2 Fix crash at startup when an empty suffix is supplied to
3 --conf-dir, also trivial memory leak. Thanks to
4 Tomas Hozza for spotting this.
6 Remove floor of 4096 on advertised EDNS0 packet size when
7 DNSSEC in use, the original rationale for this has long gone.
8 Thanks to Anders Kaseorg for spotting this.
10 Use inotify for checking on updates to /etc/resolv.conf and
11 friends under Linux. This fixes race conditions when the files are
12 updated rapidly and saves CPU by noy polling. To build
13 a binary that runs on old Linux kernels without inotify,
14 use make COPTS=-DNO_INOTIFY
16 Fix breakage of --domain=<domain>,<subnet>,local - only reverse
17 queries were intercepted. THis appears to have been broken
18 since 2.69. Thanks to Josh Stone for finding the bug.
20 Eliminate IPv6 privacy addresses and deprecated addresses from
21 the answers given by --interface-name. Note that reverse queries
22 (ie looking for names, given addresses) are not affected.
23 Thanks to Michael Gorbach for the suggestion.
25 Fix crash in DNSSEC code with long RRs. Thanks to Marco Davids
28 Add --ignore-address option. Ignore replies to A-record
29 queries which include the specified address. No error is
30 generated, dnsmasq simply continues to listen for another
31 reply. This is useful to defeat blocking strategies which
32 rely on quickly supplying a forged answer to a DNS
33 request for certain domains, before the correct answer can
34 arrive. Thanks to Glen Huang for the patch.
36 Revisit the part of DNSSEC validation which determines if an
37 unsigned answer is legit, or is in some part of the DNS
38 tree which should be signed. Dnsmasq now works from the
39 DNS root downward looking for the limit of signed
40 delegations, rather than working bottom up. This is
41 both more correct, and less likely to trip over broken
42 nameservers in the unsigned parts of the DNS tree
43 which don't respond well to DNSSEC queries.
45 Add --log-queries=extra option, which makes logs easier
46 to search automatically.
48 Add --min-cache-ttl option. I've resisted this for a long
49 time, on the grounds that disbelieving TTLs is never a
50 good idea, but I've been persuaded that there are
51 sometimes reasons to do it. (Step forward, GFW).
52 To avoid misuse, there's a hard limit on the TTL
53 floor of one hour. Thansk to RinSatsuki for the patch.
55 Cope with multiple interfaces with the same link-local
56 address. (IPv6 addresses are scoped, so this is allowed.)
57 Thanks to Cory Benfield for help with this.
59 Add --dhcp-hostsdir. This allows addition of new host
60 configurations to a running dnsmasq instance much more
61 cheaply than having dnsmasq re-read all its existing
62 configuration each time.
64 Don't reply to DHCPv6 SOLICIT messages if we're not
65 configured to do stateful DHCPv6. Thanks to Win King Wan
68 Fix broken DNSSEC validation of ECDSA signatures.
70 Add --dnssec-timestamp option, which provides an automatic
71 way to detect when the system time becomes valid after
72 boot on systems without an RTC, whilst allowing DNS
73 queries before the clock is valid so that NTP can run.
74 Thanks to Kevin Darbyshire-Bryant for developing this idea.
76 Add --tftp-no-fail option. Thanks to Stefan Tomanek for
79 Fix crash caused by looking up servers.bind, CHAOS text
80 record, when more than about five --servers= lines are
81 in the dnsmasq config. This causes memory corruption
82 which causes a crash later. Thanks to Matt Coddington for
83 sterling work chasing this down.
85 Fix crash on receipt of certain malformed DNS requests.
86 Thanks to Nick Sampanis for spotting the problem.
87 Note that this is could allow the dnsmasq process's
88 memory to be read by an attacker under certain
89 circumstances, so it has a CVE, CVE-2015-3294
91 Fix crash in authoritative DNS code, if a .arpa zone
92 is declared as authoritative, and then a PTR query which
93 is not to be treated as authoritative arrived. Normally,
94 directly declaring .arpa zone as authoritative is not
95 done, so this crash wouldn't be seen. Instead the
96 relevant .arpa zone should be specified as a subnet
97 in the auth-zone declaration. Thanks to Johnny S. Lee
98 for the bugreport and initial patch.
100 Fix authoritative DNS code to correctly reply to NS
101 and SOA queries for .arpa zones for which we are
102 declared authoritative by means of a subnet in auth-zone.
103 Previously we provided correct answers to PTR queries
104 in such zones (including NS and SOA) but not direct
105 NS and SOA queries. Thanks to Johnny S. Lee for
106 pointing out the problem.
110 Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.
112 Add support for "ipsets" in *BSD, using pf. Thanks to
113 Sven Falempim for the patch.
115 Fix race condition which could lock up dnsmasq when an
116 interface goes down and up rapidly. Thanks to Conrad
117 Kostecki for helping to chase this down.
119 Add DBus methods SetFilterWin2KOption and SetBogusPrivOption
120 Thanks to the Smoothwall project for the patch.
122 Fix failure to build against Nettle-3.0. Thanks to Steven
123 Barth for spotting this and finding the fix.
125 When assigning existing DHCP leases to intefaces by comparing
126 networks, handle the case that two or more interfaces have the
127 same network part, but different prefix lengths (favour the
128 longer prefix length.) Thanks to Lung-Pin Chang for the
131 Add a mode which detects and removes DNS forwarding loops, ie
132 a query sent to an upstream server returns as a new query to
133 dnsmasq, and would therefore be forwarded again, resulting in
134 a query which loops many times before being dropped. Upstream
135 servers which loop back are disabled and this event is logged.
136 Thanks to Smoothwall for their sponsorship of this feature.
138 Extend --conf-dir to allow filtering of files. So
139 --conf-dir=/etc/dnsmasq.d,\*.conf
140 will load all the files in /etc/dnsmasq.d which end in .conf
142 Fix bug when resulted in NXDOMAIN answers instead of NODATA in
145 Fix bug which caused dnsmasq to become unresponsive if it
146 failed to send packets due to a network interface disappearing.
147 Thanks to Niels Peen for spotting this.
149 Fix problem with --local-service option on big-endian platforms
150 Thanks to Richard Genoud for the patch.
154 Subtle change to error handling to help DNSSEC validation
155 when servers fail to provide NODATA answers for
156 non-existent DS records.
158 Tweak code which removes DNSSEC records from answers when
159 not required. Fixes broken answers when additional section
160 has real records in it. Thanks to Marco Davids for the bug
163 Fix DNSSEC validation of ANY queries. Thanks to Marco Davids
164 for spotting that too.
166 Fix total DNS failure and 100% CPU use if cachesize set to zero,
167 regression introduced in 2.69. Thanks to James Hunt and
168 the Ubuntu crowd for assistance in fixing this.
172 Fix crash, introduced in 2.69, on TCP request when dnsmasq
173 compiled with DNSSEC support, but running without DNSSEC
174 enabled. Thanks to Manish Sing for spotting that one.
176 Fix regression which broke ipset functionality. Thanks to
177 Wang Jian for the bug report.
181 Implement dynamic interface discovery on *BSD. This allows
182 the contructor: syntax to be used in dhcp-range for DHCPv6
183 on the BSD platform. Thanks to Matthias Andree for
184 valuable research on how to implement this.
186 Fix infinite loop associated with some --bogus-nxdomain
187 configs. Thanks fogobogo for the bug report.
189 Fix missing RA RDNS option with configuration like
190 --dhcp-option=option6:23,[::] Thanks to Tsachi Kimeldorfer
191 for spotting the problem.
193 Add [fd00::] and [fe80::] as special addresses in DHCPv6
194 options, analogous to [::]. [fd00::] is replaced with the
195 actual ULA of the interface on the machine running
196 dnsmasq, [fe80::] with the link-local address.
197 Thanks to Tsachi Kimeldorfer for championing this.
199 DNSSEC validation and caching. Dnsmasq needs to be
200 compiled with this enabled, with
202 make dnsmasq COPTS=-DHAVE_DNSSEC
204 this add dependencies on the nettle crypto library and the
205 gmp maths library. It's possible to have these linked
208 make dnsmasq COPTS='-DHAVE_DNSSEC -DHAVE_DNSSEC_STATIC'
210 which bloats the dnsmasq binary, but saves the size of
211 the shared libraries which are much bigger.
213 To enable, DNSSEC, you will need a set of
214 trust-anchors. Now that the TLDs are signed, this can be
215 the keys for the root zone, and for convenience they are
216 included in trust-anchors.conf in the dnsmasq
217 distribution. You should of course check that these are
218 legitimate and up-to-date. So, adding
220 conf-file=/path/to/trust-anchors.conf
223 to your config is all thats needed to get things
224 working. The upstream nameservers have to be DNSSEC-capable
225 too, of course. Many ISP nameservers aren't, but the
226 Google public nameservers (8.8.8.8 and 8.8.4.4) are.
227 When DNSSEC is configured, dnsmasq validates any queries
228 for domains which are signed. Query results which are
229 bogus are replaced with SERVFAIL replies, and results
230 which are correctly signed have the AD bit set. In
231 addition, and just as importantly, dnsmasq supplies
232 correct DNSSEC information to clients which are doing
233 their own validation, and caches DNSKEY, DS and RRSIG
234 records, which significantly improve the performance of
235 downstream validators. Setting --log-queries will show
238 If a domain is returned from an upstream nameserver without
239 DNSSEC signature, dnsmasq by default trusts this. This
240 means that for unsigned zone (still the majority) there
241 is effectively no cost for having DNSSEC enabled. Of course
242 this allows an attacker to replace a signed record with a
243 false unsigned record. This is addressed by the
244 --dnssec-check-unsigned flag, which instructs dnsmasq
245 to prove that an unsigned record is legitimate, by finding
246 a secure proof that the zone containing the record is not
247 signed. Doing this has costs (typically one or two extra
248 upstream queries). It also has a nasty failure mode if
249 dnsmasq's upstream nameservers are not DNSSEC capable.
250 Without --dnssec-check-unsigned using such an upstream
251 server will simply result in not queries being validated;
252 with --dnssec-check-unsigned enabled and a
253 DNSSEC-ignorant upstream server, _all_ queries will fail.
255 Note that DNSSEC requires that the local time is valid and
256 accurate, if not then DNSSEC validation will fail. NTP
257 should be running. This presents a problem for routers
258 without a battery-backed clock. To set the time needs NTP
259 to do DNS lookups, but lookups will fail until NTP has run.
260 To address this, there's a flag, --dnssec-no-timecheck
261 which disables the time checks (only) in DNSSEC. When dnsmasq
262 is started and the clock is not synced, this flag should
263 be used. As soon as the clock is synced, SIGHUP dnsmasq.
264 The SIGHUP clears the cache of partially-validated data and
265 resets the no-timecheck flag, so that all DNSSEC checks
266 henceforward will be complete.
268 The development of DNSSEC in dnsmasq was started by
269 Giovanni Bajo, to whom huge thanks are owed. It has been
270 supported by Comcast, whose techfund grant has allowed for
271 an invaluable period of full-time work to get it to
274 Add --rev-server. Thanks to Dave Taht for suggesting this.
276 Add --servers-file. Allows dynamic update of upstream servers
277 full access to configuration.
279 Add --local-service. Accept DNS queries only from hosts
280 whose address is on a local subnet, ie a subnet for which
281 an interface exists on the server. This option
282 only has effect if there are no --interface --except-interface,
283 --listen-address or --auth-server options. It is intended
284 to be set as a default on installation, to allow
285 unconfigured installations to be useful but also safe from
286 being used for DNS amplification attacks.
288 Fix crashes in cache_get_cname_target() when dangling CNAMEs
289 encountered. Thanks to Andy and the rt-n56u project for
290 find this and helping to chase it down.
292 Fix wrong RCODE in authoritative DNS replies to PTR queries. The
293 correct answer was included, but the RCODE was set to NXDOMAIN.
294 Thanks to Craig McQueen for spotting this.
296 Make statistics available as DNS queries in the .bind TLD as
297 well as logging them.
301 Use random addresses for DHCPv6 temporary address
302 allocations, instead of algorithmically determined stable
305 Fix bug which meant that the DHCPv6 DUID was not available
306 in DHCP script runs during the lifetime of the dnsmasq
307 process which created the DUID de-novo. Once the DUID was
308 created and stored in the lease file and dnsmasq
309 restarted, this bug disappeared.
311 Fix bug introduced in 2.67 which could result in erroneous
312 NXDOMAIN returns to CNAME queries.
314 Fix build failures on MacOS X and openBSD.
316 Allow subnet specifications in --auth-zone to be interface
317 names as well as address literals. This makes it possible
318 to configure authoritative DNS when local address ranges
319 are dynamic and works much better than the previous
320 work-around which exempted contructed DHCP ranges from the
321 IP address filtering. As a consequence, that work-around
322 is removed. Under certain circumstances, this change wil
323 break existing configuration: if you're relying on the
324 contructed-range exception, you need to change --auth-zone
325 to specify the same interface as is used to construct your
326 DHCP ranges, probably with a trailing "/6" like this:
327 --auth-zone=example.com,eth0/6 to limit the addresses to
328 IPv6 addresses of eth0.
330 Fix problems when advertising deleted IPv6 prefixes. If
331 the prefix is deleted (rather than replaced), it doesn't
332 get advertised with zero preferred time. Thanks to Tsachi
335 Fix segfault with some locally configured CNAMEs. Thanks
336 to Andrew Childs for spotting the problem.
338 Fix memory leak on re-reading /etc/hosts and friends,
341 Check the arrival interface of incoming DNS and TFTP
342 requests via IPv6, even in --bind-interfaces mode. This
343 isn't possible for IPv4 and can generate scary warnings,
344 but as it's always possible for IPv6 (the API always
345 exists) then we should do it always.
347 Tweak the rules on prefix-lengths in --dhcp-range for
348 IPv6. The new rule is that the specified prefix length
349 must be larger than or equal to the prefix length of the
350 corresponding address on the local interface.
354 Fix crash if upstream server returns SERVFAIL when
355 --conntrack in use. Thanks to Giacomo Tazzari for finding
356 this and supplying the patch.
358 Repair regression in 2.64. That release stopped sending
359 lease-time information in the reply to DHCPINFORM
360 requests, on the correct grounds that it was a standards
361 violation. However, this broke the dnsmasq-specific
362 dhcp_lease_time utility. Now, DHCPINFORM returns
363 lease-time only if it's specifically requested
364 (maintaining standards) and the dhcp_lease_time utility
365 has been taught to ask for it (restoring functionality).
367 Fix --dhcp-match, --dhcp-vendorclass and --dhcp-userclass
368 to work with BOOTP and well as DHCP. Thanks to Peter
369 Korsgaard for spotting the problem.
371 Add --synth-domain. Thanks to Vishvananda Ishaya for
374 Fix failure to compile ipset.c if old kernel headers are
375 in use. Thanks to Eugene Rudoy for pointing this out.
377 Handle IPv4 interface-address labels in Linux. These are
378 often used to emulate the old IP-alias addresses. Before,
379 using --interface=eth0 would service all the addresses of
380 eth0, including ones configured as aliases, which appear
381 in ifconfig as eth0:0. Now, only addresses with the label
382 eth0 are active. This is not backwards compatible: if you
383 want to continue to bind the aliases too, you need to add
384 eg. --interface=eth0:0 to the config.
386 Fix "failed to set SO_BINDTODEVICE on DHCP socket: Socket
387 operation on non-socket" error on startup with
388 configurations which have exactly one --interface option
389 and do RA but _not_ DHCPv6. Thanks to Trever Adams for the
392 Generalise --interface-name to cope with IPv6 addresses
393 and multiple addresses per interface per address family.
395 Fix option parsing for --dhcp-host, which was generating a
396 spurious error when all seven possible items were
397 included. Thanks to Zhiqiang Wang for the bug report.
399 Remove restriction on prefix-length in --auth-zone. Thanks
400 to Toke Hoiland-Jorgensen for suggesting this.
402 Log when the maximum number of concurrent DNS queries is
403 reached. Thanks to Marcelo Salhab Brogliato for the patch.
405 If wildcards are used in --interface, don't assume that
406 there will only ever be one available interface for DHCP
407 just because there is one at start-up. More may appear, so
408 we can't use SO_BINDTODEVICE. Thanks to Natrio for the bug
411 Increase timeout/number of retries in TFTP to accomodate
412 AudioCodes Voice Gateways doing streaming writes to flash.
413 Thanks to Damian Kaczkowski for spotting the problem.
415 Fix crash with empty DHCP string options when adding zero
416 terminator. Thanks to Patrick McLean for the bug report.
418 Allow hostnames to start with a number, as allowed in
419 RFC-1123. Thanks to Kyle Mestery for the patch.
421 Fixes to DHCP FQDN option handling: don't terminate FQDN
422 if domain not known and allow a FQDN option with blank
423 name to request that a FQDN option is returned in the
424 reply. Thanks to Roy Marples for the patch.
426 Make --clear-on-reload apply to setting upstream servers
429 When the address which triggered the construction of an
430 advertised IPv6 prefix disappears, continue to advertise
431 the prefix for up to 2 hours, with the preferred lifetime
432 set to zero. This satisfies RFC 6204 4.3 L-13 and makes
433 things work better if a prefix disappears without being
434 deprecated first. Thanks to Uwe Schindler for persuasively
437 Fix MAC address enumeration on *BSD. Thanks to Brad Smith
440 Support RFC-4242 information-refresh-time options in the
441 reply to DHCPv6 information-request. The lease time of the
442 smallest valid dhcp-range is sent. Thanks to Uwe Schindler
445 Make --listen-address higher priority than --except-interface
446 in all circumstances. Thanks to Thomas Hood for the bugreport.
448 Provide independent control over which interfaces get TFTP
449 service. If enable-tftp is given a list of interfaces, then TFTP
450 is provided on those. Without the list, the previous behaviour
451 (provide TFTP to the same interfaces we provide DHCP to)
452 is retained. Thanks to Lonnie Abelbeck for the suggestion.
454 Add --dhcp-relay config option. Many thanks to vtsl.net
455 for sponsoring this development.
457 Fix crash with empty tag: in --dhcp-range. Thanks to
458 Kaspar Schleiser for the bug report.
460 Add "baseline" and "bloatcheck" makefile targets, for
461 revealing size changes during development. Thanks to
462 Vladislav Grishenko for the patch.
464 Cope with DHCPv6 clients which send REQUESTs without
465 address options - treat them as SOLICIT with rapid commit.
467 Support identification of clients by MAC address in
468 DHCPv6. When using a relay, the relay must support RFC
469 6939 for this to work. It always works for directly
470 connected clients. Thanks to Vladislav Grishenko
471 for prompting this feature.
473 Remove the rule for constructed DHCP ranges that the local
474 address must be either the first or last address in the
475 range. This was originally to avoid SLAAC addresses, but
476 we now explicitly autoconfig and privacy addresses instead.
478 Update Polish translation. Thanks to Jan Psota.
480 Fix problem in DHCPv6 vendorclass/userclass matching
481 code. Thanks to Tanguy Bouzeloc for the patch.
483 Update Spanish transalation. Thanks to Vicente Soriano.
485 Add --ra-param option. Thanks to Vladislav Grishenko for
488 Add --add-subnet configuration, to tell upstream DNS
489 servers where the original client is. Thanks to DNSthingy
490 for sponsoring this feature.
492 Add --quiet-dhcp, --quiet-dhcp6 and --quiet-ra. Thanks to
493 Kevin Darbyshire-Bryant for the initial patch.
495 Allow A/AAAA records created by --interface-name to be the
496 target of --cname. Thanks to Hadmut Danisch for the
499 Avoid treating a --dhcp-host which has an IPv6 address
500 as eligable for use with DHCPv4 on the grounds that it has
501 no address, and vice-versa. Thanks to Yury Konovalov for
502 spotting the problem.
504 Do a better job caching dangling CNAMEs. Thanks to Yves
505 Dorfsman for spotting the problem.
509 Add the ability to act as an authoritative DNS
510 server. Dnsmasq can now answer queries from the wider 'net
511 with local data, as long as the correct NS records are set
512 up. Only local data is provided, to avoid creating an open
513 DNS relay. Zone transfer is supported, to allow secondary
514 servers to be configured.
516 Add "constructed DHCP ranges" for DHCPv6. This is intended
517 for IPv6 routers which get prefixes dynamically via prefix
518 delegation. With suitable configuration, stateful DHCPv6
519 and RA can happen automatically as prefixes are delegated
520 and then deprecated, without having to re-write the
521 dnsmasq configuration file or restart the daemon. Thanks to
522 Steven Barth for extensive testing and development work on
525 Fix crash on startup on Solaris 11. Regression probably
526 introduced in 2.61. Thanks to Geoff Johnstone for the
529 Add code to make behaviour for TCP DNS requests that same
530 as for UDP requests, when a request arrives for an allowed
531 address, but via a banned interface. This change is only
532 active on Linux, since the relevant API is missing (AFAIK)
533 on other platforms. Many thanks to Tomas Hozza for
534 spotting the problem, and doing invaluable discovery of
535 the obscure and undocumented API required for the solution.
537 Don't send the default DHCP option advertising dnsmasq as
538 the local DNS server if dnsmasq is configured to not act
539 as DNS server, or it's configured to a non-standard port.
541 Add DNSMASQ_CIRCUIT_ID, DNSMASQ_SUBCRIBER_ID,
542 DNSMASQ_REMOTE_ID variables to the environment of the
543 lease-change script (and the corresponding Lua). These hold
544 information inserted into the DHCP request by a DHCP relay
545 agent. Thanks to Lakefield Communications for providing a
546 bounty for this addition.
548 Fixed crash, introduced in 2.64, whilst handling DHCPv6
549 information-requests with some common configurations.
550 Thanks to Robert M. Albrecht for the bug report and
553 Add --ipset option. Thanks to Jason A. Donenfeld for the
556 Don't erroneously reject some option names in --dhcp-match
557 options. Thanks to Benedikt Hochstrasser for the bug report.
559 Allow a trailing '*' wildcard in all interface-name
560 configurations. Thanks to Christian Parpart for the patch.
562 Handle the situation where libc headers define
563 SO_REUSEPORT, but the kernel in use doesn't, to cope with
564 the introduction of this option to Linux. Thanks to Rich
565 Felker for the bug report.
567 Update Polish translation. Thanks to Jan Psota.
569 Fix crash if the configured DHCP lease limit is
570 reached. Regression occurred in 2.61. Thanks to Tsachi for
573 Update the French translation. Thanks to Gildas le Nadan.
577 Fix regression which broke forwarding of queries sent via
578 TCP which are not for A and AAAA and which were directed to
579 non-default servers. Thanks to Niax for the bug report.
581 Fix failure to build with DHCP support excluded. Thanks to
582 Gustavo Zacarias for the patch.
584 Fix nasty regression in 2.64 which completely broke cacheing.
588 Handle DHCP FQDN options with all flag bits zero and
589 --dhcp-client-update set. Thanks to Bernd Krumbroeck for
590 spotting the problem.
592 Finesse the check for /etc/hosts names which conflict with
593 DHCP names. Previously a name/address pair in /etc/hosts
594 which didn't match the name/address of a DHCP lease would
595 generate a warning. Now that only happesn if there is not
596 also a match. This allows multiple addresses for a name in
597 /etc/hosts with one of them assigned via DHCP.
599 Fix broken vendor-option processing for BOOTP. Thanks to
600 Hans-Joachim Baader for the bug report.
602 Don't report spurious netlink errors, regression in
603 2.63. Thanks to Vladislav Grishenko for the patch.
605 Flag DHCP or DHCPv6 in starup logging. Thanks to
606 Vladislav Grishenko for the patch.
608 Add SetServersEx method in DBus interface. Thanks to Dan
609 Williams for the patch.
611 Add SetDomainServers method in DBus interface. Thanks to
612 Roy Marples for the patch.
614 Fix build with later Lua libraries. Thansk to Cristian
615 Rodriguez for the patch.
617 Add --max-cache-ttl option. Thanks to Dennis Kaarsemaker
620 Fix breakage of --host-record parsing, resulting in
621 infinte loop at startup. Regression in 2.63. Thanks to
622 Haim Gelfenbeyn for spotting this.
624 Set SO_REUSEADDRESS and SO_V6ONLY options on the DHCPv6
625 socket, this allows multiple instances of dnsmasq on a
626 single machine, in the same way as for DHCPv4. Thanks to
627 Gene Czarcinski and Vladislav Grishenko for work on this.
629 Fix DHCPv6 to do access control correctly when it's
630 configured with --listen-address. Thanks to
631 Gene Czarcinski for sorting this out.
633 Add a "wildcard" dhcp-range which works for any IPv6
634 subnet, --dhcp-range=::,static Useful for Stateless
635 DHCPv6. Thanks to Vladislav Grishenko for the patch.
637 Don't include lease-time in DHCPACK replies to DHCPINFORM
638 queries, since RFC-2131 says we shouldn't. Thanks to
639 Wouter Ibens for pointing this out.
641 Makefile tweak to do dependency checking on header files.
642 Thanks to Johan Peeters for the patch.
644 Check interface for outgoing unsolicited router
645 advertisements, rather than relying on interface address
646 configuration. Thanks to Gene Czarinski for the patch.
648 Handle better attempts to transmit on interfaces which are
649 still doing DAD, and specifically do not just transmit
650 without setting source address and interface, since this
651 can cause very puzzling effects when a router
652 advertisement goes astray. Thanks again to Gene Czarinski.
654 Get RA timers right when there is more than one
655 dhcp-range on a subnet.
659 Do duplicate dhcp-host address check in --test mode.
661 Check that tftp-root directories are accessible before
662 start-up. Thanks to Daniel Veillard for the initial patch.
664 Allow more than one --tfp-root flag. The per-interface
665 stuff is pointless without that.
667 Add --bind-dynamic. A hybrid mode between the default and
668 --bind-interfaces which copes with dynamically created
671 A couple of fixes to the build system for Android. Thanks
672 to Metin Kaya for the patches.
674 Remove the interface:<interface> argument in --dhcp-range, and
675 the interface argument to --enable-tftp. These were a
676 still-born attempt to allow automatic isolated
677 configuration by libvirt, but have never (to my knowledge)
678 been used, had very strange semantics, and have been
679 superceded by other mechanisms.
681 Fixed bug logging filenames when duplicate dhcp-host
682 addresses are found. Thanks to John Hanks for the patch.
684 Fix regression in 2.61 which broke caching of CNAME
685 chains. Thanks to Atul Gupta for the bug report.
687 Allow the target of a --cname flag to be another --cname.
689 Teach DHCPv6 about the RFC 4242 information-refresh-time
690 option, and add parsing if the minutes, hours and days
691 format for options. Thanks to Francois-Xavier Le Bail for
694 Allow "w" (for week) as multiplier in lease times, as well
695 as seconds, minutes, hours and days. Álvaro Gámez Machado
696 spotted the ommission.
698 Update French translation. Thanks to Gildas Le Nadan.
700 Allow a DBus service name to be given with --enable-dbus
701 which overrides the default,
702 uk.org.thekelleys.dnsmasq. Thanks to Mathieu
703 Trudel-Lapierre for the patch.
705 Set the "prefix on-link" bit in Router
706 Advertisements. Thanks to Gui Iribarren for the patch.
710 Update German translation. Thanks to Conrad Kostecki.
712 Cope with router-solict packets wich don't have a valid
713 source address. Thanks to Vladislav Grishenko for the patch.
715 Fixed bug which caused missing periodic router
716 advertisements with some configurations. Thanks to
717 Vladislav Grishenko for the patch.
719 Fixed bug which broke DHCPv6/RA with prefix lengths
720 which are not divisible by 8. Thanks to Andre Coetzee
723 Fix non-response to router-solicitations when
724 router-advertisement configured, but DHCPv6 not
725 configured. Thanks to Marien Zwart for the patch.
727 Add --dns-rr, to allow arbitrary DNS resource records.
729 Fixed bug which broke RA scheduling when an interface had
730 two addresses in the same network. Thanks to Jim Bos for
731 his help nailing this.
734 Re-write interface discovery code on *BSD to use
735 getifaddrs. This is more portable, more straightforward,
736 and allows us to find the prefix length for IPv6
739 Add ra-names, ra-stateless and slaac keywords for DHCPv6.
740 Dnsmasq can now synthesise AAAA records for dual-stack
741 hosts which get IPv6 addresses via SLAAC. It is also now
742 possible to use SLAAC and stateless DHCPv6, and to
743 tell clients to use SLAAC addresses as well as DHCP ones.
744 Thanks to Dave Taht for help with this.
746 Add --dhcp-duid to allow DUID-EN uids to be used.
748 Explicity send DHCPv6 replies to the correct port, instead
749 of relying on clients to send requests with the correct
750 source address, since at least one client in the wild gets
751 this wrong. Thanks to Conrad Kostecki for help tracking
754 Send a preference value of 255 in DHCPv6 replies when
755 --dhcp-authoritative is in effect. This tells clients not
756 to wait around for other DHCP servers.
758 Better logging of DHCPv6 options.
760 Add --host-record. Thanks to Rob Zwissler for the
763 Invoke the DHCP script with action "tftp" when a TFTP file
764 transfer completes. The size of the file, address to which
765 it was sent and complete pathname are supplied. Note that
766 version 2.60 introduced some script incompatibilties
767 associated with DHCPv6, and this is a further change. To
768 be safe, scripts should ignore unknown actions, and if
769 not IPv6-aware, should exit if the environment
770 variable DNSMASQ_IAID is set. The use-case for this is
771 to track netboot/install. Suggestion from Shantanu
774 Update contrib/port-forward/dnsmasq-portforward to reflect
777 Set the environment variable DNSMASQ_LOG_DHCP when running
778 the script id --log-dhcp is in effect, so that script can
779 taylor their logging verbosity. Suggestion from Malte
782 Arrange that addresses specified with --listen-address
783 work even if there is no interface carrying the
784 address. This is chiefly useful for IPv4 loopback
785 addresses, where any address in 127.0.0.0/8 is a valid
786 loopback address, but normally only 127.0.0.1 appears on
787 the lo interface. Thanks to Mathieu Trudel-Lapierre for
788 the idea and initial patch.
790 Fix crash, introduced in 2.60, when a DHCPINFORM is
791 received from a network which has no valid dhcp-range.
792 Thanks to Stephane Glondu for the bug report.
794 Add a new DHCP lease time keyword, "deprecated" for
795 --dhcp-range. This is only valid for IPv6, and sets the
796 preffered lease time for both DHCP and RA to zero. The
797 effect is that clients can continue to use the address
798 for existing connections, but new connections will use
799 other addresses, if they exist. This makes hitless
800 renumbering at least possible.
802 Fix bug in address6_available() which caused DHCPv6 lease
803 aquisition to fail if more than one dhcp-range in use.
805 Provide RDNSS and DNSSL data in router advertisements,
806 using the settings provided for DHCP options
807 option6:domain-search and option6:dns-server.
809 Tweak logo/favicon.ico to add some transparency. Thanks to
810 SamLT for work on this.
812 Don't cache data from non-recursive nameservers, since it
813 may erroneously look like a valid CNAME to a non-exitant
814 name. Thanks to Ben Winslow for finding this.
816 Call SO_BINDTODEVICE on the DHCP socket(s) when doing DHCP
817 on exactly one interface and --bind-interfaces is set. This
818 makes the OpenStack use-case of one dnsmasq per virtual
819 interface work. This is only available on Linux; it's not
820 supported on other platforms. Thanks to Vishvananda Ishaya
821 and the OpenStack team for the suggestion.
823 Updated French translation. Thanks to Gildas Le Nadan.
825 Give correct from-cache answers to explict CNAME queries.
826 Thanks to Rob Zwissler for spotting this.
828 Add --tftp-lowercase option. Thanks to Oliver Rath for the
831 Ensure that the DBus DhcpLeaseUpdated events are generated
832 when a lease goes through INIT_REBOOT state, even if the
833 dhcp-script is not in use. Thanks to Antoaneta-Ecaterina
836 Fix failure of TFTP over IPv4 on OpenBSD platform. Thanks
837 to Brad Smith for spotting this.
841 Fix compilation problem in Mac OS X Lion. Thanks to Olaf
842 Flebbe for the patch.
844 Fix DHCP when using --listen-address with an IP address
845 which is not the primary address of an interface.
847 Add --dhcp-client-update option.
849 Add Lua integration. Dnsmasq can now execute a DHCP
850 lease-change script written in Lua. This needs to be
851 enabled at compile time by setting HAVE_LUASCRIPT in
852 src/config.h or running "make COPTS=-DHAVE_LUASCRIPT"
853 Thanks to Jan-Piet Mens for the idea and proof-of-concept
856 Tidied src/config.h to distinguish between
857 platform-dependent compile-time options which are selected
858 automatically, and builder-selectable compile time
859 options. Document the latter better, and describe how to
860 set them from the make command line.
862 Tidied up IPPROTO_IP/SOL_IP (and IPv6 equivalent)
863 confusion. IPPROTO_IP works everywhere now.
865 Set TOS on DHCP sockets, this improves things on busy
866 wireless networks. Thanks to Dave Taht for the patch.
868 Determine VERSION automatically based on git magic:
869 release tags or hash values.
871 Improve start-up speed when reading large hosts files
872 containing many distinct addresses.
874 Fix problem if dnsmasq is started without the stdin,
875 stdout and stderr file descriptors open. This can manifest
876 itself as 100% CPU use. Thanks to Chris Moore for finding
879 Fix shell-scripting bug in bld/pkg-wrapper. Thanks to
880 Mark Mitchell for the patch.
882 Allow the TFP server or boot server in --pxe-service, to
883 be a domain name instead of an IP address. This allows for
884 round-robin to multiple servers, in the same way as
885 --dhcp-boot. A good suggestion from Cristiano Cumer.
887 Support BUILDDIR variable in the Makefile. Allows builds
888 for multiple archs from the same source tree with eg.
889 make BUILDDIR=linux (relative to dnsmasq tree)
890 make BUILDDIR=/tmp/openbsd (absolute path)
891 If BUILDDIR is not set, compilation happens in the src
892 directory, as before. Suggestion from Mark Mitchell.
894 Support DHCPv6. Support is there for the sort of things
895 the existing v4 server does, including tags, options,
896 static addresses and relay support. Missing is prefix
897 delegation, which is probably not required in the dnsmasq
898 niche, and an easy way to accept prefix delegations from
899 an upstream DHCPv6 server, which is. Future plans include
900 support for DHCPv6 router option and MAC address option
901 (to make selecting clients by MAC address work like IPv4).
902 These will be added as the standards mature.
903 This code has been tested, but this is the first release,
904 so don't bet the farm on it just yet. Many thanks to all
905 testers who have got it this far.
907 Support IPv6 router advertisements. This is a
908 simple-minded implementation, aimed at providing the
909 vestigial RA needed to go alongside IPv6. Is picks up
910 configuration from the DHCPv6 conf, and should just need
911 enabling with --enable-ra.
913 Fix long-standing wrinkle with --localise-queries that
914 could result in wrong answers when DNS packets arrive
915 via an interface other than the expected one. Thanks to
916 Lorenzo Milesi and John Hanks for spotting this one.
918 Update French translation. Thanks to Gildas Le Nadan.
920 Update Polish translation. Thanks to Jan Psota.
924 Fix regression in 2.58 which caused failure to start up
925 with some combinations of dnsmasq config and IPv6 kernel
926 network config. Thanks to Brielle Bruns for the bug
929 Improve dnsmasq's behaviour when network interfaces are
930 still doing duplicate address detection (DAD). Previously,
931 dnsmasq would wait up to 20 seconds at start-up for the
932 DAD state to terminate. This is broken for bridge
933 interfaces on recent Linux kernels, which don't start DAD
934 until the bridge comes up, and so can take arbitrary
935 time. The new behaviour lets dnsmasq poll for an arbitrary
936 time whilst providing service on other interfaces. Thanks
937 to Stephen Hemminger for pointing out the problem.
941 Provide a definition of the SA_SIZE macro where it's
942 missing. Fixes build failure on openBSD.
944 Don't include a zero terminator at the end of messages
945 sent to /dev/log when /dev/log is a datagram socket.
946 Thanks to Didier Rabound for spotting the problem.
948 Add --dhcp-sequential-ip flag, to force allocation of IP
949 addresses in ascending order. Note that the default
950 pseudo-random mode is in general better but some
951 server-deployment applications need this.
953 Fix problem where a server-id of 0.0.0.0 is sent to a
954 client when a dhcp-relay is in use if a client renews a
955 lease after dnsmasq restart and before any clients on the
956 subnet get a new lease. Thanks to Mike Ruiz for assistance
957 in chasing this one down.
959 Don't return NXDOMAIN to an AAAA query if we have CNAME
960 which points to an A record only: NODATA is the correct
961 reply in this case. Thanks to Tom Fernandes for spotting
964 Relax the need to supply a netmask in --dhcp-range for
965 networks which use a DHCP relay. Whilst this is still
966 desireable, in the absence of a netmask dnsmasq will use
967 a default based on the class (A, B, or C) of the address.
968 This should at least remove a cause of mysterious failure
969 for people using RFC1918 addresses and relays.
971 Add support for Linux conntrack connection marking. If
972 enabled with --conntrack, the connection mark for incoming
973 DNS queries will be copied to the outgoing connections
974 used to answer those queries. This allows clever firewall
975 and accounting stuff. Only available if dnsmasq is
976 compiled with HAVE_CONNTRACK and adds a dependency on
977 libnetfilter-conntrack. Thanks to Ed Wildgoose for the
978 initial idea, testing and sponsorship of this function.
980 Provide a sane error message when someone attempts to
981 match a tag in --dhcp-host.
983 Tweak the behaviour of --domain-needed, to avoid problems
984 with recursive nameservers downstream of dnsmasq. The new
985 behaviour only stops A and AAAA queries, and returns
986 NODATA rather than NXDOMAIN replies.
988 Efficiency fix for very large DHCP configurations, thanks
989 to James Gartrell and Mike Ruiz for help with this.
991 Allow the TFTP-server address in --dhcp-boot to be a
992 domain-name which is looked up in /etc/hosts. This can
993 give multiple IP addresses which are used round-robin,
994 thus doing TFTP server load-balancing. Thanks to Sushil
995 Agrawal for the patch.
997 When two tagged dhcp-options for a particular option
998 number are both valid, use the one which is valid without
999 a tag from the dhcp-range. Allows overriding of the value
1000 of a DHCP option for a particular host as well as
1001 per-network values. So
1002 --dhcp-range=set:interface1,......
1003 --dhcp-host=set:myhost,.....
1004 --dhcp-option=tag:interface1,option:nis-domain,"domain1"
1005 --dhcp-option=tag:myhost,option:nis-domain,"domain2"
1006 will set the NIS-domain to domain1 for hosts in the range, but
1007 override that to domain2 for a particular host.
1009 Fix bug which resulted in truncated files and timeouts for
1010 some TFTP transfers. The bug only occurs with netascii
1011 transfers and needs an unfortunate relationship between
1012 file size, blocksize and the number of newlines in the
1013 last block before it manifests itself. Many thanks to
1014 Alkis Georgopoulos for spotting the problem and providing
1015 a comprehensive test-case.
1017 Fix regression in TFTP server on *BSD platforms introduced
1018 in version 2.56, due to confusion with sockaddr
1019 length. Many thanks to Loic Pefferkorn for finding this.
1021 Support scope-ids in IPv6 addresses of nameservers from
1022 /etc/resolv.conf and in --server options. Eg
1023 nameserver fe80::202:a412:4512:7bbf%eth0 or
1024 server=fe80::202:a412:4512:7bbf%eth0. Thanks to
1025 Michael Stapelberg for the suggestion.
1027 Update Polish translation, thanks to Jan Psota.
1029 Update French translation. Thanks to Gildas Le Nadan.
1033 Add patches to allow build under Android.
1035 Provide our own header for the DNS protocol, rather than
1036 relying on arpa/nameser.h. This has proved more or less
1037 defective over the years and the final straw is that it's
1038 effectively empty on Android.
1040 Fix regression in 2.56 which caused hex constants in
1041 configuration to be rejected if they contain the '*'
1044 Correct wrong casts of arguments to ctype.h functions,
1045 isdigit(), isxdigit() etc. Thanks to Matthias Andree for
1048 Allow build with IDN support independently from i18n.
1049 IDN support continues to be included automatically
1050 when i18n is included.
1051 'make COPTS=-DHAVE_IDN' is the magic incantation.
1053 Modify check on extraneous command line junk (added in
1054 2.56) so that it doesn't complain about extra _empty_
1055 arguments. Otherwise this breaks libvirt.
1059 Add a patch to allow dnsmasq to get interface names right in a
1060 Solaris zone. Thanks to Dj Padzensky for this.
1062 Improve data-type parsing heuristics so that
1063 --dhcp-option=option:domain-search,.
1064 treats the value as a string and not an IP address.
1065 Thanks to Clemens Fischer for spotting that.
1067 Add IPv6 support to the TFTP server. Many thanks to Jan
1068 'RedBully' Seiffert for the patches.
1070 Log DNS queries at level LOG_INFO, rather then
1071 LOG_DEBUG. This makes things consistent with DHCP
1072 logging. Thanks to Adam Pribyl for spotting the problem.
1074 Ensure that dnsmasq terminates cleanly when using
1075 --syslog-async even if it cannot make a connection to the
1078 Add --add-mac option. This is to support currently
1079 experimental DNS filtering facilities. Thanks to Benjamin
1080 Petrin for the orignal patch.
1082 Fix bug which meant that tags were ignored in dhcp-range
1083 configuration specifying PXE-proxy service. Thanks to
1084 Cristiano Cumer for spotting this.
1086 Raise an error if there is extra junk, not part of an
1087 option, on the command line.
1089 Flag a couple of log messages in cache.c as coming from
1090 the DHCP subsystem. Thanks to Olaf Westrik for the patch.
1092 Omit timestamps from logs when a) logging to stderr and
1093 b) --keep-in-forground is set. The logging facility on the
1094 other end of stderr can be assumned to supply them. Thanks
1095 to John Hallam for the patch.
1097 Don't complain about strings longer than 255 characters in
1098 --txt-record, just split the long strings into 255
1099 character chunks instead.
1101 Fix crash on double-free. This bug can only happen when
1102 dhcp-script is in use and then only in rare circumstances
1103 triggered by high DHCP transaction rate and a slow
1104 script. Thanks to Ferenc Wagner for finding the problem.
1106 Only log that a file has been sent by TFTP after the
1107 transfer has completed succesfully.
1109 A good suggestion from Ferenc Wagner: extend
1110 the --domain option to allow this sort of thing:
1111 --domain=thekelleys.org.uk,192.168.0.0/24,local
1112 which automatically creates
1113 --local=/thekelleys.org.uk/
1114 --local=/0.168.192.in-addr.arpa/
1116 Tighten up syntax checking of hex contants in the config
1117 file. Thanks to Fred Damen for spotting this.
1119 Add dnsmasq logo/icon, contributed by Justin Swift. Many
1122 Never cache DNS replies which have the 'cd' bit set, or
1123 which result from queries forwarded with the 'cd' bit
1124 set. The 'cd' bit instructs a DNSSEC validating server
1125 upstream to ignore signature failures and return replies
1126 anyway. Without this change it's possible to pollute the
1127 dnsmasq cache with bad data by making a query with the
1128 'cd' bit set and subsequent queries would return this data
1129 without its being marked as suspect. Thanks to Anders
1130 Kaseorg for pointing out this problem.
1132 Add --proxy-dnssec flag, for compliance with RFC
1133 4035. Dnsmasq will now clear the 'ad' bit in answers returned
1134 from upstream validating nameservers unless this option is
1137 Allow a filename of "-" for --conf-file to read
1138 stdin. Suggestion from Timothy Redaelli.
1140 Rotate the order of SRV records in replies, to provide
1141 round-robin load balancing when all the priorities are
1142 equal. Thanks to Peter McKinney for the suggestion.
1145 contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist
1146 so that it doesn't log all queries to a file by
1147 default. Thanks again to Peter McKinney.
1149 By default, setting an IPv4 address for a domain but not
1150 an IPv6 address causes dnsmasq to return
1151 an NODATA reply for IPv6 (or vice-versa). So
1152 --address=/google.com/1.2.3.4 stops IPv6 queries for
1153 *google.com from being forwarded. Make it possible to
1154 override this behaviour by defining the sematics if the
1155 same domain appears in both --server and --address.
1156 In that case, the --address has priority for the address
1157 family in which is appears, but the --server has priority
1158 of the address family which doesn't appear in --adddress
1160 --address=/google.com/1.2.3.4
1161 --server=/google.com/#
1162 will return 1.2.3.4 for IPv4 queries for *.google.com but
1163 forward IPv6 queries to the normal upstream nameserver.
1164 Similarly when setting an IPv6 address
1165 only this will allow forwarding of IPv4 queries. Thanks to
1166 William for pointing out the need for this.
1168 Allow more than one --dhcp-optsfile and --dhcp-hostsfile
1169 and make them understand directories as arguments in the
1170 same way as --addn-hosts. Suggestion from John Hanks.
1172 Ignore rebinding requests for leases we don't know
1173 about. Rebind is broadcast, so we might get to overhear a
1174 request meant for another DHCP server. NAKing this is
1175 wrong. Thanks to Brad D'Hondt for assistance with this.
1177 Fix cosmetic bug which produced strange output when
1178 dumping cache statistics with some configurations. Thanks
1179 to Fedor Kozhevnikov for spotting this.
1183 Fix crash when /etc/ethers is in use. Thanks to
1184 Gianluigi Tiesi for finding this.
1186 Fix crash in netlink_multicast(). Thanks to Arno Wald for
1189 Allow the empty domain "." in dhcp domain-search (119)
1194 There is no version 2.54 to avoid confusion with 2.53,
1195 which incorrectly identifies itself as 2.54.
1199 Fix failure to compile on Debian/kFreeBSD. Thanks to
1200 Axel Beckert and Petr Salinger.
1202 Fix code to avoid scary strict-aliasing warnings
1203 generated by gcc 4.4.
1205 Added FAQ entry warning about DHCP failures with Vista
1206 when firewalls block 255.255.255.255.
1208 Fixed bug which caused bad things to happen if a
1209 resolv.conf file which exists is subsequently removed.
1210 Thanks to Nikolai Saoukh for the patch.
1212 Rationalised the DHCP tag system. Every configuration item
1213 which can set a tag does so by adding "set:<tag>" and
1214 every configuration item which is conditional on a tag is
1215 made so by "tag:<tag>". The NOT operator changes to '!',
1216 which is a bit more intuitive too. Dhcp-host directives
1217 can set more than one tag now. The old '#' NOT,
1218 "net:" prefix and no-prefixes are still honoured, so
1219 no existing config file needs to be changed, but
1220 the documentation and new-style config files should be
1221 much less confusing.
1223 Added --tag-if to allow boolean operations on tags.
1224 This allows complicated logic to be clearer and more
1225 general. A great suggestion from Richard Voigt.
1227 Add broadcast/unicast information to DHCP logging.
1229 Allow --dhcp-broadcast to be unconditional.
1231 Fixed incorrect behaviour with NOT <tag> conditionals in
1232 dhcp-options. Thanks to Max Turkewitz for assistance
1235 If we send vendor-class encapsulated options based on the
1236 vendor-class supplied by the client, and no explicit
1237 vendor-class option is given, echo back the vendor-class
1240 Fix bug which stopped dnsmasq from matching both a
1241 circuitid and a remoteid. Thanks to Ignacio Bravo for
1244 Add --dhcp-proxy, which makes it possible to configure
1245 dnsmasq to use a DHCP relay agent as a full proxy, with
1246 all DHCP messages passing through the proxy. This is
1247 useful if the relay adds extra information to the packets
1248 it forwards, but cannot be configured with the RFC 5107
1249 server-override option.
1251 Added interface:<iface name> part to dhcp-range. The
1252 semantics of this are very odd at first sight, but it
1253 allows a single line of the form
1254 dhcp-range=interface:virt0,192.168.0.4,192.168.0.200
1255 to be added to dnsmasq configuration which then supplies
1256 DHCP and DNS services to that interface, without affecting
1257 what services are supplied to other interfaces and
1258 irrespective of the existance or lack of
1259 interface=<interface>
1260 lines elsewhere in the dnsmasq configuration. The idea is
1261 that such a line can be added automatically by libvirt
1262 or equivalent systems, without disturbing any manual
1265 Similarly to the above, allow --enable-tftp=<interface>
1267 Allow a TFTP root to be set separately for requests via
1268 different interfaces, --tftp-root=<path>,<interface>
1270 Correctly handle and log clashes between CNAMES and
1271 DNS names being given to DHCP leases. This fixes a bug
1272 which caused nonsense IP addresses to be logged. Thanks to
1273 Sergei Zhirikov for finding and analysing the problem.
1275 Tweak flush_log so as to avoid leaving the log
1276 file in non-blocking mode. O_NONBLOCK is a property of the
1277 file, not the process/descriptor.
1279 Fix contrib/Solaris10/create_package
1280 (/usr/man -> /usr/share/man) Thanks to Vita Batrla.
1282 Fix a problem where, if a client got a lease, then went
1283 to another subnet and got another lease, then moved back,
1284 it couldn't resume the old lease, but would instead get
1285 a new address. Thanks to Leonardo Rodrigues for spotting
1286 this and testing the fix.
1288 Fix weird bug which sometimes omitted certain characters
1289 from the start of quoted strings in dhcp-options. Thanks
1290 to Dayton Turner for spotting the problem.
1292 Add facility to redirect some domains to the standard
1293 upstream servers: this allows something like
1294 --server=/google.com/1.2.3.4 --server=/www.google.com/#
1295 which will send queries for *.google.com to 1.2.3.4,
1296 except *www.google.com which will be forwarded as usual.
1297 Thanks to AJ Weber for prompting this addition.
1299 Improve the hash-algorithm used to generate IP addresses
1300 from MAC addresses during initial DHCP address
1301 allocation. This improves performance when large numbers
1302 of hosts with similar MAC addresses all try and get an IP
1303 address at the same time. Thanks to Paul Smith for his
1306 Tweak DHCP code so that --bridge-interface can be used to
1307 select which IP alias of an interface should be used for
1308 DHCP purposes on Linux. If eth0 has an alias eth0:dhcp
1309 then adding --bridge-interface=eth0:dhcp,eth0 will use
1310 the address of eth0:dhcp to determine the correct subnet
1311 for DHCP address allocation. Thanks to Pawel Golaszewski
1312 for prompting this and Eric Cooper for further testing.
1314 Add --dhcp-generate-names. Suggestion by Ferenc Wagner.
1316 Tweak DNS server selection algorithm when there is more
1317 than one server available for a domain, eg.
1318 --server=/mydomain/1.1.1.1
1319 --server=/mydomain/2.2.2.2
1320 Thanks to Alberto Cuesta-Canada for spotting a weakness
1323 Add --max-ttl. Thanks to Fredrik Ringertz for the patch.
1325 Allow --log-facility=- to force all logging to
1326 stderr. Suggestion from Clemens Fischer.
1328 Fix regression which caused configuration like
1329 --address=/.domain.com/1.2.3.4 to be rejected. The dot to the
1330 left of the domain has been implied and not required for a
1331 long time, but it should be accepted for backward
1332 compatibility. Thanks to Andrew Burcin for spotting this.
1334 Add --rebind-domain-ok and --rebind-localhost-ok.
1335 Suggestion from Clemens Fischer.
1337 Log replies to queries of type TXT, when --log-queries
1340 Fix compiler warnings when compiled with -DNO_DHCP. Thanks
1341 to Shantanu Gadgil for the patch.
1343 Updated French translation. Thanks to Gildas Le Nadan.
1345 Updated Polish translation. Thanks to Jan Psota.
1347 Updated German translation. Thanks to Matthias Andree.
1349 Added contrib/static-arp, thanks to Darren Hoo.
1351 Fix corruption of the domain when a name from /etc/hosts
1352 overrides one supplied by a DHCP client. Thanks to Fedor
1353 Kozhevnikov for spotting the problem.
1355 Updated Spanish translation. Thanks to Chris Chatham.
1359 Work around a Linux kernel bug which insists that the
1360 length of the option passed to setsockopt must be at least
1361 sizeof(int) bytes, even if we're calling SO_BINDTODEVICE
1362 and the device name is "lo". Note that this is fixed
1363 in kernel 2.6.31, but the workaround is harmless and
1364 allows earlier kernels to be used. Also fix dnsmasq
1365 bug which reported the wrong address when this failed.
1366 Thanks to Fedor for finding this.
1368 The API for IPv6 PKTINFO changed around Linux kernel
1369 2.6.14. Workaround the case where dnsmasq is compiled
1370 against newer headers, but then run on an old kernel:
1371 necessary for some *WRT distros.
1373 Re-read the set of network interfaces when re-loading
1374 /etc/resolv.conf if --bind-interfaces is not set. This
1375 handles the case that loopback interfaces do not exist
1376 when dnsmasq is first started.
1378 Tweak the PXE code to support port 4011. This should
1379 reduce broadcasts and make things more reliable when other
1380 servers are around. It also improves inter-operability
1381 with certain clients.
1383 Make a pxe-service configuration with no filename or boot
1384 service type legal: this does a local boot. eg.
1385 pxe-service=x86PC, "Local boot"
1387 Be more conservative in detecting "A for A"
1388 queries. Dnsmasq checks if the name in a type=A query looks
1389 like a dotted-quad IP address and answers the query itself
1390 if so, rather than forwarding it. Previously dnsmasq
1391 relied in the library function inet_addr() to convert
1392 addresses, and that will accept some things which are
1393 confusing in this context, like 1.2.3 or even just
1394 1234. Now we only do A for A processing for four decimal
1395 numbers delimited by dots.
1397 A couple of tweaks to fix compilation on Solaris. Thanks
1398 to Joel Macklow for help with this.
1400 Another Solaris compilation tweak, needed for Solaris
1401 2009.06. Thanks to Lee Essen for that.
1403 Added extract packaging stuff from Lee Essen to
1406 Increased the default limit on number of leases to 1000
1407 (from 150). This is mainly a defence against DoS attacks,
1408 and for the average "one for two class C networks"
1409 installation, IP address exhaustion does that just as
1410 well. Making the limit greater than the number of IP
1411 addresses available in such an installation removes a
1412 surprise which otherwise can catch people out.
1414 Removed extraneous trailing space in the value of the
1415 DNSMASQ_TIME_REMAINING DNSMASQ_LEASE_LENGTH and
1416 DNSMASQ_LEASE_EXPIRES environment variables. Thanks to
1417 Gildas Le Nadan for spotting this.
1419 Provide the network-id tags for a DHCP transaction to
1420 the lease-change script in the environment variable
1421 DNSMASQ_TAGS. A good suggestion from Gildas Le Nadan.
1423 Add support for RFC3925 "Vendor-Identifying Vendor
1424 Options". The syntax looks like this:
1425 --dhcp-option=vi-encap:<enterprise number>, .........
1427 Add support to --dhcp-match to allow matching against
1428 RFC3925 "Vendor-Identifying Vendor Classes". The syntax
1430 --dhcp-match=tag,vi-encap<enterprise number>, <value>
1432 Add some application specific code to assist in
1433 implementing the Broadband forum TR069 CPE-WAN
1434 specification. The details are in contrib/CPE-WAN/README
1436 Increase the default DNS packet size limit to 4096, as
1437 recommended by RFC5625 section 4.4.3. This can be
1438 reconfigured using --edns-packet-max if needed. Thanks to
1439 Francis Dupont for pointing this out.
1441 Rewrite query-ids even for TSIG signed packets, since
1442 this is allowed by RFC5625 section 4.5.
1444 Use getopt_long by default on OS X. It has been supported
1445 since version 10.3.0. Thanks to Arek Dreyer for spotting
1448 Added up-to-date startup configuration for MacOSX/launchd
1449 in contrib/MacOSX-launchd. Thanks to Arek Dreyer for
1452 Fix link error when including Dbus but excluding DHCP.
1453 Thanks to Oschtan for the bug report.
1455 Updated French translation. Thanks to Gildas Le Nadan.
1457 Updated Polish translation. Thanks to Jan Psota.
1459 Updated Spanish translation. Thanks to Chris Chatham.
1461 Fixed confusion about domains, when looking up DHCP hosts
1462 in /etc/hosts. This could cause spurious "Ignoring
1463 domain..." messages. Thanks to Fedor Kozhevnikov for
1464 finding and analysing the problem.
1468 Add support for internationalised DNS. Non-ASCII characters
1469 in domain names found in /etc/hosts, /etc/ethers and
1470 /etc/dnsmasq.conf will be correctly handled by translation to
1471 punycode, as specified in RFC3490. This function is only
1472 available if dnsmasq is compiled with internationalisation
1473 support, and adds a dependency on GNU libidn. Without i18n
1474 support, dnsmasq continues to be compilable with just
1475 standard tools. Thanks to Yves Dorfsman for the
1478 Add two more environment variables for lease-change scripts:
1479 First, DNSMASQ_SUPPLIED_HOSTNAME; this is set to the hostname
1480 supplied by a client, even if the actual hostname used is
1481 over-ridden by dhcp-host or dhcp-ignore-names directives.
1482 Also DNSMASQ_RELAY_ADDRESS which gives the address of
1483 a DHCP relay, if used.
1484 Suggestions from Michael Rack.
1486 Fix regression which broke echo of relay-agent
1487 options. Thanks to Michael Rack for spotting this.
1489 Don't treat option 67 as being interchangeable with
1490 dhcp-boot parameters if it's specified as
1493 Make the code to call scripts on lease-change compile-time
1494 optional. It can be switched off by editing src/config.h
1495 or building with "make COPTS=-DNO_SCRIPT".
1497 Make the TFTP server cope with filenames from Windows/DOS
1498 which use '\' as pathname separator. Thanks to Ralf for
1501 Updated Polish translation. Thanks to Jan Psota.
1503 Warn if an IP address is duplicated in /etc/ethers. Thanks
1504 to Felix Schwarz for pointing this out.
1506 Teach --conf-dir to take an option list of file suffices
1507 which will be ignored when scanning the directory. Useful
1508 for backup files etc. Thanks to Helmut Hullen for the
1511 Add new DHCP option named tftpserver-address, which
1512 corresponds to the third argument of dhcp-boot. This
1513 allows the complete functionality of dhcp-boot to be
1514 replicated with dhcp-option. Useful when using
1517 Test which upstream nameserver to use every 10 seconds
1518 or 50 queries and not just when a query times out and
1519 is retried. This should improve performance when there
1520 is a slow nameserver in the list. Thanks to Joe for the
1523 Don't do any PXE processing, even for clients with the
1524 correct vendorclass, unless at least one pxe-prompt or
1525 pxe-service option is given. This stops dnsmasq
1526 interfering with proxy PXE subsystems when it is just
1527 the DHCP server. Thanks to Spencer Clark for spotting this.
1529 Limit the blocksize used for TFTP transfers to a value
1530 which avoids packet fragmentation, based on the MTU of the
1531 local interface. Many netboot ROMs can't cope with
1534 Honour dhcp-ignore configuration for PXE and proxy-PXE
1535 requests. Thanks to Niels Basjes for the bug report.
1537 Updated French translation. Thanks to Gildas Le Nadan.
1541 Fix security problem which allowed any host permitted to
1542 do TFTP to possibly compromise dnsmasq by remote buffer
1543 overflow when TFTP enabled. Thanks to Core Security
1544 Technologies and Iván Arce, Pablo Hernán Jorge, Alejandro
1545 Pablo Rodriguez, Martín Coco, Alberto Soliño Testa and
1546 Pablo Annetta. This problem has Bugtraq id: 36121
1549 Fix a problem which allowed a malicious TFTP client to
1550 crash dnsmasq. Thanks to Steve Grubb at Red Hat for
1551 spotting this. This problem has Bugtraq id: 36120 and
1556 Fix regression in 2.48 which disables the lease-change
1557 script. Thanks to Jose Luis Duran for spotting this.
1559 Log TFTP "file not found" errors. These were not logged,
1560 since a normal PXELinux boot generates many of them, but
1561 the lack of the messages seems to be more confusing than
1562 routinely seeing them when there is no real error.
1564 Update Spanish translation. Thanks to Chris Chatham.
1568 Archived the extensive, backwards, changelog to
1569 CHANGELOG.archive. The current changelog now runs from
1570 version 2.43 and runs conventionally.
1572 Fixed bug which broke binding of servers to physical
1573 interfaces when interface names were longer than four
1574 characters. Thanks to MURASE Katsunori for the patch.
1576 Fixed netlink code to check that messages come from the
1577 correct source, and not another userspace process. Thanks
1578 to Steve Grubb for the patch.
1580 Maintainability drive: removed bug and missing feature
1581 workarounds for some old platforms. Solaris 9, OpenBSD
1582 older than 4.1, Glibc older than 2.2, Linux 2.2.x and
1583 DBus older than 1.1.x are no longer supported.
1585 Don't read included configuration files more than once:
1586 allows complex configuration structures without problems.
1588 Mark log messages from the various subsystems in dnsmasq:
1589 messages from the DHCP subsystem now have the ident string
1590 "dnsmasq-dhcp" and messages from TFTP have ident
1591 "dnsmasq-tftp". Thanks to Olaf Westrik for the patch.
1593 Fix possible infinite DHCP protocol loop when an IP
1594 address nailed to a hostname (not a MAC address) and a
1595 host sometimes provides the name, sometimes not.
1597 Allow --addn-hosts to take a directory: all the files
1598 in the directory are read. Thanks to Phil Cornelius for
1601 Support --bridge-interface on all platforms, not just BSD.
1603 Added support for advanced PXE functions. It's now
1604 possible to define a prompt and menu options which will
1605 be displayed when a client PXE boots. It's also possible to
1606 hand-off booting to other boot servers. Proxy-DHCP, where
1607 dnsmasq just supplies the PXE information and another DHCP
1608 server does address allocation, is also allowed. See the
1609 --pxe-prompt and --pxe-service keywords. Thanks to
1610 Alkis Georgopoulos for the suggestion and Guilherme Moro
1611 and Michael Brown for assistance.
1613 Improvements to DHCP logging. Thanks to Tom Metro for
1616 Add ability to build dnsmasq without DHCP support. To do
1617 this, edit src/config.h or build with
1618 "make COPTS=-DNO_DHCP". Thanks to Mahavir Jain for the patch.
1620 Added --test command-line switch - syntax check
1621 configuration files only.
1623 Updated French translation. Thanks to Gildas Le Nadan.
1627 Updated French translation. Thanks to Gildas Le Nadan.
1629 Fixed interface enumeration code to work on NetBSD
1630 5.0. Thanks to Roy Marples for the patch.
1632 Updated config.h to use the same location for the lease
1633 file on NetBSD as the other *BSD variants. Also allow
1634 LEASEFILE and CONFFILE symbols to be overriden in CFLAGS.
1636 Handle duplicate address detection on IPv6 more
1637 intelligently. In IPv6, an interface can have an address
1638 which is not usable, because it is still undergoing DAD
1639 (such addresses are marked "tentative"). Attempting to
1640 bind to an address in this state returns an error,
1641 EADDRNOTAVAIL. Previously, on getting such an error,
1642 dnsmasq would silently abandon the address, and never
1643 listen on it. Now, it retries once per second for 20
1644 seconds before generating a fatal error. 20 seconds should
1645 be long enough for any DAD process to complete, but can be
1646 adjusted in src/config.h if necessary. Thanks to Martin
1647 Krafft for the bug report.
1649 Add DBus introspection. Patch from Jeremy Laine.
1651 Update Dbus configuration file. Patch from Colin Walters.
1653 http://bugs.freedesktop.org/show_bug.cgi?id=18961
1655 Support arbitrarily encapsulated DHCP options, suggestion
1656 and initial patch from Samium Gromoff. This is useful for
1657 (eg) gPXE, which expect all its private options to be
1658 encapsulated inside a single option 175. So, eg,
1660 dhcp-option = encap:175, 190, "iscsi-client0"
1661 dhcp-option = encap:175, 191, "iscsi-client0-secret"
1663 will provide iSCSI parameters to gPXE.
1665 Enhance --dhcp-match to allow testing of the contents of a
1666 client-sent option, as well as its presence. This
1667 application in mind for this is RFC 4578
1668 client-architecture specifiers, but it's generally useful.
1669 Joey Korkames suggested the enhancement.
1671 Move from using the IP_XMIT_IF ioctl to IP_BOUND_IF on
1672 OpenSolaris. Thanks to Bastian Machek for the heads-up.
1674 No longer complain about blank lines in
1675 /etc/ethers. Thanks to Jon Nelson for the patch.
1677 Fix binding of servers to physical devices, eg
1678 --server=/domain/1.2.3.4@eth0 which was broken from 2.43
1679 onwards unless --query-port=0 set. Thanks to Peter Naulls
1682 Reply to DHCPINFORM requests even when the supplied ciaddr
1683 doesn't fall in any dhcp-range. In this case it's not
1684 possible to supply a complete configuration, but
1685 individually-configured options (eg PAC) may be useful.
1687 Allow the source address of an alias to be a range:
1688 --alias=192.168.0.0,10.0.0.0,255.255.255.0 maps the whole
1689 subnet 192.168.0.0->192.168.0.255 to 10.0.0.0->10.0.0.255,
1691 --alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0
1692 maps only the 192.168.0.10->192.168.0.40 region. Thanks to
1693 Ib Uhrskov for the suggestion.
1695 Don't dynamically allocate DHCP addresses which may break
1696 Windows. Addresses which end in .255 or .0 are broken in
1697 Windows even when using supernetting.
1698 --dhcp-range=192.168.0.1,192.168.1.254,255,255,254.0 means
1699 192.168.0.255 is a valid IP address, but not for Windows.
1700 See Microsoft KB281579. We therefore no longer allocate
1701 these addresses to avoid hard-to-diagnose problems.
1703 Update Polish translation. Thanks to Jan Psota.
1705 Delete the PID-file when dnsmasq shuts down. Note that by
1706 this time, dnsmasq is normally not running as root, so
1707 this will fail if the PID-file is stored in a root-owned
1708 directory; such failure is silently ignored. To take
1709 advantage of this feature, the PID-file must be stored in a
1710 directory owned and write-able by the user running
1715 Allow --bootp-dynamic to take a netid tag, so that it may
1716 be selectively enabled. Thanks to Olaf Westrik for the
1719 Remove ISC-leasefile reading code. This has been
1720 deprecated for a long time, and last time I removed it, it
1721 ended up going back by request of one user. This time,
1722 it's gone for good; otherwise it would need to be
1723 re-worked to support multiple domains (see below).
1725 Support DHCP clients in multiple DNS domains. This is a
1726 long-standing request. Clients are assigned to a domain
1727 based in their IP address.
1729 Add --dhcp-fqdn flag, which changes behaviour if DNS names
1730 assigned to DHCP clients. When this is set, there must be
1731 a domain associated with each client, and only
1732 fully-qualified domain names are added to the DNS. The
1733 advantage is that the only the FQDN needs to be unique,
1734 so that two or more DHCP clients can share a hostname, as
1735 long as they are in different domains.
1737 Set environment variable DNSMASQ_DOMAIN when invoking
1738 lease-change script. This may be useful information to
1739 have now that it's variable.
1741 Tighten up data-checking code for DNS packet
1742 handling. Thanks to Steve Dodd who found certain illegal
1743 packets which could crash dnsmasq. No memory overwrite was
1744 possible, so this is not a security issue beyond the DoS
1747 Update example config dhcp option 47, the previous
1748 suggestion generated an illegal, zero-length,
1749 option. Thanks to Matthias Andree for finding this.
1751 Rewrite hosts-file reading code to remove the limit of
1752 1024 characters per line. John C Meuser found this.
1754 Create a net-id tag with the name of the interface on
1755 which the DHCP request was received.
1757 Fixed minor memory leak in DBus code, thanks to Jeremy
1758 Laine for the patch.
1760 Emit DBus signals as the DHCP lease database
1761 changes. Thanks to Jeremy Laine for the patch.
1763 Allow for more that one MAC address in a dhcp-host
1764 line. This configuration tells dnsmasq that it's OK to
1765 abandon a DHCP lease of the fixed address to one MAC
1766 address, if another MAC address in the dhcp-host statement
1767 asks for an address. This is useful to give a fixed
1768 address to a host which has two network interfaces
1769 (say, a laptop with wired and wireless interfaces.)
1770 It's very important to ensure that only one interface
1771 at a time is up, since dnsmasq abandons the first lease
1772 and re-uses the address before the leased time has
1773 elapsed. John Gray suggested this.
1775 Tweak the response to a DHCP request packet with a wrong
1776 server-id when --dhcp-authoritative is set; dnsmasq now
1777 returns a DHCPNAK, rather than silently ignoring the
1778 packet. Thanks to Chris Marget for spotting this
1781 Add --cname option. This provides a limited alias
1782 function, usable for DHCP names. Thanks to AJ Weber for
1783 suggestions on this.
1785 Updated contrib/webmin with latest version from Neil
1788 Updated Polish translation. Thanks to Jan Psota.
1790 Correct the text names for DHCP options 64 and 65 to be
1791 "nis+-domain" and "nis+-servers".
1793 Updated Spanish translation. Thanks to Chris Chatham.
1795 Force re-reading of /etc/resolv.conf when an "interface
1800 Fix total DNS failure in release 2.44 unless --min-port
1801 specified. Thanks to Steven Barth and Grant Coady for
1802 bugreport. Also reject out-of-range port spec, which could
1803 break things too: suggestion from Gilles Espinasse.
1807 Fix crash when unknown client attempts to renew a DHCP
1808 lease, problem introduced in version 2.43. Thanks to
1809 Carlos Carvalho for help chasing this down.
1811 Fix potential crash when a host which doesn't have a lease
1812 does DHCPINFORM. Again introduced in 2.43. This bug has
1813 never been reported in the wild.
1815 Fix crash in netlink code introduced in 2.43. Thanks to
1816 Jean Wolter for finding this.
1818 Change implementation of min_port to work even if min-port
1821 Patch to enable compilation of latest Mac OS X. Thanks to
1824 Update Spanish translation. Thanks to Christopher Chatham.
1828 Updated Polish translation. Thanks to Jan Psota.
1830 Flag errors when configuration options are repeated
1833 Further tweaks for GNU/kFreeBSD
1835 Add --no-wrap to msgmerge call - provides nicer .po file
1838 Honour lease-time spec in dhcp-host lines even for
1839 BOOTP. The user is assumed to known what they are doing in
1840 this case. (Hosts without the time spec still get infinite
1841 leases for BOOTP, over-riding the default in the
1842 dhcp-range.) Thanks to Peter Katzmann for uncovering this.
1844 Fix problem matching relay-agent ids. Thanks to Michael
1845 Rack for the bug report.
1847 Add --naptr-record option. Suggestion from Johan
1850 Implement RFC 5107 server-id-override DHCP relay agent
1853 Apply patches from Stefan Kruger for compilation on
1854 Solaris 10 under Sun studio.
1856 Yet more tweaking of Linux capability code, to suppress
1857 pointless wingeing from kernel 2.6.25 and above.
1859 Improve error checking during startup. Previously, some
1860 errors which occurred during startup would be worked
1861 around, with dnsmasq still starting up. Some were logged,
1862 some silent. Now, they all cause a fatal error and dnsmasq
1863 terminates with a non-zero exit code. The errors are those
1864 associated with changing uid and gid, setting process
1865 capabilities and writing the pidfile. Thanks to Uwe
1866 Gansert and the Suse security team for pointing out
1867 this improvement, and Bill Reimers for good implementation
1870 Provide NO_LARGEFILE compile option to switch off largefile
1871 support when compiling against versions of uclibc which
1872 don't support it. Thanks to Stephane Billiart for the patch.
1874 Implement random source ports for interactions with
1875 upstream nameservers. New spoofing attacks have been found
1876 against nameservers which do not do this, though it is not
1877 clear if dnsmasq is vulnerable, since to doesn't implement
1878 recursion. By default dnsmasq will now use a different
1879 source port (and socket) for each query it sends
1880 upstream. This behaviour can suppressed using the
1881 --query-port option, and the old default behaviour
1882 restored using --query-port=0. Explicit source-port
1883 specifications in --server configs are still honoured.
1885 Replace the random number generator, for better
1886 security. On most BSD systems, dnsmasq uses the
1887 arc4random() RNG, which is secure, but on other platforms,
1888 it relied on the C-library RNG, which may be
1889 guessable and therefore allow spoofing. This release
1890 replaces the libc RNG with the SURF RNG, from Daniel
1891 J. Berstein's DJBDNS package.
1893 Don't attempt to change user or group or set capabilities
1894 if dnsmasq is run as a non-root user. Without this, the
1895 change from soft to hard errors when these fail causes
1896 problems for non-root daemons listening on high
1897 ports. Thanks to Patrick McLean for spotting this.
1899 Updated French translation. Thanks to Gildas Le Nadan.
1903 The changelog for version 2.42 and earlier is
1904 available in CHANGELOG.archive.
projects / people / ms / dnsmasq.git / blob