backwards compatible: if you
351 want to continue to bind the aliases too, you need to add
352 eg. --interface=eth0:0 to the config.
354 Fix "failed to set SO_BINDTODEVICE on DHCP socket: Socket
355 operation on non-socket" error on startup with
356 configurations which have exactly one --interface option
357 and do RA but _not_ DHCPv6. Thanks to Trever Adams for the
360 Generalise --interface-name to cope with IPv6 addresses
361 and multiple addresses per interface per address family.
363 Fix option parsing for --dhcp-host, which was generating a
364 spurious error when all seven possible items were
365 included. Thanks to Zhiqiang Wang for the bug report.
367 Remove restriction on prefix-length in --auth-zone. Thanks
368 to Toke Hoiland-Jorgensen for suggesting this.
370 Log when the maximum number of concurrent DNS queries is
371 reached. Thanks to Marcelo Salhab Brogliato for the patch.
373 If wildcards are used in --interface, don't assume that
374 there will only ever be one available interface for DHCP
375 just because there is one at start-up. More may appear, so
376 we can't use SO_BINDTODEVICE. Thanks to Natrio for the bug
379 Increase timeout/number of retries in TFTP to accomodate
380 AudioCodes Voice Gateways doing streaming writes to flash.
381 Thanks to Damian Kaczkowski for spotting the problem.
383 Fix crash with empty DHCP string options when adding zero
384 terminator. Thanks to Patrick McLean for the bug report.
386 Allow hostnames to start with a number, as allowed in
387 RFC-1123. Thanks to Kyle Mestery for the patch.
389 Fixes to DHCP FQDN option handling: don't terminate FQDN
390 if domain not known and allow a FQDN option with blank
391 name to request that a FQDN option is returned in the
392 reply. Thanks to Roy Marples for the patch.
394 Make --clear-on-reload apply to setting upstream servers
397 When the address which triggered the construction of an
398 advertised IPv6 prefix disappears, continue to advertise
399 the prefix for up to 2 hours, with the preferred lifetime
400 set to zero. This satisfies RFC 6204 4.3 L-13 and makes
401 things work better if a prefix disappears without being
402 deprecated first. Thanks to Uwe Schindler for persuasively
405 Fix MAC address enumeration on *BSD. Thanks to Brad Smith
408 Support RFC-4242 information-refresh-time options in the
409 reply to DHCPv6 information-request. The lease time of the
410 smallest valid dhcp-range is sent. Thanks to Uwe Schindler
413 Make --listen-address higher priority than --except-interface
414 in all circumstances. Thanks to Thomas Hood for the bugreport.
416 Provide independent control over which interfaces get TFTP
417 service. If enable-tftp is given a list of interfaces, then TFTP
418 is provided on those. Without the list, the previous behaviour
419 (provide TFTP to the same interfaces we provide DHCP to)
420 is retained. Thanks to Lonnie Abelbeck for the suggestion.
422 Add --dhcp-relay config option. Many thanks to vtsl.net
423 for sponsoring this development.
425 Fix crash with empty tag: in --dhcp-range. Thanks to
426 Kaspar Schleiser for the bug report.
428 Add "baseline" and "bloatcheck" makefile targets, for
429 revealing size changes during development. Thanks to
430 Vladislav Grishenko for the patch.
432 Cope with DHCPv6 clients which send REQUESTs without
433 address options - treat them as SOLICIT with rapid commit.
435 Support identification of clients by MAC address in
436 DHCPv6. When using a relay, the relay must support RFC
437 6939 for this to work. It always works for directly
438 connected clients. Thanks to Vladislav Grishenko
439 for prompting this feature.
441 Remove the rule for constructed DHCP ranges that the local
442 address must be either the first or last address in the
443 range. This was originally to avoid SLAAC addresses, but
444 we now explicitly autoconfig and privacy addresses instead.
446 Update Polish translation. Thanks to Jan Psota.
448 Fix problem in DHCPv6 vendorclass/userclass matching
449 code. Thanks to Tanguy Bouzeloc for the patch.
451 Update Spanish transalation. Thanks to Vicente Soriano.
453 Add --ra-param option. Thanks to Vladislav Grishenko for
456 Add --add-subnet configuration, to tell upstream DNS
457 servers where the original client is. Thanks to DNSthingy
458 for sponsoring this feature.
460 Add --quiet-dhcp, --quiet-dhcp6 and --quiet-ra. Thanks to
461 Kevin Darbyshire-Bryant for the initial patch.
463 Allow A/AAAA records created by --interface-name to be the
464 target of --cname. Thanks to Hadmut Danisch for the
467 Avoid treating a --dhcp-host which has an IPv6 address
468 as eligable for use with DHCPv4 on the grounds that it has
469 no address, and vice-versa. Thanks to Yury Konovalov for
470 spotting the problem.
472 Do a better job caching dangling CNAMEs. Thanks to Yves
473 Dorfsman for spotting the problem.
477 Add the ability to act as an authoritative DNS
478 server. Dnsmasq can now answer queries from the wider 'net
479 with local data, as long as the correct NS records are set
480 up. Only local data is provided, to avoid creating an open
481 DNS relay. Zone transfer is supported, to allow secondary
482 servers to be configured.
484 Add "constructed DHCP ranges" for DHCPv6. This is intended
485 for IPv6 routers which get prefixes dynamically via prefix
486 delegation. With suitable configuration, stateful DHCPv6
487 and RA can happen automatically as prefixes are delegated
488 and then deprecated, without having to re-write the
489 dnsmasq configuration file or restart the daemon. Thanks to
490 Steven Barth for extensive testing and development work on
493 Fix crash on startup on Solaris 11. Regression probably
494 introduced in 2.61. Thanks to Geoff Johnstone for the
497 Add code to make behaviour for TCP DNS requests that same
498 as for UDP requests, when a request arrives for an allowed
499 address, but via a banned interface. This change is only
500 active on Linux, since the relevant API is missing (AFAIK)
501 on other platforms. Many thanks to Tomas Hozza for
502 spotting the problem, and doing invaluable discovery of
503 the obscure and undocumented API required for the solution.
505 Don't send the default DHCP option advertising dnsmasq as
506 the local DNS server if dnsmasq is configured to not act
507 as DNS server, or it's configured to a non-standard port.
509 Add DNSMASQ_CIRCUIT_ID, DNSMASQ_SUBCRIBER_ID,
510 DNSMASQ_REMOTE_ID variables to the environment of the
511 lease-change script (and the corresponding Lua). These hold
512 information inserted into the DHCP request by a DHCP relay
513 agent. Thanks to Lakefield Communications for providing a
514 bounty for this addition.
516 Fixed crash, introduced in 2.64, whilst handling DHCPv6
517 information-requests with some common configurations.
518 Thanks to Robert M. Albrecht for the bug report and
521 Add --ipset option. Thanks to Jason A. Donenfeld for the
524 Don't erroneously reject some option names in --dhcp-match
525 options. Thanks to Benedikt Hochstrasser for the bug report.
527 Allow a trailing '*' wildcard in all interface-name
528 configurations. Thanks to Christian Parpart for the patch.
530 Handle the situation where libc headers define
531 SO_REUSEPORT, but the kernel in use doesn't, to cope with
532 the introduction of this option to Linux. Thanks to Rich
533 Felker for the bug report.
535 Update Polish translation. Thanks to Jan Psota.
537 Fix crash if the configured DHCP lease limit is
538 reached. Regression occurred in 2.61. Thanks to Tsachi for
541 Update the French translation. Thanks to Gildas le Nadan.
545 Fix regression which broke forwarding of queries sent via
546 TCP which are not for A and AAAA and which were directed to
547 non-default servers. Thanks to Niax for the bug report.
549 Fix failure to build with DHCP support excluded. Thanks to
550 Gustavo Zacarias for the patch.
552 Fix nasty regression in 2.64 which completely broke cacheing.
556 Handle DHCP FQDN options with all flag bits zero and
557 --dhcp-client-update set. Thanks to Bernd Krumbroeck for
558 spotting the problem.
560 Finesse the check for /etc/hosts names which conflict with
561 DHCP names. Previously a name/address pair in /etc/hosts
562 which didn't match the name/address of a DHCP lease would
563 generate a warning. Now that only happesn if there is not
564 also a match. This allows multiple addresses for a name in
565 /etc/hosts with one of them assigned via DHCP.
567 Fix broken vendor-option processing for BOOTP. Thanks to
568 Hans-Joachim Baader for the bug report.
570 Don't report spurious netlink errors, regression in
571 2.63. Thanks to Vladislav Grishenko for the patch.
573 Flag DHCP or DHCPv6 in starup logging. Thanks to
574 Vladislav Grishenko for the patch.
576 Add SetServersEx method in DBus interface. Thanks to Dan
577 Williams for the patch.
579 Add SetDomainServers method in DBus interface. Thanks to
580 Roy Marples for the patch.
582 Fix build with later Lua libraries. Thansk to Cristian
583 Rodriguez for the patch.
585 Add --max-cache-ttl option. Thanks to Dennis Kaarsemaker
588 Fix breakage of --host-record parsing, resulting in
589 infinte loop at startup. Regression in 2.63. Thanks to
590 Haim Gelfenbeyn for spotting this.
592 Set SO_REUSEADDRESS and SO_V6ONLY options on the DHCPv6
593 socket, this allows multiple instances of dnsmasq on a
594 single machine, in the same way as for DHCPv4. Thanks to
595 Gene Czarcinski and Vladislav Grishenko for work on this.
597 Fix DHCPv6 to do access control correctly when it's
598 configured with --listen-address. Thanks to
599 Gene Czarcinski for sorting this out.
601 Add a "wildcard" dhcp-range which works for any IPv6
602 subnet, --dhcp-range=::,static Useful for Stateless
603 DHCPv6. Thanks to Vladislav Grishenko for the patch.
605 Don't include lease-time in DHCPACK replies to DHCPINFORM
606 queries, since RFC-2131 says we shouldn't. Thanks to
607 Wouter Ibens for pointing this out.
609 Makefile tweak to do dependency checking on header files.
610 Thanks to Johan Peeters for the patch.
612 Check interface for outgoing unsolicited router
613 advertisements, rather than relying on interface address
614 configuration. Thanks to Gene Czarinski for the patch.
616 Handle better attempts to transmit on interfaces which are
617 still doing DAD, and specifically do not just transmit
618 without setting source address and interface, since this
619 can cause very puzzling effects when a router
620 advertisement goes astray. Thanks again to Gene Czarinski.
622 Get RA timers right when there is more than one
623 dhcp-range on a subnet.
627 Do duplicate dhcp-host address check in --test mode.
629 Check that tftp-root directories are accessible before
630 start-up. Thanks to Daniel Veillard for the initial patch.
632 Allow more than one --tfp-root flag. The per-interface
633 stuff is pointless without that.
635 Add --bind-dynamic. A hybrid mode between the default and
636 --bind-interfaces which copes with dynamically created
639 A couple of fixes to the build system for Android. Thanks
640 to Metin Kaya for the patches.
642 Remove the interface:<interface> argument in --dhcp-range, and
643 the interface argument to --enable-tftp. These were a
644 still-born attempt to allow automatic isolated
645 configuration by libvirt, but have never (to my knowledge)
646 been used, had very strange semantics, and have been
647 superceded by other mechanisms.
649 Fixed bug logging filenames when duplicate dhcp-host
650 addresses are found. Thanks to John Hanks for the patch.
652 Fix regression in 2.61 which broke caching of CNAME
653 chains. Thanks to Atul Gupta for the bug report.
655 Allow the target of a --cname flag to be another --cname.
657 Teach DHCPv6 about the RFC 4242 information-refresh-time
658 option, and add parsing if the minutes, hours and days
659 format for options. Thanks to Francois-Xavier Le Bail for
662 Allow "w" (for week) as multiplier in lease times, as well
663 as seconds, minutes, hours and days. Álvaro Gámez Machado
664 spotted the ommission.
666 Update French translation. Thanks to Gildas Le Nadan.
668 Allow a DBus service name to be given with --enable-dbus
669 which overrides the default,
670 uk.org.thekelleys.dnsmasq. Thanks to Mathieu
671 Trudel-Lapierre for the patch.
673 Set the "prefix on-link" bit in Router
674 Advertisements. Thanks to Gui Iribarren for the patch.
678 Update German translation. Thanks to Conrad Kostecki.
680 Cope with router-solict packets wich don't have a valid
681 source address. Thanks to Vladislav Grishenko for the patch.
683 Fixed bug which caused missing periodic router
684 advertisements with some configurations. Thanks to
685 Vladislav Grishenko for the patch.
687 Fixed bug which broke DHCPv6/RA with prefix lengths
688 which are not divisible by 8. Thanks to Andre Coetzee
691 Fix non-response to router-solicitations when
692 router-advertisement configured, but DHCPv6 not
693 configured. Thanks to Marien Zwart for the patch.
695 Add --dns-rr, to allow arbitrary DNS resource records.
697 Fixed bug which broke RA scheduling when an interface had
698 two addresses in the same network. Thanks to Jim Bos for
699 his help nailing this.
702 Re-write interface discovery code on *BSD to use
703 getifaddrs. This is more portable, more straightforward,
704 and allows us to find the prefix length for IPv6
707 Add ra-names, ra-stateless and slaac keywords for DHCPv6.
708 Dnsmasq can now synthesise AAAA records for dual-stack
709 hosts which get IPv6 addresses via SLAAC. It is also now
710 possible to use SLAAC and stateless DHCPv6, and to
711 tell clients to use SLAAC addresses as well as DHCP ones.
712 Thanks to Dave Taht for help with this.
714 Add --dhcp-duid to allow DUID-EN uids to be used.
716 Explicity send DHCPv6 replies to the correct port, instead
717 of relying on clients to send requests with the correct
718 source address, since at least one client in the wild gets
719 this wrong. Thanks to Conrad Kostecki for help tracking
722 Send a preference value of 255 in DHCPv6 replies when
723 --dhcp-authoritative is in effect. This tells clients not
724 to wait around for other DHCP servers.
726 Better logging of DHCPv6 options.
728 Add --host-record. Thanks to Rob Zwissler for the
731 Invoke the DHCP script with action "tftp" when a TFTP file
732 transfer completes. The size of the file, address to which
733 it was sent and complete pathname are supplied. Note that
734 version 2.60 introduced some script incompatibilties
735 associated with DHCPv6, and this is a further change. To
736 be safe, scripts should ignore unknown actions, and if
737 not IPv6-aware, should exit if the environment
738 variable DNSMASQ_IAID is set. The use-case for this is
739 to track netboot/install. Suggestion from Shantanu
742 Update contrib/port-forward/dnsmasq-portforward to reflect
745 Set the environment variable DNSMASQ_LOG_DHCP when running
746 the script id --log-dhcp is in effect, so that script can
747 taylor their logging verbosity. Suggestion from Malte
750 Arrange that addresses specified with --listen-address
751 work even if there is no interface carrying the
752 address. This is chiefly useful for IPv4 loopback
753 addresses, where any address in 127.0.0.0/8 is a valid
754 loopback address, but normally only 127.0.0.1 appears on
755 the lo interface. Thanks to Mathieu Trudel-Lapierre for
756 the idea and initial patch.
758 Fix crash, introduced in 2.60, when a DHCPINFORM is
759 received from a network which has no valid dhcp-range.
760 Thanks to Stephane Glondu for the bug report.
762 Add a new DHCP lease time keyword, "deprecated" for
763 --dhcp-range. This is only valid for IPv6, and sets the
764 preffered lease time for both DHCP and RA to zero. The
765 effect is that clients can continue to use the address
766 for existing connections, but new connections will use
767 other addresses, if they exist. This makes hitless
768 renumbering at least possible.
770 Fix bug in address6_available() which caused DHCPv6 lease
771 aquisition to fail if more than one dhcp-range in use.
773 Provide RDNSS and DNSSL data in router advertisements,
774 using the settings provided for DHCP options
775 option6:domain-search and option6:dns-server.
777 Tweak logo/favicon.ico to add some transparency. Thanks to
778 SamLT for work on this.
780 Don't cache data from non-recursive nameservers, since it
781 may erroneously look like a valid CNAME to a non-exitant
782 name. Thanks to Ben Winslow for finding this.
784 Call SO_BINDTODEVICE on the DHCP socket(s) when doing DHCP
785 on exactly one interface and --bind-interfaces is set. This
786 makes the OpenStack use-case of one dnsmasq per virtual
787 interface work. This is only available on Linux; it's not
788 supported on other platforms. Thanks to Vishvananda Ishaya
789 and the OpenStack team for the suggestion.
791 Updated French translation. Thanks to Gildas Le Nadan.
793 Give correct from-cache answers to explict CNAME queries.
794 Thanks to Rob Zwissler for spotting this.
796 Add --tftp-lowercase option. Thanks to Oliver Rath for the
799 Ensure that the DBus DhcpLeaseUpdated events are generated
800 when a lease goes through INIT_REBOOT state, even if the
801 dhcp-script is not in use. Thanks to Antoaneta-Ecaterina
804 Fix failure of TFTP over IPv4 on OpenBSD platform. Thanks
805 to Brad Smith for spotting this.
809 Fix compilation problem in Mac OS X Lion. Thanks to Olaf
810 Flebbe for the patch.
812 Fix DHCP when using --listen-address with an IP address
813 which is not the primary address of an interface.
815 Add --dhcp-client-update option.
817 Add Lua integration. Dnsmasq can now execute a DHCP
818 lease-change script written in Lua. This needs to be
819 enabled at compile time by setting HAVE_LUASCRIPT in
820 src/config.h or running "make COPTS=-DHAVE_LUASCRIPT"
821 Thanks to Jan-Piet Mens for the idea and proof-of-concept
824 Tidied src/config.h to distinguish between
825 platform-dependent compile-time options which are selected
826 automatically, and builder-selectable compile time
827 options. Document the latter better, and describe how to
828 set them from the make command line.
830 Tidied up IPPROTO_IP/SOL_IP (and IPv6 equivalent)
831 confusion. IPPROTO_IP works everywhere now.
833 Set TOS on DHCP sockets, this improves things on busy
834 wireless networks. Thanks to Dave Taht for the patch.
836 Determine VERSION automatically based on git magic:
837 release tags or hash values.
839 Improve start-up speed when reading large hosts files
840 containing many distinct addresses.
842 Fix problem if dnsmasq is started without the stdin,
843 stdout and stderr file descriptors open. This can manifest
844 itself as 100% CPU use. Thanks to Chris Moore for finding
847 Fix shell-scripting bug in bld/pkg-wrapper. Thanks to
848 Mark Mitchell for the patch.
850 Allow the TFP server or boot server in --pxe-service, to
851 be a domain name instead of an IP address. This allows for
852 round-robin to multiple servers, in the same way as
853 --dhcp-boot. A good suggestion from Cristiano Cumer.
855 Support BUILDDIR variable in the Makefile. Allows builds
856 for multiple archs from the same source tree with eg.
857 make BUILDDIR=linux (relative to dnsmasq tree)
858 make BUILDDIR=/tmp/openbsd (absolute path)
859 If BUILDDIR is not set, compilation happens in the src
860 directory, as before. Suggestion from Mark Mitchell.
862 Support DHCPv6. Support is there for the sort of things
863 the existing v4 server does, including tags, options,
864 static addresses and relay support. Missing is prefix
865 delegation, which is probably not required in the dnsmasq
866 niche, and an easy way to accept prefix delegations from
867 an upstream DHCPv6 server, which is. Future plans include
868 support for DHCPv6 router option and MAC address option
869 (to make selecting clients by MAC address work like IPv4).
870 These will be added as the standards mature.
871 This code has been tested, but this is the first release,
872 so don't bet the farm on it just yet. Many thanks to all
873 testers who have got it this far.
875 Support IPv6 router advertisements. This is a
876 simple-minded implementation, aimed at providing the
877 vestigial RA needed to go alongside IPv6. Is picks up
878 configuration from the DHCPv6 conf, and should just need
879 enabling with --enable-ra.
881 Fix long-standing wrinkle with --localise-queries that
882 could result in wrong answers when DNS packets arrive
883 via an interface other than the expected one. Thanks to
884 Lorenzo Milesi and John Hanks for spotting this one.
886 Update French translation. Thanks to Gildas Le Nadan.
888 Update Polish translation. Thanks to Jan Psota.
892 Fix regression in 2.58 which caused failure to start up
893 with some combinations of dnsmasq config and IPv6 kernel
894 network config. Thanks to Brielle Bruns for the bug
897 Improve dnsmasq's behaviour when network interfaces are
898 still doing duplicate address detection (DAD). Previously,
899 dnsmasq would wait up to 20 seconds at start-up for the
900 DAD state to terminate. This is broken for bridge
901 interfaces on recent Linux kernels, which don't start DAD
902 until the bridge comes up, and so can take arbitrary
903 time. The new behaviour lets dnsmasq poll for an arbitrary
904 time whilst providing service on other interfaces. Thanks
905 to Stephen Hemminger for pointing out the problem.
909 Provide a definition of the SA_SIZE macro where it's
910 missing. Fixes build failure on openBSD.
912 Don't include a zero terminator at the end of messages
913 sent to /dev/log when /dev/log is a datagram socket.
914 Thanks to Didier Rabound for spotting the problem.
916 Add --dhcp-sequential-ip flag, to force allocation of IP
917 addresses in ascending order. Note that the default
918 pseudo-random mode is in general better but some
919 server-deployment applications need this.
921 Fix problem where a server-id of 0.0.0.0 is sent to a
922 client when a dhcp-relay is in use if a client renews a
923 lease after dnsmasq restart and before any clients on the
924 subnet get a new lease. Thanks to Mike Ruiz for assistance
925 in chasing this one down.
927 Don't return NXDOMAIN to an AAAA query if we have CNAME
928 which points to an A record only: NODATA is the correct
929 reply in this case. Thanks to Tom Fernandes for spotting
932 Relax the need to supply a netmask in --dhcp-range for
933 networks which use a DHCP relay. Whilst this is still
934 desireable, in the absence of a netmask dnsmasq will use
935 a default based on the class (A, B, or C) of the address.
936 This should at least remove a cause of mysterious failure
937 for people using RFC1918 addresses and relays.
939 Add support for Linux conntrack connection marking. If
940 enabled with --conntrack, the connection mark for incoming
941 DNS queries will be copied to the outgoing connections
942 used to answer those queries. This allows clever firewall
943 and accounting stuff. Only available if dnsmasq is
944 compiled with HAVE_CONNTRACK and adds a dependency on
945 libnetfilter-conntrack. Thanks to Ed Wildgoose for the
946 initial idea, testing and sponsorship of this function.
948 Provide a sane error message when someone attempts to
949 match a tag in --dhcp-host.
951 Tweak the behaviour of --domain-needed, to avoid problems
952 with recursive nameservers downstream of dnsmasq. The new
953 behaviour only stops A and AAAA queries, and returns
954 NODATA rather than NXDOMAIN replies.
956 Efficiency fix for very large DHCP configurations, thanks
957 to James Gartrell and Mike Ruiz for help with this.
959 Allow the TFTP-server address in --dhcp-boot to be a
960 domain-name which is looked up in /etc/hosts. This can
961 give multiple IP addresses which are used round-robin,
962 thus doing TFTP server load-balancing. Thanks to Sushil
963 Agrawal for the patch.
965 When two tagged dhcp-options for a particular option
966 number are both valid, use the one which is valid without
967 a tag from the dhcp-range. Allows overriding of the value
968 of a DHCP option for a particular host as well as
969 per-network values. So
970 --dhcp-range=set:interface1,......
971 --dhcp-host=set:myhost,.....
972 --dhcp-option=tag:interface1,option:nis-domain,"domain1"
973 --dhcp-option=tag:myhost,option:nis-domain,"domain2"
974 will set the NIS-domain to domain1 for hosts in the range, but
975 override that to domain2 for a particular host.
977 Fix bug which resulted in truncated files and timeouts for
978 some TFTP transfers. The bug only occurs with netascii
979 transfers and needs an unfortunate relationship between
980 file size, blocksize and the number of newlines in the
981 last block before it manifests itself. Many thanks to
982 Alkis Georgopoulos for spotting the problem and providing
983 a comprehensive test-case.
985 Fix regression in TFTP server on *BSD platforms introduced
986 in version 2.56, due to confusion with sockaddr
987 length. Many thanks to Loic Pefferkorn for finding this.
989 Support scope-ids in IPv6 addresses of nameservers from
990 /etc/resolv.conf and in --server options. Eg
991 nameserver fe80::202:a412:4512:7bbf%eth0 or
992 server=fe80::202:a412:4512:7bbf%eth0. Thanks to
993 Michael Stapelberg for the suggestion.
995 Update Polish translation, thanks to Jan Psota.
997 Update French translation. Thanks to Gildas Le Nadan.
1001 Add patches to allow build under Android.
1003 Provide our own header for the DNS protocol, rather than
1004 relying on arpa/nameser.h. This has proved more or less
1005 defective over the years and the final straw is that it's
1006 effectively empty on Android.
1008 Fix regression in 2.56 which caused hex constants in
1009 configuration to be rejected if they contain the '*'
1012 Correct wrong casts of arguments to ctype.h functions,
1013 isdigit(), isxdigit() etc. Thanks to Matthias Andree for
1016 Allow build with IDN support independently from i18n.
1017 IDN support continues to be included automatically
1018 when i18n is included.
1019 'make COPTS=-DHAVE_IDN' is the magic incantation.
1021 Modify check on extraneous command line junk (added in
1022 2.56) so that it doesn't complain about extra _empty_
1023 arguments. Otherwise this breaks libvirt.
1027 Add a patch to allow dnsmasq to get interface names right in a
1028 Solaris zone. Thanks to Dj Padzensky for this.
1030 Improve data-type parsing heuristics so that
1031 --dhcp-option=option:domain-search,.
1032 treats the value as a string and not an IP address.
1033 Thanks to Clemens Fischer for spotting that.
1035 Add IPv6 support to the TFTP server. Many thanks to Jan
1036 'RedBully' Seiffert for the patches.
1038 Log DNS queries at level LOG_INFO, rather then
1039 LOG_DEBUG. This makes things consistent with DHCP
1040 logging. Thanks to Adam Pribyl for spotting the problem.
1042 Ensure that dnsmasq terminates cleanly when using
1043 --syslog-async even if it cannot make a connection to the
1046 Add --add-mac option. This is to support currently
1047 experimental DNS filtering facilities. Thanks to Benjamin
1048 Petrin for the orignal patch.
1050 Fix bug which meant that tags were ignored in dhcp-range
1051 configuration specifying PXE-proxy service. Thanks to
1052 Cristiano Cumer for spotting this.
1054 Raise an error if there is extra junk, not part of an
1055 option, on the command line.
1057 Flag a couple of log messages in cache.c as coming from
1058 the DHCP subsystem. Thanks to Olaf Westrik for the patch.
1060 Omit timestamps from logs when a) logging to stderr and
1061 b) --keep-in-forground is set. The logging facility on the
1062 other end of stderr can be assumned to supply them. Thanks
1063 to John Hallam for the patch.
1065 Don't complain about strings longer than 255 characters in
1066 --txt-record, just split the long strings into 255
1067 character chunks instead.
1069 Fix crash on double-free. This bug can only happen when
1070 dhcp-script is in use and then only in rare circumstances
1071 triggered by high DHCP transaction rate and a slow
1072 script. Thanks to Ferenc Wagner for finding the problem.
1074 Only log that a file has been sent by TFTP after the
1075 transfer has completed succesfully.
1077 A good suggestion from Ferenc Wagner: extend
1078 the --domain option to allow this sort of thing:
1079 --domain=thekelleys.org.uk,192.168.0.0/24,local
1080 which automatically creates
1081 --local=/thekelleys.org.uk/
1082 --local=/0.168.192.in-addr.arpa/
1084 Tighten up syntax checking of hex contants in the config
1085 file. Thanks to Fred Damen for spotting this.
1087 Add dnsmasq logo/icon, contributed by Justin Swift. Many
1090 Never cache DNS replies which have the 'cd' bit set, or
1091 which result from queries forwarded with the 'cd' bit
1092 set. The 'cd' bit instructs a DNSSEC validating server
1093 upstream to ignore signature failures and return replies
1094 anyway. Without this change it's possible to pollute the
1095 dnsmasq cache with bad data by making a query with the
1096 'cd' bit set and subsequent queries would return this data
1097 without its being marked as suspect. Thanks to Anders
1098 Kaseorg for pointing out this problem.
1100 Add --proxy-dnssec flag, for compliance with RFC
1101 4035. Dnsmasq will now clear the 'ad' bit in answers returned
1102 from upstream validating nameservers unless this option is
1105 Allow a filename of "-" for --conf-file to read
1106 stdin. Suggestion from Timothy Redaelli.
1108 Rotate the order of SRV records in replies, to provide
1109 round-robin load balancing when all the priorities are
1110 equal. Thanks to Peter McKinney for the suggestion.
1113 contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist
1114 so that it doesn't log all queries to a file by
1115 default. Thanks again to Peter McKinney.
1117 By default, setting an IPv4 address for a domain but not
1118 an IPv6 address causes dnsmasq to return
1119 an NODATA reply for IPv6 (or vice-versa). So
1120 --address=/google.com/1.2.3.4 stops IPv6 queries for
1121 *google.com from being forwarded. Make it possible to
1122 override this behaviour by defining the sematics if the
1123 same domain appears in both --server and --address.
1124 In that case, the --address has priority for the address
1125 family in which is appears, but the --server has priority
1126 of the address family which doesn't appear in --adddress
1128 --address=/google.com/1.2.3.4
1129 --server=/google.com/#
1130 will return 1.2.3.4 for IPv4 queries for *.google.com but
1131 forward IPv6 queries to the normal upstream nameserver.
1132 Similarly when setting an IPv6 address
1133 only this will allow forwarding of IPv4 queries. Thanks to
1134 William for pointing out the need for this.
1136 Allow more than one --dhcp-optsfile and --dhcp-hostsfile
1137 and make them understand directories as arguments in the
1138 same way as --addn-hosts. Suggestion from John Hanks.
1140 Ignore rebinding requests for leases we don't know
1141 about. Rebind is broadcast, so we might get to overhear a
1142 request meant for another DHCP server. NAKing this is
1143 wrong. Thanks to Brad D'Hondt for assistance with this.
1145 Fix cosmetic bug which produced strange output when
1146 dumping cache statistics with some configurations. Thanks
1147 to Fedor Kozhevnikov for spotting this.
1151 Fix crash when /etc/ethers is in use. Thanks to
1152 Gianluigi Tiesi for finding this.
1154 Fix crash in netlink_multicast(). Thanks to Arno Wald for
1157 Allow the empty domain "." in dhcp domain-search (119)
1162 There is no version 2.54 to avoid confusion with 2.53,
1163 which incorrectly identifies itself as 2.54.
1167 Fix failure to compile on Debian/kFreeBSD. Thanks to
1168 Axel Beckert and Petr Salinger.
1170 Fix code to avoid scary strict-aliasing warnings
1171 generated by gcc 4.4.
1173 Added FAQ entry warning about DHCP failures with Vista
1174 when firewalls block 255.255.255.255.
1176 Fixed bug which caused bad things to happen if a
1177 resolv.conf file which exists is subsequently removed.
1178 Thanks to Nikolai Saoukh for the patch.
1180 Rationalised the DHCP tag system. Every configuration item
1181 which can set a tag does so by adding "set:<tag>" and
1182 every configuration item which is conditional on a tag is
1183 made so by "tag:<tag>". The NOT operator changes to '!',
1184 which is a bit more intuitive too. Dhcp-host directives
1185 can set more than one tag now. The old '#' NOT,
1186 "net:" prefix and no-prefixes are still honoured, so
1187 no existing config file needs to be changed, but
1188 the documentation and new-style config files should be
1189 much less confusing.
1191 Added --tag-if to allow boolean operations on tags.
1192 This allows complicated logic to be clearer and more
1193 general. A great suggestion from Richard Voigt.
1195 Add broadcast/unicast information to DHCP logging.
1197 Allow --dhcp-broadcast to be unconditional.
1199 Fixed incorrect behaviour with NOT <tag> conditionals in
1200 dhcp-options. Thanks to Max Turkewitz for assistance
1203 If we send vendor-class encapsulated options based on the
1204 vendor-class supplied by the client, and no explicit
1205 vendor-class option is given, echo back the vendor-class
1208 Fix bug which stopped dnsmasq from matching both a
1209 circuitid and a remoteid. Thanks to Ignacio Bravo for
1212 Add --dhcp-proxy, which makes it possible to configure
1213 dnsmasq to use a DHCP relay agent as a full proxy, with
1214 all DHCP messages passing through the proxy. This is
1215 useful if the relay adds extra information to the packets
1216 it forwards, but cannot be configured with the RFC 5107
1217 server-override option.
1219 Added interface:<iface name> part to dhcp-range. The
1220 semantics of this are very odd at first sight, but it
1221 allows a single line of the form
1222 dhcp-range=interface:virt0,192.168.0.4,192.168.0.200
1223 to be added to dnsmasq configuration which then supplies
1224 DHCP and DNS services to that interface, without affecting
1225 what services are supplied to other interfaces and
1226 irrespective of the existance or lack of
1227 interface=<interface>
1228 lines elsewhere in the dnsmasq configuration. The idea is
1229 that such a line can be added automatically by libvirt
1230 or equivalent systems, without disturbing any manual
1233 Similarly to the above, allow --enable-tftp=<interface>
1235 Allow a TFTP root to be set separately for requests via
1236 different interfaces, --tftp-root=<path>,<interface>
1238 Correctly handle and log clashes between CNAMES and
1239 DNS names being given to DHCP leases. This fixes a bug
1240 which caused nonsense IP addresses to be logged. Thanks to
1241 Sergei Zhirikov for finding and analysing the problem.
1243 Tweak flush_log so as to avoid leaving the log
1244 file in non-blocking mode. O_NONBLOCK is a property of the
1245 file, not the process/descriptor.
1247 Fix contrib/Solaris10/create_package
1248 (/usr/man -> /usr/share/man) Thanks to Vita Batrla.
1250 Fix a problem where, if a client got a lease, then went
1251 to another subnet and got another lease, then moved back,
1252 it couldn't resume the old lease, but would instead get
1253 a new address. Thanks to Leonardo Rodrigues for spotting
1254 this and testing the fix.
1256 Fix weird bug which sometimes omitted certain characters
1257 from the start of quoted strings in dhcp-options. Thanks
1258 to Dayton Turner for spotting the problem.
1260 Add facility to redirect some domains to the standard
1261 upstream servers: this allows something like
1262 --server=/google.com/1.2.3.4 --server=/www.google.com/#
1263 which will send queries for *.google.com to 1.2.3.4,
1264 except *www.google.com which will be forwarded as usual.
1265 Thanks to AJ Weber for prompting this addition.
1267 Improve the hash-algorithm used to generate IP addresses
1268 from MAC addresses during initial DHCP address
1269 allocation. This improves performance when large numbers
1270 of hosts with similar MAC addresses all try and get an IP
1271 address at the same time. Thanks to Paul Smith for his
1274 Tweak DHCP code so that --bridge-interface can be used to
1275 select which IP alias of an interface should be used for
1276 DHCP purposes on Linux. If eth0 has an alias eth0:dhcp
1277 then adding --bridge-interface=eth0:dhcp,eth0 will use
1278 the address of eth0:dhcp to determine the correct subnet
1279 for DHCP address allocation. Thanks to Pawel Golaszewski
1280 for prompting this and Eric Cooper for further testing.
1282 Add --dhcp-generate-names. Suggestion by Ferenc Wagner.
1284 Tweak DNS server selection algorithm when there is more
1285 than one server available for a domain, eg.
1286 --server=/mydomain/1.1.1.1
1287 --server=/mydomain/2.2.2.2
1288 Thanks to Alberto Cuesta-Canada for spotting a weakness
1291 Add --max-ttl. Thanks to Fredrik Ringertz for the patch.
1293 Allow --log-facility=- to force all logging to
1294 stderr. Suggestion from Clemens Fischer.
1296 Fix regression which caused configuration like
1297 --address=/.domain.com/1.2.3.4 to be rejected. The dot to the
1298 left of the domain has been implied and not required for a
1299 long time, but it should be accepted for backward
1300 compatibility. Thanks to Andrew Burcin for spotting this.
1302 Add --rebind-domain-ok and --rebind-localhost-ok.
1303 Suggestion from Clemens Fischer.
1305 Log replies to queries of type TXT, when --log-queries
1308 Fix compiler warnings when compiled with -DNO_DHCP. Thanks
1309 to Shantanu Gadgil for the patch.
1311 Updated French translation. Thanks to Gildas Le Nadan.
1313 Updated Polish translation. Thanks to Jan Psota.
1315 Updated German translation. Thanks to Matthias Andree.
1317 Added contrib/static-arp, thanks to Darren Hoo.
1319 Fix corruption of the domain when a name from /etc/hosts
1320 overrides one supplied by a DHCP client. Thanks to Fedor
1321 Kozhevnikov for spotting the problem.
1323 Updated Spanish translation. Thanks to Chris Chatham.
1327 Work around a Linux kernel bug which insists that the
1328 length of the option passed to setsockopt must be at least
1329 sizeof(int) bytes, even if we're calling SO_BINDTODEVICE
1330 and the device name is "lo". Note that this is fixed
1331 in kernel 2.6.31, but the workaround is harmless and
1332 allows earlier kernels to be used. Also fix dnsmasq
1333 bug which reported the wrong address when this failed.
1334 Thanks to Fedor for finding this.
1336 The API for IPv6 PKTINFO changed around Linux kernel
1337 2.6.14. Workaround the case where dnsmasq is compiled
1338 against newer headers, but then run on an old kernel:
1339 necessary for some *WRT distros.
1341 Re-read the set of network interfaces when re-loading
1342 /etc/resolv.conf if --bind-interfaces is not set. This
1343 handles the case that loopback interfaces do not exist
1344 when dnsmasq is first started.
1346 Tweak the PXE code to support port 4011. This should
1347 reduce broadcasts and make things more reliable when other
1348 servers are around. It also improves inter-operability
1349 with certain clients.
1351 Make a pxe-service configuration with no filename or boot
1352 service type legal: this does a local boot. eg.
1353 pxe-service=x86PC, "Local boot"
1355 Be more conservative in detecting "A for A"
1356 queries. Dnsmasq checks if the name in a type=A query looks
1357 like a dotted-quad IP address and answers the query itself
1358 if so, rather than forwarding it. Previously dnsmasq
1359 relied in the library function inet_addr() to convert
1360 addresses, and that will accept some things which are
1361 confusing in this context, like 1.2.3 or even just
1362 1234. Now we only do A for A processing for four decimal
1363 numbers delimited by dots.
1365 A couple of tweaks to fix compilation on Solaris. Thanks
1366 to Joel Macklow for help with this.
1368 Another Solaris compilation tweak, needed for Solaris
1369 2009.06. Thanks to Lee Essen for that.
1371 Added extract packaging stuff from Lee Essen to
1374 Increased the default limit on number of leases to 1000
1375 (from 150). This is mainly a defence against DoS attacks,
1376 and for the average "one for two class C networks"
1377 installation, IP address exhaustion does that just as
1378 well. Making the limit greater than the number of IP
1379 addresses available in such an installation removes a
1380 surprise which otherwise can catch people out.
1382 Removed extraneous trailing space in the value of the
1383 DNSMASQ_TIME_REMAINING DNSMASQ_LEASE_LENGTH and
1384 DNSMASQ_LEASE_EXPIRES environment variables. Thanks to
1385 Gildas Le Nadan for spotting this.
1387 Provide the network-id tags for a DHCP transaction to
1388 the lease-change script in the environment variable
1389 DNSMASQ_TAGS. A good suggestion from Gildas Le Nadan.
1391 Add support for RFC3925 "Vendor-Identifying Vendor
1392 Options". The syntax looks like this:
1393 --dhcp-option=vi-encap:<enterprise number>, .........
1395 Add support to --dhcp-match to allow matching against
1396 RFC3925 "Vendor-Identifying Vendor Classes". The syntax
1398 --dhcp-match=tag,vi-encap<enterprise number>, <value>
1400 Add some application specific code to assist in
1401 implementing the Broadband forum TR069 CPE-WAN
1402 specification. The details are in contrib/CPE-WAN/README
1404 Increase the default DNS packet size limit to 4096, as
1405 recommended by RFC5625 section 4.4.3. This can be
1406 reconfigured using --edns-packet-max if needed. Thanks to
1407 Francis Dupont for pointing this out.
1409 Rewrite query-ids even for TSIG signed packets, since
1410 this is allowed by RFC5625 section 4.5.
1412 Use getopt_long by default on OS X. It has been supported
1413 since version 10.3.0. Thanks to Arek Dreyer for spotting
1416 Added up-to-date startup configuration for MacOSX/launchd
1417 in contrib/MacOSX-launchd. Thanks to Arek Dreyer for
1420 Fix link error when including Dbus but excluding DHCP.
1421 Thanks to Oschtan for the bug report.
1423 Updated French translation. Thanks to Gildas Le Nadan.
1425 Updated Polish translation. Thanks to Jan Psota.
1427 Updated Spanish translation. Thanks to Chris Chatham.
1429 Fixed confusion about domains, when looking up DHCP hosts
1430 in /etc/hosts. This could cause spurious "Ignoring
1431 domain..." messages. Thanks to Fedor Kozhevnikov for
1432 finding and analysing the problem.
1436 Add support for internationalised DNS. Non-ASCII characters
1437 in domain names found in /etc/hosts, /etc/ethers and
1438 /etc/dnsmasq.conf will be correctly handled by translation to
1439 punycode, as specified in RFC3490. This function is only
1440 available if dnsmasq is compiled with internationalisation
1441 support, and adds a dependency on GNU libidn. Without i18n
1442 support, dnsmasq continues to be compilable with just
1443 standard tools. Thanks to Yves Dorfsman for the
1446 Add two more environment variables for lease-change scripts:
1447 First, DNSMASQ_SUPPLIED_HOSTNAME; this is set to the hostname
1448 supplied by a client, even if the actual hostname used is
1449 over-ridden by dhcp-host or dhcp-ignore-names directives.
1450 Also DNSMASQ_RELAY_ADDRESS which gives the address of
1451 a DHCP relay, if used.
1452 Suggestions from Michael Rack.
1454 Fix regression which broke echo of relay-agent
1455 options. Thanks to Michael Rack for spotting this.
1457 Don't treat option 67 as being interchangeable with
1458 dhcp-boot parameters if it's specified as
1461 Make the code to call scripts on lease-change compile-time
1462 optional. It can be switched off by editing src/config.h
1463 or building with "make COPTS=-DNO_SCRIPT".
1465 Make the TFTP server cope with filenames from Windows/DOS
1466 which use '\' as pathname separator. Thanks to Ralf for
1469 Updated Polish translation. Thanks to Jan Psota.
1471 Warn if an IP address is duplicated in /etc/ethers. Thanks
1472 to Felix Schwarz for pointing this out.
1474 Teach --conf-dir to take an option list of file suffices
1475 which will be ignored when scanning the directory. Useful
1476 for backup files etc. Thanks to Helmut Hullen for the
1479 Add new DHCP option named tftpserver-address, which
1480 corresponds to the third argument of dhcp-boot. This
1481 allows the complete functionality of dhcp-boot to be
1482 replicated with dhcp-option. Useful when using
1485 Test which upstream nameserver to use every 10 seconds
1486 or 50 queries and not just when a query times out and
1487 is retried. This should improve performance when there
1488 is a slow nameserver in the list. Thanks to Joe for the
1491 Don't do any PXE processing, even for clients with the
1492 correct vendorclass, unless at least one pxe-prompt or
1493 pxe-service option is given. This stops dnsmasq
1494 interfering with proxy PXE subsystems when it is just
1495 the DHCP server. Thanks to Spencer Clark for spotting this.
1497 Limit the blocksize used for TFTP transfers to a value
1498 which avoids packet fragmentation, based on the MTU of the
1499 local interface. Many netboot ROMs can't cope with
1502 Honour dhcp-ignore configuration for PXE and proxy-PXE
1503 requests. Thanks to Niels Basjes for the bug report.
1505 Updated French translation. Thanks to Gildas Le Nadan.
1509 Fix security problem which allowed any host permitted to
1510 do TFTP to possibly compromise dnsmasq by remote buffer
1511 overflow when TFTP enabled. Thanks to Core Security
1512 Technologies and Iván Arce, Pablo Hernán Jorge, Alejandro
1513 Pablo Rodriguez, Martín Coco, Alberto Soliño Testa and
1514 Pablo Annetta. This problem has Bugtraq id: 36121
1517 Fix a problem which allowed a malicious TFTP client to
1518 crash dnsmasq. Thanks to Steve Grubb at Red Hat for
1519 spotting this. This problem has Bugtraq id: 36120 and
1524 Fix regression in 2.48 which disables the lease-change
1525 script. Thanks to Jose Luis Duran for spotting this.
1527 Log TFTP "file not found" errors. These were not logged,
1528 since a normal PXELinux boot generates many of them, but
1529 the lack of the messages seems to be more confusing than
1530 routinely seeing them when there is no real error.
1532 Update Spanish translation. Thanks to Chris Chatham.
1536 Archived the extensive, backwards, changelog to
1537 CHANGELOG.archive. The current changelog now runs from
1538 version 2.43 and runs conventionally.
1540 Fixed bug which broke binding of servers to physical
1541 interfaces when interface names were longer than four
1542 characters. Thanks to MURASE Katsunori for the patch.
1544 Fixed netlink code to check that messages come from the
1545 correct source, and not another userspace process. Thanks
1546 to Steve Grubb for the patch.
1548 Maintainability drive: removed bug and missing feature
1549 workarounds for some old platforms. Solaris 9, OpenBSD
1550 older than 4.1, Glibc older than 2.2, Linux 2.2.x and
1551 DBus older than 1.1.x are no longer supported.
1553 Don't read included configuration files more than once:
1554 allows complex configuration structures without problems.
1556 Mark log messages from the various subsystems in dnsmasq:
1557 messages from the DHCP subsystem now have the ident string
1558 "dnsmasq-dhcp" and messages from TFTP have ident
1559 "dnsmasq-tftp". Thanks to Olaf Westrik for the patch.
1561 Fix possible infinite DHCP protocol loop when an IP
1562 address nailed to a hostname (not a MAC address) and a
1563 host sometimes provides the name, sometimes not.
1565 Allow --addn-hosts to take a directory: all the files
1566 in the directory are read. Thanks to Phil Cornelius for
1569 Support --bridge-interface on all platforms, not just BSD.
1571 Added support for advanced PXE functions. It's now
1572 possible to define a prompt and menu options which will
1573 be displayed when a client PXE boots. It's also possible to
1574 hand-off booting to other boot servers. Proxy-DHCP, where
1575 dnsmasq just supplies the PXE information and another DHCP
1576 server does address allocation, is also allowed. See the
1577 --pxe-prompt and --pxe-service keywords. Thanks to
1578 Alkis Georgopoulos for the suggestion and Guilherme Moro
1579 and Michael Brown for assistance.
1581 Improvements to DHCP logging. Thanks to Tom Metro for
1584 Add ability to build dnsmasq without DHCP support. To do
1585 this, edit src/config.h or build with
1586 "make COPTS=-DNO_DHCP". Thanks to Mahavir Jain for the patch.
1588 Added --test command-line switch - syntax check
1589 configuration files only.
1591 Updated French translation. Thanks to Gildas Le Nadan.
1595 Updated French translation. Thanks to Gildas Le Nadan.
1597 Fixed interface enumeration code to work on NetBSD
1598 5.0. Thanks to Roy Marples for the patch.
1600 Updated config.h to use the same location for the lease
1601 file on NetBSD as the other *BSD variants. Also allow
1602 LEASEFILE and CONFFILE symbols to be overriden in CFLAGS.
1604 Handle duplicate address detection on IPv6 more
1605 intelligently. In IPv6, an interface can have an address
1606 which is not usable, because it is still undergoing DAD
1607 (such addresses are marked "tentative"). Attempting to
1608 bind to an address in this state returns an error,
1609 EADDRNOTAVAIL. Previously, on getting such an error,
1610 dnsmasq would silently abandon the address, and never
1611 listen on it. Now, it retries once per second for 20
1612 seconds before generating a fatal error. 20 seconds should
1613 be long enough for any DAD process to complete, but can be
1614 adjusted in src/config.h if necessary. Thanks to Martin
1615 Krafft for the bug report.
1617 Add DBus introspection. Patch from Jeremy Laine.
1619 Update Dbus configuration file. Patch from Colin Walters.
1621 http://bugs.freedesktop.org/show_bug.cgi?id=18961
1623 Support arbitrarily encapsulated DHCP options, suggestion
1624 and initial patch from Samium Gromoff. This is useful for
1625 (eg) gPXE, which expect all its private options to be
1626 encapsulated inside a single option 175. So, eg,
1628 dhcp-option = encap:175, 190, "iscsi-client0"
1629 dhcp-option = encap:175, 191, "iscsi-client0-secret"
1631 will provide iSCSI parameters to gPXE.
1633 Enhance --dhcp-match to allow testing of the contents of a
1634 client-sent option, as well as its presence. This
1635 application in mind for this is RFC 4578
1636 client-architecture specifiers, but it's generally useful.
1637 Joey Korkames suggested the enhancement.
1639 Move from using the IP_XMIT_IF ioctl to IP_BOUND_IF on
1640 OpenSolaris. Thanks to Bastian Machek for the heads-up.
1642 No longer complain about blank lines in
1643 /etc/ethers. Thanks to Jon Nelson for the patch.
1645 Fix binding of servers to physical devices, eg
1646 --server=/domain/1.2.3.4@eth0 which was broken from 2.43
1647 onwards unless --query-port=0 set. Thanks to Peter Naulls
1650 Reply to DHCPINFORM requests even when the supplied ciaddr
1651 doesn't fall in any dhcp-range. In this case it's not
1652 possible to supply a complete configuration, but
1653 individually-configured options (eg PAC) may be useful.
1655 Allow the source address of an alias to be a range:
1656 --alias=192.168.0.0,10.0.0.0,255.255.255.0 maps the whole
1657 subnet 192.168.0.0->192.168.0.255 to 10.0.0.0->10.0.0.255,
1659 --alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0
1660 maps only the 192.168.0.10->192.168.0.40 region. Thanks to
1661 Ib Uhrskov for the suggestion.
1663 Don't dynamically allocate DHCP addresses which may break
1664 Windows. Addresses which end in .255 or .0 are broken in
1665 Windows even when using supernetting.
1666 --dhcp-range=192.168.0.1,192.168.1.254,255,255,254.0 means
1667 192.168.0.255 is a valid IP address, but not for Windows.
1668 See Microsoft KB281579. We therefore no longer allocate
1669 these addresses to avoid hard-to-diagnose problems.
1671 Update Polish translation. Thanks to Jan Psota.
1673 Delete the PID-file when dnsmasq shuts down. Note that by
1674 this time, dnsmasq is normally not running as root, so
1675 this will fail if the PID-file is stored in a root-owned
1676 directory; such failure is silently ignored. To take
1677 advantage of this feature, the PID-file must be stored in a
1678 directory owned and write-able by the user running
1683 Allow --bootp-dynamic to take a netid tag, so that it may
1684 be selectively enabled. Thanks to Olaf Westrik for the
1687 Remove ISC-leasefile reading code. This has been
1688 deprecated for a long time, and last time I removed it, it
1689 ended up going back by request of one user. This time,
1690 it's gone for good; otherwise it would need to be
1691 re-worked to support multiple domains (see below).
1693 Support DHCP clients in multiple DNS domains. This is a
1694 long-standing request. Clients are assigned to a domain
1695 based in their IP address.
1697 Add --dhcp-fqdn flag, which changes behaviour if DNS names
1698 assigned to DHCP clients. When this is set, there must be
1699 a domain associated with each client, and only
1700 fully-qualified domain names are added to the DNS. The
1701 advantage is that the only the FQDN needs to be unique,
1702 so that two or more DHCP clients can share a hostname, as
1703 long as they are in different domains.
1705 Set environment variable DNSMASQ_DOMAIN when invoking
1706 lease-change script. This may be useful information to
1707 have now that it's variable.
1709 Tighten up data-checking code for DNS packet
1710 handling. Thanks to Steve Dodd who found certain illegal
1711 packets which could crash dnsmasq. No memory overwrite was
1712 possible, so this is not a security issue beyond the DoS
1715 Update example config dhcp option 47, the previous
1716 suggestion generated an illegal, zero-length,
1717 option. Thanks to Matthias Andree for finding this.
1719 Rewrite hosts-file reading code to remove the limit of
1720 1024 characters per line. John C Meuser found this.
1722 Create a net-id tag with the name of the interface on
1723 which the DHCP request was received.
1725 Fixed minor memory leak in DBus code, thanks to Jeremy
1726 Laine for the patch.
1728 Emit DBus signals as the DHCP lease database
1729 changes. Thanks to Jeremy Laine for the patch.
1731 Allow for more that one MAC address in a dhcp-host
1732 line. This configuration tells dnsmasq that it's OK to
1733 abandon a DHCP lease of the fixed address to one MAC
1734 address, if another MAC address in the dhcp-host statement
1735 asks for an address. This is useful to give a fixed
1736 address to a host which has two network interfaces
1737 (say, a laptop with wired and wireless interfaces.)
1738 It's very important to ensure that only one interface
1739 at a time is up, since dnsmasq abandons the first lease
1740 and re-uses the address before the leased time has
1741 elapsed. John Gray suggested this.
1743 Tweak the response to a DHCP request packet with a wrong
1744 server-id when --dhcp-authoritative is set; dnsmasq now
1745 returns a DHCPNAK, rather than silently ignoring the
1746 packet. Thanks to Chris Marget for spotting this
1749 Add --cname option. This provides a limited alias
1750 function, usable for DHCP names. Thanks to AJ Weber for
1751 suggestions on this.
1753 Updated contrib/webmin with latest version from Neil
1756 Updated Polish translation. Thanks to Jan Psota.
1758 Correct the text names for DHCP options 64 and 65 to be
1759 "nis+-domain" and "nis+-servers".
1761 Updated Spanish translation. Thanks to Chris Chatham.
1763 Force re-reading of /etc/resolv.conf when an "interface
1768 Fix total DNS failure in release 2.44 unless --min-port
1769 specified. Thanks to Steven Barth and Grant Coady for
1770 bugreport. Also reject out-of-range port spec, which could
1771 break things too: suggestion from Gilles Espinasse.
1775 Fix crash when unknown client attempts to renew a DHCP
1776 lease, problem introduced in version 2.43. Thanks to
1777 Carlos Carvalho for help chasing this down.
1779 Fix potential crash when a host which doesn't have a lease
1780 does DHCPINFORM. Again introduced in 2.43. This bug has
1781 never been reported in the wild.
1783 Fix crash in netlink code introduced in 2.43. Thanks to
1784 Jean Wolter for finding this.
1786 Change implementation of min_port to work even if min-port
1789 Patch to enable compilation of latest Mac OS X. Thanks to
1792 Update Spanish translation. Thanks to Christopher Chatham.
1796 Updated Polish translation. Thanks to Jan Psota.
1798 Flag errors when configuration options are repeated
1801 Further tweaks for GNU/kFreeBSD
1803 Add --no-wrap to msgmerge call - provides nicer .po file
1806 Honour lease-time spec in dhcp-host lines even for
1807 BOOTP. The user is assumed to known what they are doing in
1808 this case. (Hosts without the time spec still get infinite
1809 leases for BOOTP, over-riding the default in the
1810 dhcp-range.) Thanks to Peter Katzmann for uncovering this.
1812 Fix problem matching relay-agent ids. Thanks to Michael
1813 Rack for the bug report.
1815 Add --naptr-record option. Suggestion from Johan
1818 Implement RFC 5107 server-id-override DHCP relay agent
1821 Apply patches from Stefan Kruger for compilation on
1822 Solaris 10 under Sun studio.
1824 Yet more tweaking of Linux capability code, to suppress
1825 pointless wingeing from kernel 2.6.25 and above.
1827 Improve error checking during startup. Previously, some
1828 errors which occurred during startup would be worked
1829 around, with dnsmasq still starting up. Some were logged,
1830 some silent. Now, they all cause a fatal error and dnsmasq
1831 terminates with a non-zero exit code. The errors are those
1832 associated with changing uid and gid, setting process
1833 capabilities and writing the pidfile. Thanks to Uwe
1834 Gansert and the Suse security team for pointing out
1835 this improvement, and Bill Reimers for good implementation
1838 Provide NO_LARGEFILE compile option to switch off largefile
1839 support when compiling against versions of uclibc which
1840 don't support it. Thanks to Stephane Billiart for the patch.
1842 Implement random source ports for interactions with
1843 upstream nameservers. New spoofing attacks have been found
1844 against nameservers which do not do this, though it is not
1845 clear if dnsmasq is vulnerable, since to doesn't implement
1846 recursion. By default dnsmasq will now use a different
1847 source port (and socket) for each query it sends
1848 upstream. This behaviour can suppressed using the
1849 --query-port option, and the old default behaviour
1850 restored using --query-port=0. Explicit source-port
1851 specifications in --server configs are still honoured.
1853 Replace the random number generator, for better
1854 security. On most BSD systems, dnsmasq uses the
1855 arc4random() RNG, which is secure, but on other platforms,
1856 it relied on the C-library RNG, which may be
1857 guessable and therefore allow spoofing. This release
1858 replaces the libc RNG with the SURF RNG, from Daniel
1859 J. Berstein's DJBDNS package.
1861 Don't attempt to change user or group or set capabilities
1862 if dnsmasq is run as a non-root user. Without this, the
1863 change from soft to hard errors when these fail causes
1864 problems for non-root daemons listening on high
1865 ports. Thanks to Patrick McLean for spotting this.
1867 Updated French translation. Thanks to Gildas Le Nadan.
1871 The changelog for version 2.42 and earlier is
1872 available in CHANGELOG.archive.
projects / people / ms / dnsmasq.git / blob