blob: 111764f105a27da9ca322b94d779de4d6a01e759 [file] [log] [blame]
Simon Kelley294d36d2016-07-06 21:30:25 +01001version 2.77
Simon Kelley903df072017-01-19 17:22:00 +00002 Generate an error when configured with a CNAME loop,
Simon Kelley0740e432017-01-26 18:02:54 +00003 rather than a crash. Thanks to George Metz for
Simon Kelley903df072017-01-19 17:22:00 +00004 spotting this problem.
5
Simon Kelley294d36d2016-07-06 21:30:25 +01006 Calculate the length of TFTP error reply packet
7 correctly. This fixes a problem when the error
8 message in a TFTP packet exceeds the arbitrary
9 limit of 500 characters. The message was correctly
10 truncated, but not the packet length, so
11 extra data was appended. This is a possible
12 security risk, since the extra data comes from
13 a buffer which is also used for DNS, so that
14 previous DNS queries or replies may be leaked.
15 Thanks to Mozilla for funding the security audit
16 which spotted this bug.
17
Ivan Kokshaysky1d076672016-07-11 18:36:05 +010018 Fix logic error in Linux netlink code. This could
19 cause dnsmasq to enter a tight loop on systems
20 with a very large number of network interfaces.
21 Thanks to Ivan Kokshaysky for the diagnosis and
22 patch.
23
Kevin Darbyshire-Bryant06093a92016-07-11 21:03:27 +010024 Fix problem with --dnssec-timestamp whereby receipt
25 of SIGHUP would erroneously engage timestamp checking.
26 Thanks to Kevin Darbyshire-Bryant for this work.
Simon Kelleyc8328ec2016-08-05 16:54:58 +010027
28 Bump zone serial on reloading /etc/hosts and friends
29 when providing authoritative DNS. Thanks to Harrald
30 Dunkel for spotting this.
Simon Kelley6d950992016-08-11 23:38:54 +010031
32 Handle v4-mapped IPv6 addresses sanely in --synth-domain.
33 These have standard representation like ::ffff:1.2.3.4
34 and are now converted to names like
35 <prefix>--ffff-1-2-3-4.<domain>
36
Beniamino Galvani2675f202016-08-28 20:44:05 +010037 Handle binding upstream servers to an interface
38 (--server=1.2.3.4@eth0) when the named interface
39 is destroyed and recreated in the kernel. Thanks to
40 Beniamino Galvani for the patch.
41
Simon Kelleyb637d782016-12-13 16:44:11 +000042 Allow wildcard CNAME records in authoritative zones.
43 For example --cname=*.example.com,default.example.com
44 Thanks to Pro Backup for sponsoring this development.
45
Simon Kelley09b768e2016-12-22 22:16:58 +000046 Bump the allowed backlog of TCP connections from 5 to 32,
47 and make this a compile-time configurable option. Thanks
48 to Donatas Abraitis for diagnosing this as a potential
49 problem.
50
ZHAO Yuf89cae32016-12-22 22:32:31 +000051 Add DNSMASQ_REQUESTED_OPTIONS environment variable to the
52 lease-change script. Thanks to ZHAO Yu for the patch.
Simon Kelley294d36d2016-07-06 21:30:25 +010053
klemens43517fc2017-02-19 15:53:37 +000054 Fix foobar in rrfilter code, that could cause malformed
Simon Kelley0740e432017-01-26 18:02:54 +000055 replies, especially when DNSSEC validation on, and
56 the upstream server returns answer with the RRs in a
57 particular order. The only DNS server known to tickle
58 this is Nominum's. Thanks to Dave Täht for spotting the
59 bug and assisting in the fix.
60
Simon Kelleyd42d4702017-02-02 16:52:06 +000061 Fix the manpage which lied that only the primary address
62 of an interface is used by --interface-name.
63
64 Make --localise-queries apply to names from --interface-name.
65 Thanks to Kevin Darbyshire-Bryant and Eric Luehrsen
66 for pushing this.
67
klemens43517fc2017-02-19 15:53:37 +000068 Improve connection handling when talking to TCP upstream
Simon Kelley361dfe52017-02-10 21:12:30 +000069 servers. Specifically, be prepared to open a new TCP
70 connection when we want to make multiple queries
71 but the upstream server accepts fewer queries per connection.
Hannu Nyman3e2496f2017-02-11 13:44:08 +000072
73 Improve logging of upstream servers when there are a lot
74 of "local addresses only" entries. Thanks to Hannu Nyman for
75 the patch.
Simon Kelley361dfe52017-02-10 21:12:30 +000076
Simon Kelley88a77a72017-02-11 17:02:02 +000077 Implement RFC 6842. Thanks to Reddeiah Raju Konduru for
78 pointing out that this was missing.
79
Simon Kelleyfca008d2017-02-19 18:50:41 +000080 Make --bogus-priv apply to IPv6, for the prefixes specified
81 in RFC6303. Thanks to Kevin Darbyshire-Bryant for work on this.
Floris Bos60704f52017-04-09 22:22:49 +010082
83 Allow use of MAC addresses with --tftp-unique-root. Thanks
84 to Floris Bos for the patch.
Floris Bos503c6092017-04-09 23:07:13 +010085
86 Add --dhcp-reply-delay option. Thanks to Floris Bos
87 for the patch.
David Flamand005c46d2017-04-11 11:49:54 +010088
89 Add mtu setting facility to --ra-param. Thanks to David
90 Flamand for the patch.
Petr Menšíkc77fb9d2017-04-16 20:20:08 +010091
92 Capture STDOUT and STDERR output from dhcp-script and log
93 it as part of the dnsmasq log stream. Makes life easier
94 for diagnosing unexpected problems in scripts.
95 Thanks to Petr Mensik for the patch.
96
Petr Menšík3a8b0f62017-04-23 14:12:37 +010097 Generate fatal errors when failing to parse the output
98 of the dhcp-script in "init" mode. Avoids strange errors
99 when the script accidentally emits error messages.
100 Thanks to Petr Mensik for the patch.
101
Vladislav Grishenko5a7212c2017-04-24 22:19:57 +0100102 Make --rev-server for an RFC1918 subnet work even in the
103 presence of the --bogus-priv flag. Thanks to
104 Vladislav Grishenko for the patch.
Simon Kelley88a77a72017-02-11 17:02:02 +0000105
Vladislav Grishenko6ec5f5c2017-04-24 22:34:45 +0100106 Extend --ra-param mtu: field to allow an interface name.
107 This allows the MTU of a WAN interface to be advertised on
108 the internal interfaces of a router. Thanks to
109 Vladislav Grishenko for the patch.
110
Simon Kelley5ce3e762017-04-28 22:14:20 +0100111 Do ICMP-ping check for address-in-use for DHCPv4 when
112 the client specifies an address in DHCPDISCOVER, and when
113 an address in configured locally. Thanks to Alin Năstac
114 for spotting the problem.
115
Vladislav Grishenko6ec5f5c2017-04-24 22:34:45 +0100116
Simon Kelleyd2aa7df2015-08-03 21:52:12 +0100117version 2.76
118 Include 0.0.0.0/8 in DNS rebind checks. This range
119 translates to hosts on the local network, or, at
120 least, 0.0.0.0 accesses the local host, so could
121 be targets for DNS rebinding. See RFC 5735 section 3
122 for details. Thanks to Stephen Röttger for the bug report.
Floris Bos503c6092017-04-09 23:07:13 +0100123
Ed Bardsleya7369be2015-08-05 21:17:18 +0100124 Enhance --add-subnet to allow arbitrary subnet addresses.
125 Thanks to Ed Barsley for the patch.
Simon Kelley77607cb2015-09-10 23:08:43 +0100126
127 Respect the --no-resolv flag in inotify code. Fixes bug
128 which caused dnsmasq to fail to start if a resolv-file
129 was a dangling symbolic link, even of --no-resolv set.
130 Thanks to Alexander Kurtz for spotting the problem.
131
Edwin Török41a8d9e2015-11-14 17:45:48 +0000132 Fix crash when an A or AAAA record is defined locally,
133 in a hosts file, and an upstream server sends a reply
134 that the same name is empty. Thanks to Edwin Török for
135 the patch.
136
André Glüpkereddf3652016-01-12 12:54:17 +0000137 Fix failure to correctly calculate cache-size when
138 reading a hosts-file fails. Thanks to André Glüpker
139 for the patch.
140
Simon Kelleyd05dd582016-01-19 21:23:30 +0000141 Fix wrong answer to simple name query when --domain-needed
142 set, but no upstream servers configured. Dnsmasq returned
143 REFUSED, in this case, when it should be the same as when
144 upstream servers are configured - NOERROR. Thanks to
145 Allain Legacy for spotting the problem.
146
147 Return REFUSED when running out of forwarding table slots,
148 not SERVFAIL.
149
Hans Dedecker926332a2016-01-23 10:48:12 +0000150 Add --max-port configuration. Thanks to Hans Dedecker for
151 the patch.
Simon Kelley1e505122016-01-25 21:29:23 +0000152
153 Add --script-arp and two new functions for the dhcp-script.
154 These are "arp" and "arp-old" which announce the arrival and
Josh Soref730c6742017-02-06 16:14:04 +0000155 removal of entries in the ARP or neighbour tables.
Simon Kelley1e505122016-01-25 21:29:23 +0000156
157 Extend --add-mac to allow a new encoding of the MAC address
Josh Soref730c6742017-02-06 16:14:04 +0000158 as base64, by configuring --add-mac=base64
Simon Kelleyfdc97e12016-02-13 17:47:17 +0000159
Simon Kelley1e505122016-01-25 21:29:23 +0000160 Add --add-cpe-id option.
161
Simon Kelleyfdc97e12016-02-13 17:47:17 +0000162 Don't crash with divide-by-zero if an IPv6 dhcp-range
163 is declared as a whole /64.
164 (ie xx::0 to xx::ffff:ffff:ffff:ffff)
165 Thanks to Laurent Bendel for spotting this problem.
166
Simon Kelleye06e6e32016-02-24 21:26:16 +0000167 Add support for a TTL parameter in --host-record and
168 --cname.
169
170 Add --dhcp-ttl option.
Simon Kelleyfdc97e12016-02-13 17:47:17 +0000171
Simon Kelleybec366b2016-02-24 22:03:26 +0000172 Add --tftp-mtu option. Thanks to Patrick McLean for the
173 initial patch.
174
Simon Kelleya2bc2542016-04-21 22:34:22 +0100175 Check return-code of inet_pton() when parsing dhcp-option.
176 Bad addresses could fail to generate errors and result in
177 garbage dhcp-options being sent. Thanks to Marc Branchaud
178 for spotting this.
179
Simon Kelley14ffa072016-04-25 16:36:44 +0100180 Fix wrong value for EDNS UDP packet size when using
181 --servers-file to define upstream DNS servers. Thanks to
182 Scott Bonar for the bug report.
183
Simon Kelley69cbf782016-05-03 21:33:38 +0100184 Move the dhcp_release and dhcp_lease_time tools from
185 contrib/wrt to contrib/lease-tools.
186
187 Add dhcp_release6 to contrib/lease-tools. Many thanks
188 to Sergey Nechaev for this code.
189
Simon Kelleyb9702602016-05-03 22:34:06 +0100190 To avoid filling logs in configurations which define
191 many upstream nameservers, don't log more that 30 servers.
192 The number to be logged can be changed as SERVERS_LOGGED
Simon Kelley68bea102016-05-11 22:15:06 +0100193 in src/config.h.
194
195 Swap the values if BC_EFI and x86-64_EFI in --pxe-service.
196 These were previously wrong due to an error in RFC 4578.
197 If you're using BC_EFI to boot 64-bit EFI machines, you
198 will need to update your config.
199
200 Add ARM32_EFI and ARM64_EFI as valid architectures in
201 --pxe-service.
Simon Kelleyb9702602016-05-03 22:34:06 +0100202
Simon Kelley0a4a0492016-05-15 20:13:45 +0100203 Fix PXE booting for UEFI architectures. Modify PXE boot
204 sequence in this case to force the client to talk to dnsmasq
205 over port 4011. This makes PXE and especially proxy-DHCP PXE
Josh Soref730c6742017-02-06 16:14:04 +0000206 work with these architectures.
Simon Kelley0a4a0492016-05-15 20:13:45 +0100207
208 Workaround problems with UEFI PXE clients. There exist
209 in the wild PXE clients which have problems with PXE
210 boot menus. To work around this, when there's a single
211 --pxe-service which applies to client, then that target
212 will be booted directly, rather then sending a
213 single-item boot menu.
214
215 Many thanks to Jarek Polok, Michael Kuron and Dreamcat4
216 for their work on the long-standing UEFI PXE problem.
217
Simon Kelleyda2cad42016-05-18 15:14:08 +0100218 Subtle change in the semantics of "basename" in
219 --pxe-service. The historical behaviour has always been
220 that the actual filename downloaded from the TFTP server
221 is <basename>.<layer> where <layer> is an integer which
222 corresponds to the layer parameter supplied by the client.
223 It's not clear what the function of the "layer"
224 actually is in the PXE protocol, and in practise layer
225 is always zero, so the filename is <basename>.0
226 The new behaviour is the same as the old, except when
227 <basename> includes a file suffix, in which case
228 the layer suffix is no longer added. This allows
229 sensible suffices to be used, rather then the
230 meaningless ".0". Only in the unlikely event that you
231 have a config with a basename which already has a
232 suffix, is this an incompatible change, since the file
233 downloaded will change from name.suffix.0 to just
234 name.suffix
235
Simon Kelleybec366b2016-02-24 22:03:26 +0000236
Simon Kelley63ec5d12015-07-30 20:59:07 +0100237version 2.75
238 Fix reversion on 2.74 which caused 100% CPU use when a
239 dhcp-script is configured. Thanks to Adrian Davey for
240 reporting the bug and testing the fix.
241
242
Simon Kelley90cb2222015-07-05 21:59:10 +0100243version 2.74
244 Fix reversion in 2.73 where --conf-file would attempt to
245 read the default file, rather than no file.
246
Simon Kelley362c9302015-07-06 21:48:49 +0100247 Fix inotify code to handle dangling symlinks better and
248 not SEGV in some circumstances.
249
Simon Kelley13480e82015-07-16 22:23:13 +0100250 DNSSEC fix. In the case of a signed CNAME generated by a
251 wildcard which pointed to an unsigned domain, the wrong
252 status would be logged, and some necessary checks omitted.
253
Simon Kelley362c9302015-07-06 21:48:49 +0100254
Simon Kelley00cd9d52014-10-02 21:44:21 +0100255version 2.73
256 Fix crash at startup when an empty suffix is supplied to
257 --conf-dir, also trivial memory leak. Thanks to
258 Tomas Hozza for spotting this.
Simon Kelley800c5cc2014-12-15 17:50:15 +0000259
260 Remove floor of 4096 on advertised EDNS0 packet size when
261 DNSSEC in use, the original rationale for this has long gone.
262 Thanks to Anders Kaseorg for spotting this.
263
Simon Kelleyad946d52014-12-15 17:52:22 +0000264 Use inotify for checking on updates to /etc/resolv.conf and
265 friends under Linux. This fixes race conditions when the files are
Simon Kelley04918052015-01-26 11:23:43 +0000266 updated rapidly and saves CPU by noy polling. To build
267 a binary that runs on old Linux kernels without inotify,
268 use make COPTS=-DNO_INOTIFY
Simon Kelley3ad3f3b2014-12-16 18:25:17 +0000269
270 Fix breakage of --domain=<domain>,<subnet>,local - only reverse
271 queries were intercepted. THis appears to have been broken
272 since 2.69. Thanks to Josh Stone for finding the bug.
Simon Kelley47669362014-12-17 12:41:56 +0000273
274 Eliminate IPv6 privacy addresses and deprecated addresses from
275 the answers given by --interface-name. Note that reverse queries
276 (ie looking for names, given addresses) are not affected.
277 Thanks to Michael Gorbach for the suggestion.
Simon Kelley094b5c32014-12-21 16:11:52 +0000278
279 Fix crash in DNSSEC code with long RRs. Thanks to Marco Davids
280 for the bug report.
Glen Huang32fc6db2014-12-27 15:28:12 +0000281
282 Add --ignore-address option. Ignore replies to A-record
283 queries which include the specified address. No error is
284 generated, dnsmasq simply continues to listen for another
285 reply. This is useful to defeat blocking strategies which
286 rely on quickly supplying a forged answer to a DNS
287 request for certain domains, before the correct answer can
288 arrive. Thanks to Glen Huang for the patch.
Simon Kelleyad946d52014-12-15 17:52:22 +0000289
Simon Kelley97e618a2015-01-07 21:55:43 +0000290 Revisit the part of DNSSEC validation which determines if an
291 unsigned answer is legit, or is in some part of the DNS
292 tree which should be signed. Dnsmasq now works from the
293 DNS root downward looking for the limit of signed
294 delegations, rather than working bottom up. This is
295 both more correct, and less likely to trip over broken
296 nameservers in the unsigned parts of the DNS tree
297 which don't respond well to DNSSEC queries.
Simon Kelley00cd9d52014-10-02 21:44:21 +0100298
Simon Kelley25cf5e32015-01-09 15:53:03 +0000299 Add --log-queries=extra option, which makes logs easier
300 to search automatically.
301
RinSatsuki28de3872015-01-10 15:22:21 +0000302 Add --min-cache-ttl option. I've resisted this for a long
303 time, on the grounds that disbelieving TTLs is never a
304 good idea, but I've been persuaded that there are
305 sometimes reasons to do it. (Step forward, GFW).
306 To avoid misuse, there's a hard limit on the TTL
Josh Soref730c6742017-02-06 16:14:04 +0000307 floor of one hour. Thanks to RinSatsuki for the patch.
Simon Kelley39341552015-01-18 22:11:10 +0000308
309 Cope with multiple interfaces with the same link-local
310 address. (IPv6 addresses are scoped, so this is allowed.)
311 Thanks to Cory Benfield for help with this.
Simon Kelley5f4dc5c2015-01-20 20:51:02 +0000312
313 Add --dhcp-hostsdir. This allows addition of new host
314 configurations to a running dnsmasq instance much more
315 cheaply than having dnsmasq re-read all its existing
316 configuration each time.
RinSatsuki28de3872015-01-10 15:22:21 +0000317
Win King Wan61b838d2015-01-21 20:41:48 +0000318 Don't reply to DHCPv6 SOLICIT messages if we're not
319 configured to do stateful DHCPv6. Thanks to Win King Wan
320 for the patch.
321
Simon Kelley6ef15b32015-01-31 22:44:26 +0000322 Fix broken DNSSEC validation of ECDSA signatures.
Simon Kelleyf6e62e22015-03-01 18:17:54 +0000323
324 Add --dnssec-timestamp option, which provides an automatic
Simon Kelley38440b22015-04-12 21:52:47 +0100325 way to detect when the system time becomes valid after
326 boot on systems without an RTC, whilst allowing DNS
327 queries before the clock is valid so that NTP can run.
328 Thanks to Kevin Darbyshire-Bryant for developing this idea.
Stefan Tomanek30d08792015-03-31 22:32:11 +0100329
330 Add --tftp-no-fail option. Thanks to Stefan Tomanek for
331 the patch.
Simon Kelley04b0ac02015-04-06 17:19:13 +0100332
Simon Kelley38440b22015-04-12 21:52:47 +0100333 Fix crash caused by looking up servers.bind, CHAOS text
334 record, when more than about five --servers= lines are
335 in the dnsmasq config. This causes memory corruption
336 which causes a crash later. Thanks to Matt Coddington for
337 sterling work chasing this down.
338
339 Fix crash on receipt of certain malformed DNS requests.
340 Thanks to Nick Sampanis for spotting the problem.
Simon Kelley0df29f52015-04-16 15:24:52 +0100341 Note that this is could allow the dnsmasq process's
342 memory to be read by an attacker under certain
343 circumstances, so it has a CVE, CVE-2015-3294
Simon Kelley38440b22015-04-12 21:52:47 +0100344
345 Fix crash in authoritative DNS code, if a .arpa zone
346 is declared as authoritative, and then a PTR query which
347 is not to be treated as authoritative arrived. Normally,
348 directly declaring .arpa zone as authoritative is not
349 done, so this crash wouldn't be seen. Instead the
350 relevant .arpa zone should be specified as a subnet
351 in the auth-zone declaration. Thanks to Johnny S. Lee
352 for the bugreport and initial patch.
Simon Kelley04b0ac02015-04-06 17:19:13 +0100353
Simon Kelley78c61842015-04-16 15:05:30 +0100354 Fix authoritative DNS code to correctly reply to NS
355 and SOA queries for .arpa zones for which we are
356 declared authoritative by means of a subnet in auth-zone.
357 Previously we provided correct answers to PTR queries
358 in such zones (including NS and SOA) but not direct
359 NS and SOA queries. Thanks to Johnny S. Lee for
Simon Kelleya5ae1f82015-04-25 21:46:10 +0100360 pointing out the problem.
361
362 Fix logging of DHCPREPLY which should be suppressed
363 by quiet-dhcp6. Thanks to J. Pablo Abonia for
364 spotting the problem.
Simon Kelley78c61842015-04-16 15:05:30 +0100365
Simon Kelleya77cec82015-05-08 16:25:38 +0100366 Try and handle net connections with broken fragmentation
367 that lose large UDP packets. If a server times out,
368 reduce the maximum UDP packet size field in the EDNS0
369 header to 1280 bytes. If it then answers, make that
370 change permanent.
371
Simon Kelleyb059c962015-05-08 20:25:51 +0100372 Check IPv4-mapped IPv6 addresses when --stop-rebind
373 is active. Thanks to Jordan Milne for spotting this.
374
Simon Kelleyca85a282015-05-13 22:33:04 +0100375 Allow DHCPv4 options T1 and T2 to be set using --dhcp-option.
376 Thanks to Kevin Benton for patches and work on this.
377
Simon Kelley89130d92015-06-03 22:30:59 +0100378 Fix code for DHCPCONFIRM DHCPv6 messages to confirm addresses
379 in the correct subnet, even of not in dynamic address
380 allocation range. Thanks to Steve Hirsch for spotting
381 the problem.
Nicolas Cavallaric6d82c92015-06-09 20:42:20 +0100382
383 Add AddDhcpLease and DeleteDhcpLease DBus methods. Thanks
384 to Nicolas Cavallari for the patch.
Neil Jerram4918bd52015-06-10 22:23:20 +0100385
386 Allow configuration of router advertisements without the
387 "on-link" bit set. Thanks to Neil Jerram for the patch.
388
389 Extend --bridge-interface to DHCPv6 and router
390 advertisements. Thanks to Neil Jerram for the patch.
Simon Kelley89130d92015-06-03 22:30:59 +0100391
Simon Kelley97e618a2015-01-07 21:55:43 +0000392
Simon Kelley8e9ffba2014-05-20 20:38:25 +0100393version 2.72
Simon Kelleyc4a09372014-06-02 20:30:07 +0100394 Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.
395
396 Add support for "ipsets" in *BSD, using pf. Thanks to
Josh Soref730c6742017-02-06 16:14:04 +0000397 Sven Falempin for the patch.
Simon Kelley8e9ffba2014-05-20 20:38:25 +0100398
Simon Kelleya0358e52014-06-07 13:38:48 +0100399 Fix race condition which could lock up dnsmasq when an
400 interface goes down and up rapidly. Thanks to Conrad
401 Kostecki for helping to chase this down.
Daniel Collinsc4638f92014-06-07 21:21:44 +0100402
403 Add DBus methods SetFilterWin2KOption and SetBogusPrivOption
404 Thanks to the Smoothwall project for the patch.
Simon Kelleycdb755c2014-06-18 20:52:53 +0100405
406 Fix failure to build against Nettle-3.0. Thanks to Steven
407 Barth for spotting this and finding the fix.
Simon Kelleya0358e52014-06-07 13:38:48 +0100408
Josh Soref730c6742017-02-06 16:14:04 +0000409 When assigning existing DHCP leases to interfaces by comparing
Simon Kelley6d8e8ac2014-07-13 22:12:45 +0100410 networks, handle the case that two or more interfaces have the
411 same network part, but different prefix lengths (favour the
412 longer prefix length.) Thanks to Lung-Pin Chang for the
413 patch.
414
Simon Kelleyb5ea1cc2014-07-29 16:34:14 +0100415 Add a mode which detects and removes DNS forwarding loops, ie
416 a query sent to an upstream server returns as a new query to
417 dnsmasq, and would therefore be forwarded again, resulting in
418 a query which loops many times before being dropped. Upstream
419 servers which loop back are disabled and this event is logged.
420 Thanks to Smoothwall for their sponsorship of this feature.
421
Simon Kelley3e1551a2014-09-09 21:46:07 +0100422 Extend --conf-dir to allow filtering of files. So
423 --conf-dir=/etc/dnsmasq.d,\*.conf
424 will load all the files in /etc/dnsmasq.d which end in .conf
Ilya Ponetaev5bf50af2014-09-09 12:46:21 +0100425
Simon Kelley288df492014-09-18 21:48:51 +0100426 Fix bug when resulted in NXDOMAIN answers instead of NODATA in
427 some circumstances.
Simon Kelley57826492014-09-18 22:08:58 +0100428
429 Fix bug which caused dnsmasq to become unresponsive if it
430 failed to send packets due to a network interface disappearing.
431 Thanks to Niels Peen for spotting this.
Simon Kelleybf2db4b2014-09-18 22:10:46 +0100432
433 Fix problem with --local-service option on big-endian platforms
434 Thanks to Richard Genoud for the patch.
435
Simon Kelleyad4a8ff2015-04-09 21:48:00 +0100436
Simon Kelley9d1b22a2014-04-29 13:02:41 +0100437version 2.71
438 Subtle change to error handling to help DNSSEC validation
439 when servers fail to provide NODATA answers for
440 non-existent DS records.
441
442 Tweak code which removes DNSSEC records from answers when
443 not required. Fixes broken answers when additional section
444 has real records in it. Thanks to Marco Davids for the bug
445 report.
446
447 Fix DNSSEC validation of ANY queries. Thanks to Marco Davids
448 for spotting that too.
449
Simon Kelleyb692f232014-05-09 10:29:43 +0100450 Fix total DNS failure and 100% CPU use if cachesize set to zero,
451 regression introduced in 2.69. Thanks to James Hunt and
452 the Ubuntu crowd for assistance in fixing this.
453
Simon Kelley9d1b22a2014-04-29 13:02:41 +0100454
Simon Kelley63758382014-04-16 22:20:55 +0100455version 2.70
456 Fix crash, introduced in 2.69, on TCP request when dnsmasq
457 compiled with DNSSEC support, but running without DNSSEC
458 enabled. Thanks to Manish Sing for spotting that one.
459
Simon Kelley3b1b3e92014-04-23 15:46:05 +0100460 Fix regression which broke ipset functionality. Thanks to
461 Wang Jian for the bug report.
462
Simon Kelley63758382014-04-16 22:20:55 +0100463
Simon Kelley1ee9be42013-12-09 16:50:19 +0000464version 2.69
465 Implement dynamic interface discovery on *BSD. This allows
Josh Soref730c6742017-02-06 16:14:04 +0000466 the constructor: syntax to be used in dhcp-range for DHCPv6
Simon Kelley1ee9be42013-12-09 16:50:19 +0000467 on the BSD platform. Thanks to Matthias Andree for
468 valuable research on how to implement this.
469
Simon Kelley8db957d2013-12-17 15:47:10 +0000470 Fix infinite loop associated with some --bogus-nxdomain
Simon Kelley74e6b522013-12-17 21:33:53 +0000471 configs. Thanks fogobogo for the bug report.
Simon Kelley8db957d2013-12-17 15:47:10 +0000472
Simon Kelleyae762422014-01-10 18:15:16 +0000473 Fix missing RA RDNS option with configuration like
474 --dhcp-option=option6:23,[::] Thanks to Tsachi Kimeldorfer
475 for spotting the problem.
476
Simon Kelleyc3a04082014-01-11 22:18:19 +0000477 Add [fd00::] and [fe80::] as special addresses in DHCPv6
478 options, analogous to [::]. [fd00::] is replaced with the
479 actual ULA of the interface on the machine running
480 dnsmasq, [fe80::] with the link-local address.
481 Thanks to Tsachi Kimeldorfer for championing this.
482
Simon Kelley613d6c52014-02-04 11:50:11 +0000483 DNSSEC validation and caching. Dnsmasq needs to be
484 compiled with this enabled, with
485
486 make dnsmasq COPTS=-DHAVE_DNSSEC
487
488 this add dependencies on the nettle crypto library and the
489 gmp maths library. It's possible to have these linked
490 statically with
491
492 make dnsmasq COPTS='-DHAVE_DNSSEC -DHAVE_DNSSEC_STATIC'
493
Simon Kelley198d9402014-04-09 20:36:53 +0100494 which bloats the dnsmasq binary, but saves the size of
495 the shared libraries which are much bigger.
496
Simon Kelley613d6c52014-02-04 11:50:11 +0000497 To enable, DNSSEC, you will need a set of
498 trust-anchors. Now that the TLDs are signed, this can be
499 the keys for the root zone, and for convenience they are
500 included in trust-anchors.conf in the dnsmasq
501 distribution. You should of course check that these are
502 legitimate and up-to-date. So, adding
503
504 conf-file=/path/to/trust-anchors.conf
505 dnssec
Simon Kelley1ee9be42013-12-09 16:50:19 +0000506
klemens43517fc2017-02-19 15:53:37 +0000507 to your config is all that's needed to get things
Simon Kelley613d6c52014-02-04 11:50:11 +0000508 working. The upstream nameservers have to be DNSSEC-capable
509 too, of course. Many ISP nameservers aren't, but the
510 Google public nameservers (8.8.8.8 and 8.8.4.4) are.
511 When DNSSEC is configured, dnsmasq validates any queries
512 for domains which are signed. Query results which are
513 bogus are replaced with SERVFAIL replies, and results
514 which are correctly signed have the AD bit set. In
515 addition, and just as importantly, dnsmasq supplies
516 correct DNSSEC information to clients which are doing
517 their own validation, and caches DNSKEY, DS and RRSIG
518 records, which significantly improve the performance of
519 downstream validators. Setting --log-queries will show
520 DNSSEC in action.
521
Simon Kelley198d9402014-04-09 20:36:53 +0100522 If a domain is returned from an upstream nameserver without
523 DNSSEC signature, dnsmasq by default trusts this. This
524 means that for unsigned zone (still the majority) there
525 is effectively no cost for having DNSSEC enabled. Of course
526 this allows an attacker to replace a signed record with a
527 false unsigned record. This is addressed by the
528 --dnssec-check-unsigned flag, which instructs dnsmasq
529 to prove that an unsigned record is legitimate, by finding
530 a secure proof that the zone containing the record is not
531 signed. Doing this has costs (typically one or two extra
532 upstream queries). It also has a nasty failure mode if
533 dnsmasq's upstream nameservers are not DNSSEC capable.
534 Without --dnssec-check-unsigned using such an upstream
535 server will simply result in not queries being validated;
536 with --dnssec-check-unsigned enabled and a
537 DNSSEC-ignorant upstream server, _all_ queries will fail.
538
539 Note that DNSSEC requires that the local time is valid and
540 accurate, if not then DNSSEC validation will fail. NTP
541 should be running. This presents a problem for routers
542 without a battery-backed clock. To set the time needs NTP
543 to do DNS lookups, but lookups will fail until NTP has run.
544 To address this, there's a flag, --dnssec-no-timecheck
545 which disables the time checks (only) in DNSSEC. When dnsmasq
546 is started and the clock is not synced, this flag should
547 be used. As soon as the clock is synced, SIGHUP dnsmasq.
548 The SIGHUP clears the cache of partially-validated data and
549 resets the no-timecheck flag, so that all DNSSEC checks
550 henceforward will be complete.
551
Simon Kelley613d6c52014-02-04 11:50:11 +0000552 The development of DNSSEC in dnsmasq was started by
553 Giovanni Bajo, to whom huge thanks are owed. It has been
554 supported by Comcast, whose techfund grant has allowed for
555 an invaluable period of full-time work to get it to
556 a workable state.
557
Simon Kelleyde73a492014-02-17 21:43:27 +0000558 Add --rev-server. Thanks to Dave Taht for suggesting this.
Simon Kelley7b1eae42014-02-20 13:43:28 +0000559
560 Add --servers-file. Allows dynamic update of upstream servers
561 full access to configuration.
Simon Kelleyde73a492014-02-17 21:43:27 +0000562
Simon Kelleyc8a80482014-03-05 14:29:54 +0000563 Add --local-service. Accept DNS queries only from hosts
564 whose address is on a local subnet, ie a subnet for which
565 an interface exists on the server. This option
Simon Kelleyf00690f2014-03-12 20:07:12 +0000566 only has effect if there are no --interface --except-interface,
Simon Kelleyc8a80482014-03-05 14:29:54 +0000567 --listen-address or --auth-server options. It is intended
568 to be set as a default on installation, to allow
569 unconfigured installations to be useful but also safe from
570 being used for DNS amplification attacks.
571
Simon Kelley604f7592014-03-22 19:33:43 +0000572 Fix crashes in cache_get_cname_target() when dangling CNAMEs
573 encountered. Thanks to Andy and the rt-n56u project for
574 find this and helping to chase it down.
575
Simon Kelley10068602014-04-03 21:16:40 +0100576 Fix wrong RCODE in authoritative DNS replies to PTR queries. The
577 correct answer was included, but the RCODE was set to NXDOMAIN.
578 Thanks to Craig McQueen for spotting this.
579
Simon Kelley198d9402014-04-09 20:36:53 +0100580 Make statistics available as DNS queries in the .bind TLD as
581 well as logging them.
582
Simon Kelleyc8a80482014-03-05 14:29:54 +0000583
Simon Kelley376d48c2013-11-13 13:04:30 +0000584version 2.68
585 Use random addresses for DHCPv6 temporary address
586 allocations, instead of algorithmically determined stable
587 addresses.
588
589 Fix bug which meant that the DHCPv6 DUID was not available
590 in DHCP script runs during the lifetime of the dnsmasq
591 process which created the DUID de-novo. Once the DUID was
592 created and stored in the lease file and dnsmasq
593 restarted, this bug disappeared.
594
595 Fix bug introduced in 2.67 which could result in erroneous
596 NXDOMAIN returns to CNAME queries.
597
598 Fix build failures on MacOS X and openBSD.
599
600 Allow subnet specifications in --auth-zone to be interface
601 names as well as address literals. This makes it possible
602 to configure authoritative DNS when local address ranges
603 are dynamic and works much better than the previous
Josh Soref730c6742017-02-06 16:14:04 +0000604 work-around which exempted constructed DHCP ranges from the
Simon Kelley376d48c2013-11-13 13:04:30 +0000605 IP address filtering. As a consequence, that work-around
606 is removed. Under certain circumstances, this change wil
607 break existing configuration: if you're relying on the
Josh Soref730c6742017-02-06 16:14:04 +0000608 constructed-range exception, you need to change --auth-zone
Simon Kelley376d48c2013-11-13 13:04:30 +0000609 to specify the same interface as is used to construct your
610 DHCP ranges, probably with a trailing "/6" like this:
611 --auth-zone=example.com,eth0/6 to limit the addresses to
612 IPv6 addresses of eth0.
Simon Kelleydd9d9ce2013-11-15 11:24:00 +0000613
614 Fix problems when advertising deleted IPv6 prefixes. If
615 the prefix is deleted (rather than replaced), it doesn't
616 get advertised with zero preferred time. Thanks to Tsachi
617 for the bug report.
Simon Kelley25439062013-11-25 21:14:51 +0000618
619 Fix segfault with some locally configured CNAMEs. Thanks
620 to Andrew Childs for spotting the problem.
621
622 Fix memory leak on re-reading /etc/hosts and friends,
623 introduced in 2.67.
Simon Kelley2329bef2013-12-03 13:41:16 +0000624
625 Check the arrival interface of incoming DNS and TFTP
626 requests via IPv6, even in --bind-interfaces mode. This
627 isn't possible for IPv4 and can generate scary warnings,
628 but as it's always possible for IPv6 (the API always
629 exists) then we should do it always.
Vladislav Grishenko4c82efc2013-12-03 16:05:30 +0000630
631 Tweak the rules on prefix-lengths in --dhcp-range for
632 IPv6. The new rule is that the specified prefix length
633 must be larger than or equal to the prefix length of the
634 corresponding address on the local interface.
635
Simon Kelley376d48c2013-11-13 13:04:30 +0000636
Giacomo Tazzari797a7af2013-04-22 13:16:37 +0100637version 2.67
638 Fix crash if upstream server returns SERVFAIL when
639 --conntrack in use. Thanks to Giacomo Tazzari for finding
640 this and supplying the patch.
Simon Kelleyaa63a212013-04-22 15:01:52 +0100641
642 Repair regression in 2.64. That release stopped sending
643 lease-time information in the reply to DHCPINFORM
644 requests, on the correct grounds that it was a standards
645 violation. However, this broke the dnsmasq-specific
646 dhcp_lease_time utility. Now, DHCPINFORM returns
647 lease-time only if it's specifically requested
648 (maintaining standards) and the dhcp_lease_time utility
649 has been taught to ask for it (restoring functionality).
Simon Kelley86e92f92013-04-23 11:31:39 +0100650
651 Fix --dhcp-match, --dhcp-vendorclass and --dhcp-userclass
652 to work with BOOTP and well as DHCP. Thanks to Peter
653 Korsgaard for spotting the problem.
Simon Kelley2bb73af2013-04-24 17:38:19 +0100654
655 Add --synth-domain. Thanks to Vishvananda Ishaya for
656 suggesting this.
Simon Kelleyd5052fb2013-04-25 12:44:20 +0100657
658 Fix failure to compile ipset.c if old kernel headers are
659 in use. Thanks to Eugene Rudoy for pointing this out.
Simon Kelley3f2873d2013-05-14 11:28:47 +0100660
661 Handle IPv4 interface-address labels in Linux. These are
662 often used to emulate the old IP-alias addresses. Before,
663 using --interface=eth0 would service all the addresses of
664 eth0, including ones configured as aliases, which appear
665 in ifconfig as eth0:0. Now, only addresses with the label
666 eth0 are active. This is not backwards compatible: if you
667 want to continue to bind the aliases too, you need to add
668 eg. --interface=eth0:0 to the config.
Giacomo Tazzari797a7af2013-04-22 13:16:37 +0100669
Simon Kelleycfcad422013-05-17 11:32:03 +0100670 Fix "failed to set SO_BINDTODEVICE on DHCP socket: Socket
671 operation on non-socket" error on startup with
672 configurations which have exactly one --interface option
673 and do RA but _not_ DHCPv6. Thanks to Trever Adams for the
674 bug report.
Giacomo Tazzari797a7af2013-04-22 13:16:37 +0100675
Simon Kelley115ac3e2013-05-20 11:28:32 +0100676 Generalise --interface-name to cope with IPv6 addresses
677 and multiple addresses per interface per address family.
678
Simon Kelley3e8ed782013-05-29 14:31:33 +0100679 Fix option parsing for --dhcp-host, which was generating a
680 spurious error when all seven possible items were
681 included. Thanks to Zhiqiang Wang for the bug report.
Simon Kelleybaa80ae2013-05-29 16:32:07 +0100682
683 Remove restriction on prefix-length in --auth-zone. Thanks
684 to Toke Hoiland-Jorgensen for suggesting this.
685
Marcelo Salhab Brogliato0da5e892013-05-31 11:49:06 +0100686 Log when the maximum number of concurrent DNS queries is
687 reached. Thanks to Marcelo Salhab Brogliato for the patch.
688
Simon Kelleye2ba0df2013-05-31 17:04:25 +0100689 If wildcards are used in --interface, don't assume that
690 there will only ever be one available interface for DHCP
691 just because there is one at start-up. More may appear, so
692 we can't use SO_BINDTODEVICE. Thanks to Natrio for the bug
693 report.
694
klemens43517fc2017-02-19 15:53:37 +0000695 Increase timeout/number of retries in TFTP to accommodate
Simon Kelleyb4b93082013-06-19 10:31:23 +0100696 AudioCodes Voice Gateways doing streaming writes to flash.
697 Thanks to Damian Kaczkowski for spotting the problem.
698
Simon Kelley625ac282013-07-02 21:19:32 +0100699 Fix crash with empty DHCP string options when adding zero
Simon Kelley3953dcc2013-07-03 20:40:45 +0100700 terminator. Thanks to Patrick McLean for the bug report.
Simon Kelley625ac282013-07-02 21:19:32 +0100701
Kyle Mesteryd859ca22013-07-24 13:11:58 +0100702 Allow hostnames to start with a number, as allowed in
703 RFC-1123. Thanks to Kyle Mestery for the patch.
704
Roy Marples3f3adae2013-07-25 16:22:46 +0100705 Fixes to DHCP FQDN option handling: don't terminate FQDN
706 if domain not known and allow a FQDN option with blank
707 name to request that a FQDN option is returned in the
708 reply. Thanks to Roy Marples for the patch.
709
Simon Kelleyd9fb0be2013-07-25 21:47:17 +0100710 Make --clear-on-reload apply to setting upstream servers
711 via DBus too.
712
Simon Kelleyef1a94a2013-07-26 13:59:03 +0100713 When the address which triggered the construction of an
714 advertised IPv6 prefix disappears, continue to advertise
715 the prefix for up to 2 hours, with the preferred lifetime
716 set to zero. This satisfies RFC 6204 4.3 L-13 and makes
717 things work better if a prefix disappears without being
718 deprecated first. Thanks to Uwe Schindler for persuasively
719 arguing for this.
720
Simon Kelleyfc4c4fd2013-07-26 15:38:59 +0100721 Fix MAC address enumeration on *BSD. Thanks to Brad Smith
722 for the bug report.
Simon Kelleyb4b93082013-06-19 10:31:23 +0100723
Simon Kelley871d4562013-07-27 21:32:32 +0100724 Support RFC-4242 information-refresh-time options in the
725 reply to DHCPv6 information-request. The lease time of the
726 smallest valid dhcp-range is sent. Thanks to Uwe Schindler
727 for suggesting this.
728
Simon Kelleyedf0bde2013-07-29 17:21:48 +0100729 Make --listen-address higher priority than --except-interface
730 in all circumstances. Thanks to Thomas Hood for the bugreport.
731
Simon Kelley2937f8a2013-07-29 19:49:07 +0100732 Provide independent control over which interfaces get TFTP
733 service. If enable-tftp is given a list of interfaces, then TFTP
734 is provided on those. Without the list, the previous behaviour
735 (provide TFTP to the same interfaces we provide DHCP to)
736 is retained. Thanks to Lonnie Abelbeck for the suggestion.
737
Simon Kelley6acef732013-09-09 15:21:39 +0100738 Add --dhcp-relay config option. Many thanks to vtsl.net
739 for sponsoring this development.
Simon Kelleyff7eea22013-09-04 18:01:38 +0100740
Simon Kelley0932f9c2013-09-05 11:30:30 +0100741 Fix crash with empty tag: in --dhcp-range. Thanks to
742 Kaspar Schleiser for the bug report.
743
Simon Kelleyceae52d2013-09-12 15:05:47 +0100744 Add "baseline" and "bloatcheck" makefile targets, for
745 revealing size changes during development. Thanks to
746 Vladislav Grishenko for the patch.
747
Simon Kelleyc8f2dd82013-09-13 11:22:55 +0100748 Cope with DHCPv6 clients which send REQUESTs without
749 address options - treat them as SOLICIT with rapid commit.
750
Simon Kelley89500e32013-09-20 16:29:20 +0100751 Support identification of clients by MAC address in
752 DHCPv6. When using a relay, the relay must support RFC
753 6939 for this to work. It always works for directly
754 connected clients. Thanks to Vladislav Grishenko
755 for prompting this feature.
Simon Kelley861c8912013-09-25 15:30:30 +0100756
757 Remove the rule for constructed DHCP ranges that the local
758 address must be either the first or last address in the
759 range. This was originally to avoid SLAAC addresses, but
760 we now explicitly autoconfig and privacy addresses instead.
Simon Kelley89500e32013-09-20 16:29:20 +0100761
Simon Kelley889d8a12013-10-02 13:12:09 +0100762 Update Polish translation. Thanks to Jan Psota.
763
Tanguy Bouzelocef1d7422013-10-03 11:06:31 +0100764 Fix problem in DHCPv6 vendorclass/userclass matching
765 code. Thanks to Tanguy Bouzeloc for the patch.
766
Josh Soref730c6742017-02-06 16:14:04 +0000767 Update Spanish translation. Thanks to Vicente Soriano.
Simon Kelley871d4562013-07-27 21:32:32 +0100768
Simon Kelleyc4cd95d2013-10-10 20:58:11 +0100769 Add --ra-param option. Thanks to Vladislav Grishenko for
770 inspiration on this.
771
Simon Kelleyed4c0762013-10-08 20:46:34 +0100772 Add --add-subnet configuration, to tell upstream DNS
Simon Kelleyf65b0e52013-10-11 10:19:01 +0100773 servers where the original client is. Thanks to DNSthingy
774 for sponsoring this feature.
Simon Kelleyed4c0762013-10-08 20:46:34 +0100775
Kevin Darbyshire-Bryant8c0b73d2013-10-11 11:56:33 +0100776 Add --quiet-dhcp, --quiet-dhcp6 and --quiet-ra. Thanks to
777 Kevin Darbyshire-Bryant for the initial patch.
778
Simon Kelleyd56a6042013-10-11 14:39:03 +0100779 Allow A/AAAA records created by --interface-name to be the
780 target of --cname. Thanks to Hadmut Danisch for the
781 suggestion.
782
Simon Kelley24b5a5d2013-10-11 15:19:28 +0100783 Avoid treating a --dhcp-host which has an IPv6 address
Josh Soref730c6742017-02-06 16:14:04 +0000784 as eligible for use with DHCPv4 on the grounds that it has
Simon Kelley24b5a5d2013-10-11 15:19:28 +0100785 no address, and vice-versa. Thanks to Yury Konovalov for
786 spotting the problem.
787
Simon Kelley45cca582013-10-15 10:20:13 +0100788 Do a better job caching dangling CNAMEs. Thanks to Yves
789 Dorfsman for spotting the problem.
790
Vic043c2712013-10-04 15:09:13 +0100791
Simon Kelley333b2ce2013-01-07 21:46:03 +0000792version 2.66
793 Add the ability to act as an authoritative DNS
794 server. Dnsmasq can now answer queries from the wider 'net
795 with local data, as long as the correct NS records are set
796 up. Only local data is provided, to avoid creating an open
797 DNS relay. Zone transfer is supported, to allow secondary
798 servers to be configured.
799
800 Add "constructed DHCP ranges" for DHCPv6. This is intended
801 for IPv6 routers which get prefixes dynamically via prefix
802 delegation. With suitable configuration, stateful DHCPv6
803 and RA can happen automatically as prefixes are delegated
804 and then deprecated, without having to re-write the
805 dnsmasq configuration file or restart the daemon. Thanks to
806 Steven Barth for extensive testing and development work on
807 this idea.
Simon Kelley71c73ac2013-01-08 21:22:24 +0000808
809 Fix crash on startup on Solaris 11. Regression probably
Simon Kelley22ce5502013-01-22 13:53:04 +0000810 introduced in 2.61. Thanks to Geoff Johnstone for the
811 patch.
812
813 Add code to make behaviour for TCP DNS requests that same
814 as for UDP requests, when a request arrives for an allowed
815 address, but via a banned interface. This change is only
816 active on Linux, since the relevant API is missing (AFAIK)
817 on other platforms. Many thanks to Tomas Hozza for
818 spotting the problem, and doing invaluable discovery of
819 the obscure and undocumented API required for the solution.
Simon Kelleya21e27b2013-02-17 16:41:35 +0000820
821 Don't send the default DHCP option advertising dnsmasq as
822 the local DNS server if dnsmasq is configured to not act
823 as DNS server, or it's configured to a non-standard port.
Simon Kelleydd1721c2013-02-18 21:04:04 +0000824
Josh Soref730c6742017-02-06 16:14:04 +0000825 Add DNSMASQ_CIRCUIT_ID, DNSMASQ_SUBSCRIBER_ID,
Simon Kelleydd1721c2013-02-18 21:04:04 +0000826 DNSMASQ_REMOTE_ID variables to the environment of the
Simon Kelley3d77c042013-03-22 10:03:50 +0000827 lease-change script (and the corresponding Lua). These hold
Simon Kelleydd1721c2013-02-18 21:04:04 +0000828 information inserted into the DHCP request by a DHCP relay
829 agent. Thanks to Lakefield Communications for providing a
830 bounty for this addition.
831
Simon Kelley4038ae22013-02-19 16:47:07 +0000832 Fixed crash, introduced in 2.64, whilst handling DHCPv6
833 information-requests with some common configurations.
834 Thanks to Robert M. Albrecht for the bug report and
835 chasing the problem.
836
Jason A. Donenfeld13d86c72013-02-22 18:20:53 +0000837 Add --ipset option. Thanks to Jason A. Donenfeld for the
838 patch.
839
Simon Kelleyc7961072013-02-28 15:17:58 +0000840 Don't erroneously reject some option names in --dhcp-match
Simon Kelley3d77c042013-03-22 10:03:50 +0000841 options. Thanks to Benedikt Hochstrasser for the bug report.
Simon Kelley49333cb2013-03-15 20:30:51 +0000842
843 Allow a trailing '*' wildcard in all interface-name
844 configurations. Thanks to Christian Parpart for the patch.
Simon Kelleyc7961072013-02-28 15:17:58 +0000845
Simon Kelley56a11422013-04-02 17:02:58 +0100846 Handle the situation where libc headers define
847 SO_REUSEPORT, but the kernel in use doesn't, to cope with
848 the introduction of this option to Linux. Thanks to Rich
849 Felker for the bug report.
850
Simon Kelleycd1e04a2013-04-02 20:11:48 +0100851 Update Polish translation. Thanks to Jan Psota.
Simon Kelley0b0a73c2013-04-11 14:07:02 +0100852
853 Fix crash if the configured DHCP lease limit is
854 reached. Regression occurred in 2.61. Thanks to Tsachi for
855 the bug report.
Simon Kelleycd1e04a2013-04-02 20:11:48 +0100856
Simon Kelley834f36f2013-04-17 13:52:49 +0100857 Update the French translation. Thanks to Gildas le Nadan.
858
Simon Kelley49333cb2013-03-15 20:30:51 +0000859
Simon Kelleyee86ce62012-12-07 11:54:46 +0000860version 2.65
861 Fix regression which broke forwarding of queries sent via
862 TCP which are not for A and AAAA and which were directed to
863 non-default servers. Thanks to Niax for the bug report.
864
Simon Kelleyb5a8dd12012-12-10 11:37:25 +0000865 Fix failure to build with DHCP support excluded. Thanks to
866 Gustavo Zacarias for the patch.
Simon Kelley1d6c6392012-12-14 11:19:36 +0000867
Josh Soref730c6742017-02-06 16:14:04 +0000868 Fix nasty regression in 2.64 which completely broke caching.
Simon Kelleyb5a8dd12012-12-10 11:37:25 +0000869
870
Simon Kelley2e34ac12012-08-29 14:15:25 +0100871version 2.64
872 Handle DHCP FQDN options with all flag bits zero and
873 --dhcp-client-update set. Thanks to Bernd Krumbroeck for
874 spotting the problem.
875
Simon Kelley12d71ed2012-08-30 15:16:41 +0100876 Finesse the check for /etc/hosts names which conflict with
877 DHCP names. Previously a name/address pair in /etc/hosts
878 which didn't match the name/address of a DHCP lease would
Josh Soref730c6742017-02-06 16:14:04 +0000879 generate a warning. Now that only happens if there is not
Simon Kelley12d71ed2012-08-30 15:16:41 +0100880 also a match. This allows multiple addresses for a name in
881 /etc/hosts with one of them assigned via DHCP.
882
Simon Kelley4d0f5b42012-09-05 23:29:30 +0100883 Fix broken vendor-option processing for BOOTP. Thanks to
884 Hans-Joachim Baader for the bug report.
885
Simon Kelleydfb23b32012-09-18 21:44:47 +0100886 Don't report spurious netlink errors, regression in
887 2.63. Thanks to Vladislav Grishenko for the patch.
888
Josh Soref730c6742017-02-06 16:14:04 +0000889 Flag DHCP or DHCPv6 in startup logging. Thanks to
Simon Kelley2b127a12012-09-18 21:51:22 +0100890 Vladislav Grishenko for the patch.
891
Simon Kelley295a54e2012-12-01 21:02:15 +0000892 Add SetServersEx method in DBus interface. Thanks to Dan
Simon Kelleyfaafb3f2012-09-20 14:17:39 +0100893 Williams for the patch.
894
Simon Kelley295a54e2012-12-01 21:02:15 +0000895 Add SetDomainServers method in DBus interface. Thanks to
896 Roy Marples for the patch.
897
Josh Soref730c6742017-02-06 16:14:04 +0000898 Fix build with later Lua libraries. Thanks to Cristian
Simon Kelley289a2532012-09-20 15:29:35 +0100899 Rodriguez for the patch.
Simon Kelley2e34ac12012-08-29 14:15:25 +0100900
Simon Kelley1d860412012-09-20 20:48:04 +0100901 Add --max-cache-ttl option. Thanks to Dennis Kaarsemaker
902 for the patch.
903
Simon Kelleye4807d82012-09-27 21:52:26 +0100904 Fix breakage of --host-record parsing, resulting in
Josh Soref730c6742017-02-06 16:14:04 +0000905 infinite loop at startup. Regression in 2.63. Thanks to
Simon Kelleye4807d82012-09-27 21:52:26 +0100906 Haim Gelfenbeyn for spotting this.
907
Simon Kelley20223102012-10-15 10:41:17 +0100908 Set SO_REUSEADDRESS and SO_V6ONLY options on the DHCPv6
909 socket, this allows multiple instances of dnsmasq on a
910 single machine, in the same way as for DHCPv4. Thanks to
911 Gene Czarcinski and Vladislav Grishenko for work on this.
912
Simon Kelleybe6cfb42012-10-16 20:38:31 +0100913 Fix DHCPv6 to do access control correctly when it's
914 configured with --listen-address. Thanks to
915 Gene Czarcinski for sorting this out.
916
Simon Kelley819ff4d2012-10-21 18:25:12 +0100917 Add a "wildcard" dhcp-range which works for any IPv6
918 subnet, --dhcp-range=::,static Useful for Stateless
919 DHCPv6. Thanks to Vladislav Grishenko for the patch.
920
Simon Kelleyd1a59752012-11-05 16:50:30 +0000921 Don't include lease-time in DHCPACK replies to DHCPINFORM
922 queries, since RFC-2131 says we shouldn't. Thanks to
923 Wouter Ibens for pointing this out.
Simon Kelley8e4b8792012-11-14 14:12:56 +0000924
925 Makefile tweak to do dependency checking on header files.
926 Thanks to Johan Peeters for the patch.
Simon Kelleyd89fb4e2012-12-01 21:21:13 +0000927
928 Check interface for outgoing unsolicited router
929 advertisements, rather than relying on interface address
930 configuration. Thanks to Gene Czarinski for the patch.
Simon Kelley29d28dd2012-12-03 14:05:59 +0000931
932 Handle better attempts to transmit on interfaces which are
933 still doing DAD, and specifically do not just transmit
934 without setting source address and interface, since this
935 can cause very puzzling effects when a router
936 advertisement goes astray. Thanks again to Gene Czarinski.
937
938 Get RA timers right when there is more than one
939 dhcp-range on a subnet.
Simon Kelley289a2532012-09-20 15:29:35 +0100940
Simon Kelleyd1a59752012-11-05 16:50:30 +0000941
Simon Kelley078a6302012-06-07 13:56:23 +0100942version 2.63
943 Do duplicate dhcp-host address check in --test mode.
944
Simon Kelley8b3ae2f2012-06-13 13:43:49 +0100945 Check that tftp-root directories are accessible before
946 start-up. Thanks to Daniel Veillard for the initial patch.
947
948 Allow more than one --tfp-root flag. The per-interface
949 stuff is pointless without that.
950
Simon Kelley54dd3932012-06-20 11:23:38 +0100951 Add --bind-dynamic. A hybrid mode between the default and
952 --bind-interfaces which copes with dynamically created
953 interfaces.
Simon Kelley6b617c02012-06-29 21:15:42 +0100954
955 A couple of fixes to the build system for Android. Thanks
956 to Metin Kaya for the patches.
Simon Kelley54dd3932012-06-20 11:23:38 +0100957
Simon Kelley8bc4cec2012-07-03 21:04:11 +0100958 Remove the interface:<interface> argument in --dhcp-range, and
959 the interface argument to --enable-tftp. These were a
960 still-born attempt to allow automatic isolated
961 configuration by libvirt, but have never (to my knowledge)
962 been used, had very strange semantics, and have been
klemens43517fc2017-02-19 15:53:37 +0000963 superseded by other mechanisms.
Simon Kelley8bc4cec2012-07-03 21:04:11 +0100964
Simon Kelleyc4a7f902012-07-12 20:52:12 +0100965 Fixed bug logging filenames when duplicate dhcp-host
966 addresses are found. Thanks to John Hanks for the patch.
967
Simon Kelley611ebc52012-07-16 16:23:46 +0100968 Fix regression in 2.61 which broke caching of CNAME
969 chains. Thanks to Atul Gupta for the bug report.
970
Simon Kelleyb2714462012-07-17 12:09:26 +0100971 Allow the target of a --cname flag to be another --cname.
Simon Kelley611ebc52012-07-16 16:23:46 +0100972
Simon Kelley42243212012-07-20 15:19:18 +0100973 Teach DHCPv6 about the RFC 4242 information-refresh-time
974 option, and add parsing if the minutes, hours and days
975 format for options. Thanks to Francois-Xavier Le Bail for
976 the suggestion.
977
978 Allow "w" (for week) as multiplier in lease times, as well
979 as seconds, minutes, hours and days. Álvaro Gámez Machado
Josh Soref730c6742017-02-06 16:14:04 +0000980 spotted the omission.
Simon Kelleyc4c04882012-08-06 20:09:15 +0100981
982 Update French translation. Thanks to Gildas Le Nadan.
Simon Kelley42243212012-07-20 15:19:18 +0100983
Simon Kelleyad094272012-08-10 17:10:54 +0100984 Allow a DBus service name to be given with --enable-dbus
985 which overrides the default,
986 uk.org.thekelleys.dnsmasq. Thanks to Mathieu
987 Trudel-Lapierre for the patch.
988
Simon Kelleyfd05f122012-08-12 17:48:50 +0100989 Set the "prefix on-link" bit in Router
990 Advertisements. Thanks to Gui Iribarren for the patch.
991
Simon Kelley078a6302012-06-07 13:56:23 +0100992
Simon Kelley8358e0f2012-04-29 21:53:09 +0100993version 2.62
994 Update German translation. Thanks to Conrad Kostecki.
995
klemens43517fc2017-02-19 15:53:37 +0000996 Cope with router-solict packets which don't have a valid
Simon Kelleyf632e562012-05-12 15:05:34 +0100997 source address. Thanks to Vladislav Grishenko for the patch.
998
Simon Kelley919dd7c2012-05-12 15:23:09 +0100999 Fixed bug which caused missing periodic router
1000 advertisements with some configurations. Thanks to
1001 Vladislav Grishenko for the patch.
1002
Simon Kelleyc64b7f62012-05-18 10:19:59 +01001003 Fixed bug which broke DHCPv6/RA with prefix lengths
1004 which are not divisible by 8. Thanks to Andre Coetzee
1005 for spotting this.
1006
Simon Kelley18c63ef2012-05-21 14:34:15 +01001007 Fix non-response to router-solicitations when
1008 router-advertisement configured, but DHCPv6 not
1009 configured. Thanks to Marien Zwart for the patch.
1010
Simon Kelley9f7f3b12012-05-28 21:39:57 +01001011 Add --dns-rr, to allow arbitrary DNS resource records.
1012
Simon Kelley5ae34bf2012-06-04 21:14:03 +01001013 Fixed bug which broke RA scheduling when an interface had
1014 two addresses in the same network. Thanks to Jim Bos for
1015 his help nailing this.
1016
Simon Kelleyeabc6dd2012-03-07 20:28:20 +00001017version 2.61
1018 Re-write interface discovery code on *BSD to use
1019 getifaddrs. This is more portable, more straightforward,
1020 and allows us to find the prefix length for IPv6
1021 addresses.
1022
Simon Kelley01d1b8d2012-03-28 21:37:25 +01001023 Add ra-names, ra-stateless and slaac keywords for DHCPv6.
1024 Dnsmasq can now synthesise AAAA records for dual-stack
1025 hosts which get IPv6 addresses via SLAAC. It is also now
1026 possible to use SLAAC and stateless DHCPv6, and to
1027 tell clients to use SLAAC addresses as well as DHCP ones.
1028 Thanks to Dave Taht for help with this.
Simon Kelley7023e382012-03-09 12:05:49 +00001029
Simon Kelley8b372702012-03-09 17:45:10 +00001030 Add --dhcp-duid to allow DUID-EN uids to be used.
1031
Josh Soref730c6742017-02-06 16:14:04 +00001032 Explicitly send DHCPv6 replies to the correct port, instead
Simon Kelley8643ec72012-03-12 20:04:14 +00001033 of relying on clients to send requests with the correct
1034 source address, since at least one client in the wild gets
Simon Kelley8358e0f2012-04-29 21:53:09 +01001035 this wrong. Thanks to Conrad Kostecki for help tracking
Simon Kelley8643ec72012-03-12 20:04:14 +00001036 this down.
Simon Kelleyeabc6dd2012-03-07 20:28:20 +00001037
Simon Kelley8643ec72012-03-12 20:04:14 +00001038 Send a preference value of 255 in DHCPv6 replies when
1039 --dhcp-authoritative is in effect. This tells clients not
1040 to wait around for other DHCP servers.
1041
1042 Better logging of DHCPv6 options.
1043
Simon Kelleye759d422012-03-16 13:18:57 +00001044 Add --host-record. Thanks to Rob Zwissler for the
1045 suggestion.
1046
Simon Kelleya9530962012-03-20 22:07:35 +00001047 Invoke the DHCP script with action "tftp" when a TFTP file
1048 transfer completes. The size of the file, address to which
1049 it was sent and complete pathname are supplied. Note that
Josh Soref730c6742017-02-06 16:14:04 +00001050 version 2.60 introduced some script incompatibilities
Simon Kelleya9530962012-03-20 22:07:35 +00001051 associated with DHCPv6, and this is a further change. To
1052 be safe, scripts should ignore unknown actions, and if
1053 not IPv6-aware, should exit if the environment
1054 variable DNSMASQ_IAID is set. The use-case for this is
1055 to track netboot/install. Suggestion from Shantanu
1056 Gadgil.
1057
1058 Update contrib/port-forward/dnsmasq-portforward to reflect
1059 the above.
1060
1061 Set the environment variable DNSMASQ_LOG_DHCP when running
1062 the script id --log-dhcp is in effect, so that script can
Simon Kelley52d4abf2012-03-21 21:39:48 +00001063 taylor their logging verbosity. Suggestion from Malte
1064 Forkel.
1065
1066 Arrange that addresses specified with --listen-address
1067 work even if there is no interface carrying the
1068 address. This is chiefly useful for IPv4 loopback
1069 addresses, where any address in 127.0.0.0/8 is a valid
1070 loopback address, but normally only 127.0.0.1 appears on
1071 the lo interface. Thanks to Mathieu Trudel-Lapierre for
1072 the idea and initial patch.
Simon Kelleya9530962012-03-20 22:07:35 +00001073
Simon Kelley7d2b5c92012-03-23 10:00:02 +00001074 Fix crash, introduced in 2.60, when a DHCPINFORM is
1075 received from a network which has no valid dhcp-range.
1076 Thanks to Stephane Glondu for the bug report.
1077
Simon Kelleyc8257542012-03-28 21:15:41 +01001078 Add a new DHCP lease time keyword, "deprecated" for
1079 --dhcp-range. This is only valid for IPv6, and sets the
Josh Soref730c6742017-02-06 16:14:04 +00001080 preferred lease time for both DHCP and RA to zero. The
Simon Kelleyc8257542012-03-28 21:15:41 +01001081 effect is that clients can continue to use the address
1082 for existing connections, but new connections will use
1083 other addresses, if they exist. This makes hitless
1084 renumbering at least possible.
1085
1086 Fix bug in address6_available() which caused DHCPv6 lease
Josh Soref730c6742017-02-06 16:14:04 +00001087 acquisition to fail if more than one dhcp-range in use.
Simon Kelley18f0fb02012-03-31 21:18:55 +01001088
1089 Provide RDNSS and DNSSL data in router advertisements,
1090 using the settings provided for DHCP options
1091 option6:domain-search and option6:dns-server.
Simon Kelley6c559c32012-04-02 20:40:34 +01001092
1093 Tweak logo/favicon.ico to add some transparency. Thanks to
1094 SamLT for work on this.
Simon Kelleyc8257542012-03-28 21:15:41 +01001095
Simon Kelley1023dcb2012-04-09 18:00:08 +01001096 Don't cache data from non-recursive nameservers, since it
Josh Soref730c6742017-02-06 16:14:04 +00001097 may erroneously look like a valid CNAME to a non-existent
Simon Kelley1023dcb2012-04-09 18:00:08 +01001098 name. Thanks to Ben Winslow for finding this.
Simon Kelley9380ba72012-04-16 14:41:56 +01001099
1100 Call SO_BINDTODEVICE on the DHCP socket(s) when doing DHCP
Simon Kelley8358e0f2012-04-29 21:53:09 +01001101 on exactly one interface and --bind-interfaces is set. This
Simon Kelley9380ba72012-04-16 14:41:56 +01001102 makes the OpenStack use-case of one dnsmasq per virtual
1103 interface work. This is only available on Linux; it's not
1104 supported on other platforms. Thanks to Vishvananda Ishaya
Simon Kelleye46164e2012-04-16 16:39:38 +01001105 and the OpenStack team for the suggestion.
1106
1107 Updated French translation. Thanks to Gildas Le Nadan.
Simon Kelleyd1c759c2012-04-16 17:26:19 +01001108
Josh Soref730c6742017-02-06 16:14:04 +00001109 Give correct from-cache answers to explicit CNAME queries.
Simon Kelleyd1c759c2012-04-16 17:26:19 +01001110 Thanks to Rob Zwissler for spotting this.
Simon Kelley1023dcb2012-04-09 18:00:08 +01001111
Simon Kelleyfc92ead2012-04-22 21:28:24 +01001112 Add --tftp-lowercase option. Thanks to Oliver Rath for the
Simon Kelley61ce6002012-04-20 21:28:49 +01001113 patch.
Simon Kelleydcffad22012-04-24 15:25:18 +01001114
1115 Ensure that the DBus DhcpLeaseUpdated events are generated
1116 when a lease goes through INIT_REBOOT state, even if the
Simon Kelley8358e0f2012-04-29 21:53:09 +01001117 dhcp-script is not in use. Thanks to Antoaneta-Ecaterina
Simon Kelleydcffad22012-04-24 15:25:18 +01001118 Ene for the patch.
Simon Kelley19d69be2012-04-27 10:14:34 +01001119
1120 Fix failure of TFTP over IPv4 on OpenBSD platform. Thanks
1121 to Brad Smith for spotting this.
Simon Kelley61ce6002012-04-20 21:28:49 +01001122
Simon Kelleyc8257542012-03-28 21:15:41 +01001123
Simon Kelleyc72daea2012-01-05 21:33:27 +00001124version 2.60
1125 Fix compilation problem in Mac OS X Lion. Thanks to Olaf
1126 Flebbe for the patch.
Simon Kelley74c95c22011-10-19 09:33:39 +01001127
Simon Kelleyc72daea2012-01-05 21:33:27 +00001128 Fix DHCP when using --listen-address with an IP address
1129 which is not the primary address of an interface.
1130
1131 Add --dhcp-client-update option.
1132
1133 Add Lua integration. Dnsmasq can now execute a DHCP
1134 lease-change script written in Lua. This needs to be
1135 enabled at compile time by setting HAVE_LUASCRIPT in
1136 src/config.h or running "make COPTS=-DHAVE_LUASCRIPT"
1137 Thanks to Jan-Piet Mens for the idea and proof-of-concept
1138 implementation.
1139
1140 Tidied src/config.h to distinguish between
1141 platform-dependent compile-time options which are selected
1142 automatically, and builder-selectable compile time
1143 options. Document the latter better, and describe how to
1144 set them from the make command line.
1145
1146 Tidied up IPPROTO_IP/SOL_IP (and IPv6 equivalent)
1147 confusion. IPPROTO_IP works everywhere now.
1148
1149 Set TOS on DHCP sockets, this improves things on busy
1150 wireless networks. Thanks to Dave Taht for the patch.
1151
Simon Kelley984d2fd2012-01-06 14:34:32 +00001152 Determine VERSION automatically based on git magic:
1153 release tags or hash values.
Simon Kelleyc72daea2012-01-05 21:33:27 +00001154
Simon Kelleya2761752012-01-18 16:07:21 +00001155 Improve start-up speed when reading large hosts files
1156 containing many distinct addresses.
1157
1158 Fix problem if dnsmasq is started without the stdin,
1159 stdout and stderr file descriptors open. This can manifest
1160 itself as 100% CPU use. Thanks to Chris Moore for finding
1161 this.
1162
Simon Kelley9bbc8872012-02-09 21:33:09 +00001163 Fix shell-scripting bug in bld/pkg-wrapper. Thanks to
1164 Mark Mitchell for the patch.
1165
Simon Kelley751d6f42012-02-10 15:24:51 +00001166 Allow the TFP server or boot server in --pxe-service, to
1167 be a domain name instead of an IP address. This allows for
1168 round-robin to multiple servers, in the same way as
1169 --dhcp-boot. A good suggestion from Cristiano Cumer.
1170
Simon Kelleyfdacfb02012-02-28 15:20:25 +00001171 Support BUILDDIR variable in the Makefile. Allows builds
1172 for multiple archs from the same source tree with eg.
1173 make BUILDDIR=linux (relative to dnsmasq tree)
1174 make BUILDDIR=/tmp/openbsd (absolute path)
Simon Kelleye5ffdb92012-02-13 14:19:25 +00001175 If BUILDDIR is not set, compilation happens in the src
Simon Kelleyb36ae192012-02-13 12:54:34 +00001176 directory, as before. Suggestion from Mark Mitchell.
1177
Simon Kelleyfdacfb02012-02-28 15:20:25 +00001178 Support DHCPv6. Support is there for the sort of things
1179 the existing v4 server does, including tags, options,
1180 static addresses and relay support. Missing is prefix
1181 delegation, which is probably not required in the dnsmasq
1182 niche, and an easy way to accept prefix delegations from
1183 an upstream DHCPv6 server, which is. Future plans include
1184 support for DHCPv6 router option and MAC address option
1185 (to make selecting clients by MAC address work like IPv4).
1186 These will be added as the standards mature.
1187 This code has been tested, but this is the first release,
1188 so don't bet the farm on it just yet. Many thanks to all
1189 testers who have got it this far.
Simon Kelley1adadf52012-02-13 22:15:58 +00001190
Simon Kelleyac8540c2012-02-26 20:57:31 +00001191 Support IPv6 router advertisements. This is a
1192 simple-minded implementation, aimed at providing the
1193 vestigial RA needed to go alongside IPv6. Is picks up
1194 configuration from the DHCPv6 conf, and should just need
1195 enabling with --enable-ra.
1196
Simon Kelley552af8b2012-02-29 20:10:31 +00001197 Fix long-standing wrinkle with --localise-queries that
1198 could result in wrong answers when DNS packets arrive
1199 via an interface other than the expected one. Thanks to
1200 Lorenzo Milesi and John Hanks for spotting this one.
Simon Kelley71ee7ee2012-03-03 18:06:49 +00001201
1202 Update French translation. Thanks to Gildas Le Nadan.
Simon Kelley552af8b2012-02-29 20:10:31 +00001203
Simon Kelleydf66e342012-03-04 20:04:22 +00001204 Update Polish translation. Thanks to Jan Psota.
1205
1206
Simon Kelleyc72daea2012-01-05 21:33:27 +00001207version 2.59
1208 Fix regression in 2.58 which caused failure to start up
1209 with some combinations of dnsmasq config and IPv6 kernel
1210 network config. Thanks to Brielle Bruns for the bug
1211 report.
1212
1213 Improve dnsmasq's behaviour when network interfaces are
1214 still doing duplicate address detection (DAD). Previously,
1215 dnsmasq would wait up to 20 seconds at start-up for the
1216 DAD state to terminate. This is broken for bridge
1217 interfaces on recent Linux kernels, which don't start DAD
1218 until the bridge comes up, and so can take arbitrary
1219 time. The new behaviour lets dnsmasq poll for an arbitrary
1220 time whilst providing service on other interfaces. Thanks
1221 to Stephen Hemminger for pointing out the problem.
Simon Kelley74c95c22011-10-19 09:33:39 +01001222
1223
Simon Kelley7de060b2011-08-26 17:24:52 +01001224version 2.58
1225 Provide a definition of the SA_SIZE macro where it's
1226 missing. Fixes build failure on openBSD.
1227
1228 Don't include a zero terminator at the end of messages
1229 sent to /dev/log when /dev/log is a datagram socket.
1230 Thanks to Didier Rabound for spotting the problem.
1231
1232 Add --dhcp-sequential-ip flag, to force allocation of IP
1233 addresses in ascending order. Note that the default
1234 pseudo-random mode is in general better but some
1235 server-deployment applications need this.
1236
1237 Fix problem where a server-id of 0.0.0.0 is sent to a
1238 client when a dhcp-relay is in use if a client renews a
1239 lease after dnsmasq restart and before any clients on the
1240 subnet get a new lease. Thanks to Mike Ruiz for assistance
1241 in chasing this one down.
1242
1243 Don't return NXDOMAIN to an AAAA query if we have CNAME
1244 which points to an A record only: NODATA is the correct
1245 reply in this case. Thanks to Tom Fernandes for spotting
1246 the problem.
1247
1248 Relax the need to supply a netmask in --dhcp-range for
1249 networks which use a DHCP relay. Whilst this is still
klemens43517fc2017-02-19 15:53:37 +00001250 desirable, in the absence of a netmask dnsmasq will use
Simon Kelley7de060b2011-08-26 17:24:52 +01001251 a default based on the class (A, B, or C) of the address.
1252 This should at least remove a cause of mysterious failure
1253 for people using RFC1918 addresses and relays.
1254
1255 Add support for Linux conntrack connection marking. If
1256 enabled with --conntrack, the connection mark for incoming
1257 DNS queries will be copied to the outgoing connections
1258 used to answer those queries. This allows clever firewall
1259 and accounting stuff. Only available if dnsmasq is
1260 compiled with HAVE_CONNTRACK and adds a dependency on
1261 libnetfilter-conntrack. Thanks to Ed Wildgoose for the
1262 initial idea, testing and sponsorship of this function.
1263
1264 Provide a sane error message when someone attempts to
1265 match a tag in --dhcp-host.
1266
1267 Tweak the behaviour of --domain-needed, to avoid problems
1268 with recursive nameservers downstream of dnsmasq. The new
1269 behaviour only stops A and AAAA queries, and returns
1270 NODATA rather than NXDOMAIN replies.
1271
1272 Efficiency fix for very large DHCP configurations, thanks
1273 to James Gartrell and Mike Ruiz for help with this.
1274
1275 Allow the TFTP-server address in --dhcp-boot to be a
1276 domain-name which is looked up in /etc/hosts. This can
1277 give multiple IP addresses which are used round-robin,
1278 thus doing TFTP server load-balancing. Thanks to Sushil
1279 Agrawal for the patch.
1280
1281 When two tagged dhcp-options for a particular option
1282 number are both valid, use the one which is valid without
1283 a tag from the dhcp-range. Allows overriding of the value
1284 of a DHCP option for a particular host as well as
1285 per-network values. So
1286 --dhcp-range=set:interface1,......
1287 --dhcp-host=set:myhost,.....
1288 --dhcp-option=tag:interface1,option:nis-domain,"domain1"
1289 --dhcp-option=tag:myhost,option:nis-domain,"domain2"
1290 will set the NIS-domain to domain1 for hosts in the range, but
1291 override that to domain2 for a particular host.
1292
1293 Fix bug which resulted in truncated files and timeouts for
1294 some TFTP transfers. The bug only occurs with netascii
1295 transfers and needs an unfortunate relationship between
1296 file size, blocksize and the number of newlines in the
1297 last block before it manifests itself. Many thanks to
1298 Alkis Georgopoulos for spotting the problem and providing
1299 a comprehensive test-case.
1300
1301 Fix regression in TFTP server on *BSD platforms introduced
1302 in version 2.56, due to confusion with sockaddr
Simon Kelleyde604c12012-10-19 09:50:01 +01001303 length. Many thanks to Loic Pefferkorn for finding this.
Simon Kelley7de060b2011-08-26 17:24:52 +01001304
1305 Support scope-ids in IPv6 addresses of nameservers from
1306 /etc/resolv.conf and in --server options. Eg
1307 nameserver fe80::202:a412:4512:7bbf%eth0 or
1308 server=fe80::202:a412:4512:7bbf%eth0. Thanks to
1309 Michael Stapelberg for the suggestion.
1310
1311 Update Polish translation, thanks to Jan Psota.
1312
1313 Update French translation. Thanks to Gildas Le Nadan.
1314
1315
Simon Kelley572b41e2011-02-18 18:11:18 +00001316version 2.57
1317 Add patches to allow build under Android.
1318
1319 Provide our own header for the DNS protocol, rather than
1320 relying on arpa/nameser.h. This has proved more or less
1321 defective over the years and the final straw is that it's
1322 effectively empty on Android.
1323
1324 Fix regression in 2.56 which caused hex constants in
1325 configuration to be rejected if they contain the '*'
1326 wildcard.
1327
1328 Correct wrong casts of arguments to ctype.h functions,
1329 isdigit(), isxdigit() etc. Thanks to Matthias Andree for
1330 spotting this.
1331
1332 Allow build with IDN support independently from i18n.
1333 IDN support continues to be included automatically
1334 when i18n is included.
1335 'make COPTS=-DHAVE_IDN' is the magic incantation.
1336
1337 Modify check on extraneous command line junk (added in
1338 2.56) so that it doesn't complain about extra _empty_
1339 arguments. Otherwise this breaks libvirt.
1340
1341
Simon Kelley28866e92011-02-14 20:19:14 +00001342version 2.56
1343 Add a patch to allow dnsmasq to get interface names right in a
1344 Solaris zone. Thanks to Dj Padzensky for this.
1345
1346 Improve data-type parsing heuristics so that
1347 --dhcp-option=option:domain-search,.
1348 treats the value as a string and not an IP address.
1349 Thanks to Clemens Fischer for spotting that.
1350
1351 Add IPv6 support to the TFTP server. Many thanks to Jan
1352 'RedBully' Seiffert for the patches.
1353
1354 Log DNS queries at level LOG_INFO, rather then
1355 LOG_DEBUG. This makes things consistent with DHCP
1356 logging. Thanks to Adam Pribyl for spotting the problem.
1357
1358 Ensure that dnsmasq terminates cleanly when using
1359 --syslog-async even if it cannot make a connection to the
1360 syslogd.
1361
1362 Add --add-mac option. This is to support currently
1363 experimental DNS filtering facilities. Thanks to Benjamin
klemens43517fc2017-02-19 15:53:37 +00001364 Petrin for the original patch.
Simon Kelley28866e92011-02-14 20:19:14 +00001365
1366 Fix bug which meant that tags were ignored in dhcp-range
1367 configuration specifying PXE-proxy service. Thanks to
1368 Cristiano Cumer for spotting this.
1369
1370 Raise an error if there is extra junk, not part of an
1371 option, on the command line.
1372
1373 Flag a couple of log messages in cache.c as coming from
1374 the DHCP subsystem. Thanks to Olaf Westrik for the patch.
1375
1376 Omit timestamps from logs when a) logging to stderr and
Josh Soref730c6742017-02-06 16:14:04 +00001377 b) --keep-in-foreground is set. The logging facility on the
1378 other end of stderr can be assumed to supply them. Thanks
Simon Kelley28866e92011-02-14 20:19:14 +00001379 to John Hallam for the patch.
1380
1381 Don't complain about strings longer than 255 characters in
1382 --txt-record, just split the long strings into 255
1383 character chunks instead.
1384
1385 Fix crash on double-free. This bug can only happen when
1386 dhcp-script is in use and then only in rare circumstances
1387 triggered by high DHCP transaction rate and a slow
1388 script. Thanks to Ferenc Wagner for finding the problem.
1389
1390 Only log that a file has been sent by TFTP after the
Josh Soref730c6742017-02-06 16:14:04 +00001391 transfer has completed successfully.
Simon Kelley28866e92011-02-14 20:19:14 +00001392
1393 A good suggestion from Ferenc Wagner: extend
1394 the --domain option to allow this sort of thing:
1395 --domain=thekelleys.org.uk,192.168.0.0/24,local
1396 which automatically creates
1397 --local=/thekelleys.org.uk/
1398 --local=/0.168.192.in-addr.arpa/
1399
Josh Soref730c6742017-02-06 16:14:04 +00001400 Tighten up syntax checking of hex constants in the config
Simon Kelley28866e92011-02-14 20:19:14 +00001401 file. Thanks to Fred Damen for spotting this.
1402
1403 Add dnsmasq logo/icon, contributed by Justin Swift. Many
1404 thanks for that.
1405
1406 Never cache DNS replies which have the 'cd' bit set, or
1407 which result from queries forwarded with the 'cd' bit
1408 set. The 'cd' bit instructs a DNSSEC validating server
1409 upstream to ignore signature failures and return replies
1410 anyway. Without this change it's possible to pollute the
1411 dnsmasq cache with bad data by making a query with the
1412 'cd' bit set and subsequent queries would return this data
1413 without its being marked as suspect. Thanks to Anders
1414 Kaseorg for pointing out this problem.
1415
1416 Add --proxy-dnssec flag, for compliance with RFC
1417 4035. Dnsmasq will now clear the 'ad' bit in answers returned
1418 from upstream validating nameservers unless this option is
1419 set.
1420
1421 Allow a filename of "-" for --conf-file to read
1422 stdin. Suggestion from Timothy Redaelli.
1423
1424 Rotate the order of SRV records in replies, to provide
1425 round-robin load balancing when all the priorities are
1426 equal. Thanks to Peter McKinney for the suggestion.
1427
1428 Edit
1429 contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist
1430 so that it doesn't log all queries to a file by
1431 default. Thanks again to Peter McKinney.
1432
1433 By default, setting an IPv4 address for a domain but not
1434 an IPv6 address causes dnsmasq to return
1435 an NODATA reply for IPv6 (or vice-versa). So
1436 --address=/google.com/1.2.3.4 stops IPv6 queries for
1437 *google.com from being forwarded. Make it possible to
Josh Soref730c6742017-02-06 16:14:04 +00001438 override this behaviour by defining the semantics if the
Simon Kelley28866e92011-02-14 20:19:14 +00001439 same domain appears in both --server and --address.
1440 In that case, the --address has priority for the address
1441 family in which is appears, but the --server has priority
Josh Soref730c6742017-02-06 16:14:04 +00001442 of the address family which doesn't appear in --address
Simon Kelley28866e92011-02-14 20:19:14 +00001443 So:
1444 --address=/google.com/1.2.3.4
1445 --server=/google.com/#
1446 will return 1.2.3.4 for IPv4 queries for *.google.com but
1447 forward IPv6 queries to the normal upstream nameserver.
1448 Similarly when setting an IPv6 address
1449 only this will allow forwarding of IPv4 queries. Thanks to
1450 William for pointing out the need for this.
1451
1452 Allow more than one --dhcp-optsfile and --dhcp-hostsfile
1453 and make them understand directories as arguments in the
1454 same way as --addn-hosts. Suggestion from John Hanks.
1455
1456 Ignore rebinding requests for leases we don't know
1457 about. Rebind is broadcast, so we might get to overhear a
1458 request meant for another DHCP server. NAKing this is
1459 wrong. Thanks to Brad D'Hondt for assistance with this.
1460
Simon Kelley572b41e2011-02-18 18:11:18 +00001461 Fix cosmetic bug which produced strange output when
1462 dumping cache statistics with some configurations. Thanks
1463 to Fedor Kozhevnikov for spotting this.
Simon Kelley28866e92011-02-14 20:19:14 +00001464
1465
Simon Kelleyc52e1892010-06-07 22:01:39 +01001466version 2.55
Simon Kelley28866e92011-02-14 20:19:14 +00001467 Fix crash when /etc/ethers is in use. Thanks to
1468 Gianluigi Tiesi for finding this.
Simon Kelleyc52e1892010-06-07 22:01:39 +01001469
Simon Kelley28866e92011-02-14 20:19:14 +00001470 Fix crash in netlink_multicast(). Thanks to Arno Wald for
1471 finding this one.
Simon Kelleyc52e1892010-06-07 22:01:39 +01001472
Simon Kelley28866e92011-02-14 20:19:14 +00001473 Allow the empty domain "." in dhcp domain-search (119)
1474 options.
Simon Kelleyc52e1892010-06-07 22:01:39 +01001475
1476
1477version 2.54
Simon Kelley28866e92011-02-14 20:19:14 +00001478 There is no version 2.54 to avoid confusion with 2.53,
1479 which incorrectly identifies itself as 2.54.
Simon Kelleyc52e1892010-06-07 22:01:39 +01001480
1481
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001482version 2.53
1483 Fix failure to compile on Debian/kFreeBSD. Thanks to
1484 Axel Beckert and Petr Salinger.
1485
1486 Fix code to avoid scary strict-aliasing warnings
1487 generated by gcc 4.4.
1488
1489 Added FAQ entry warning about DHCP failures with Vista
1490 when firewalls block 255.255.255.255.
1491
1492 Fixed bug which caused bad things to happen if a
1493 resolv.conf file which exists is subsequently removed.
1494 Thanks to Nikolai Saoukh for the patch.
1495
1496 Rationalised the DHCP tag system. Every configuration item
1497 which can set a tag does so by adding "set:<tag>" and
1498 every configuration item which is conditional on a tag is
1499 made so by "tag:<tag>". The NOT operator changes to '!',
1500 which is a bit more intuitive too. Dhcp-host directives
1501 can set more than one tag now. The old '#' NOT,
1502 "net:" prefix and no-prefixes are still honoured, so
1503 no existing config file needs to be changed, but
1504 the documentation and new-style config files should be
1505 much less confusing.
1506
1507 Added --tag-if to allow boolean operations on tags.
1508 This allows complicated logic to be clearer and more
1509 general. A great suggestion from Richard Voigt.
1510
1511 Add broadcast/unicast information to DHCP logging.
1512
1513 Allow --dhcp-broadcast to be unconditional.
1514
1515 Fixed incorrect behaviour with NOT <tag> conditionals in
1516 dhcp-options. Thanks to Max Turkewitz for assistance
1517 finding this.
1518
1519 If we send vendor-class encapsulated options based on the
1520 vendor-class supplied by the client, and no explicit
1521 vendor-class option is given, echo back the vendor-class
1522 from the client.
1523
1524 Fix bug which stopped dnsmasq from matching both a
1525 circuitid and a remoteid. Thanks to Ignacio Bravo for
1526 finding this.
1527
1528 Add --dhcp-proxy, which makes it possible to configure
1529 dnsmasq to use a DHCP relay agent as a full proxy, with
1530 all DHCP messages passing through the proxy. This is
1531 useful if the relay adds extra information to the packets
1532 it forwards, but cannot be configured with the RFC 5107
1533 server-override option.
1534
1535 Added interface:<iface name> part to dhcp-range. The
1536 semantics of this are very odd at first sight, but it
1537 allows a single line of the form
1538 dhcp-range=interface:virt0,192.168.0.4,192.168.0.200
1539 to be added to dnsmasq configuration which then supplies
1540 DHCP and DNS services to that interface, without affecting
1541 what services are supplied to other interfaces and
Josh Soref730c6742017-02-06 16:14:04 +00001542 irrespective of the existence or lack of
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001543 interface=<interface>
1544 lines elsewhere in the dnsmasq configuration. The idea is
1545 that such a line can be added automatically by libvirt
1546 or equivalent systems, without disturbing any manual
1547 configuration.
1548
1549 Similarly to the above, allow --enable-tftp=<interface>
1550
1551 Allow a TFTP root to be set separately for requests via
1552 different interfaces, --tftp-root=<path>,<interface>
1553
1554 Correctly handle and log clashes between CNAMES and
1555 DNS names being given to DHCP leases. This fixes a bug
1556 which caused nonsense IP addresses to be logged. Thanks to
1557 Sergei Zhirikov for finding and analysing the problem.
1558
1559 Tweak flush_log so as to avoid leaving the log
1560 file in non-blocking mode. O_NONBLOCK is a property of the
1561 file, not the process/descriptor.
1562
1563 Fix contrib/Solaris10/create_package
1564 (/usr/man -> /usr/share/man) Thanks to Vita Batrla.
1565
1566 Fix a problem where, if a client got a lease, then went
1567 to another subnet and got another lease, then moved back,
1568 it couldn't resume the old lease, but would instead get
1569 a new address. Thanks to Leonardo Rodrigues for spotting
1570 this and testing the fix.
1571
1572 Fix weird bug which sometimes omitted certain characters
1573 from the start of quoted strings in dhcp-options. Thanks
1574 to Dayton Turner for spotting the problem.
1575
1576 Add facility to redirect some domains to the standard
1577 upstream servers: this allows something like
1578 --server=/google.com/1.2.3.4 --server=/www.google.com/#
1579 which will send queries for *.google.com to 1.2.3.4,
1580 except *www.google.com which will be forwarded as usual.
1581 Thanks to AJ Weber for prompting this addition.
1582
1583 Improve the hash-algorithm used to generate IP addresses
1584 from MAC addresses during initial DHCP address
1585 allocation. This improves performance when large numbers
1586 of hosts with similar MAC addresses all try and get an IP
1587 address at the same time. Thanks to Paul Smith for his
1588 work on this.
1589
1590 Tweak DHCP code so that --bridge-interface can be used to
1591 select which IP alias of an interface should be used for
1592 DHCP purposes on Linux. If eth0 has an alias eth0:dhcp
1593 then adding --bridge-interface=eth0:dhcp,eth0 will use
1594 the address of eth0:dhcp to determine the correct subnet
1595 for DHCP address allocation. Thanks to Pawel Golaszewski
1596 for prompting this and Eric Cooper for further testing.
1597
1598 Add --dhcp-generate-names. Suggestion by Ferenc Wagner.
1599
1600 Tweak DNS server selection algorithm when there is more
1601 than one server available for a domain, eg.
1602 --server=/mydomain/1.1.1.1
1603 --server=/mydomain/2.2.2.2
1604 Thanks to Alberto Cuesta-Canada for spotting a weakness
1605 here.
1606
1607 Add --max-ttl. Thanks to Fredrik Ringertz for the patch.
1608
1609 Allow --log-facility=- to force all logging to
1610 stderr. Suggestion from Clemens Fischer.
1611
1612 Fix regression which caused configuration like
1613 --address=/.domain.com/1.2.3.4 to be rejected. The dot to the
1614 left of the domain has been implied and not required for a
1615 long time, but it should be accepted for backward
1616 compatibility. Thanks to Andrew Burcin for spotting this.
1617
1618 Add --rebind-domain-ok and --rebind-localhost-ok.
1619 Suggestion from Clemens Fischer.
1620
1621 Log replies to queries of type TXT, when --log-queries
1622 is set.
1623
1624 Fix compiler warnings when compiled with -DNO_DHCP. Thanks
1625 to Shantanu Gadgil for the patch.
1626
1627 Updated French translation. Thanks to Gildas Le Nadan.
1628
1629 Updated Polish translation. Thanks to Jan Psota.
1630
1631 Updated German translation. Thanks to Matthias Andree.
1632
1633 Added contrib/static-arp, thanks to Darren Hoo.
1634
1635 Fix corruption of the domain when a name from /etc/hosts
1636 overrides one supplied by a DHCP client. Thanks to Fedor
1637 Kozhevnikov for spotting the problem.
1638
1639 Updated Spanish translation. Thanks to Chris Chatham.
1640
1641
Simon Kelley316e2732010-01-22 20:16:09 +00001642version 2.52
1643 Work around a Linux kernel bug which insists that the
1644 length of the option passed to setsockopt must be at least
1645 sizeof(int) bytes, even if we're calling SO_BINDTODEVICE
1646 and the device name is "lo". Note that this is fixed
1647 in kernel 2.6.31, but the workaround is harmless and
1648 allows earlier kernels to be used. Also fix dnsmasq
1649 bug which reported the wrong address when this failed.
1650 Thanks to Fedor for finding this.
1651
1652 The API for IPv6 PKTINFO changed around Linux kernel
1653 2.6.14. Workaround the case where dnsmasq is compiled
1654 against newer headers, but then run on an old kernel:
1655 necessary for some *WRT distros.
1656
1657 Re-read the set of network interfaces when re-loading
1658 /etc/resolv.conf if --bind-interfaces is not set. This
1659 handles the case that loopback interfaces do not exist
1660 when dnsmasq is first started.
1661
1662 Tweak the PXE code to support port 4011. This should
1663 reduce broadcasts and make things more reliable when other
1664 servers are around. It also improves inter-operability
1665 with certain clients.
1666
1667 Make a pxe-service configuration with no filename or boot
1668 service type legal: this does a local boot. eg.
1669 pxe-service=x86PC, "Local boot"
1670
1671 Be more conservative in detecting "A for A"
1672 queries. Dnsmasq checks if the name in a type=A query looks
1673 like a dotted-quad IP address and answers the query itself
1674 if so, rather than forwarding it. Previously dnsmasq
1675 relied in the library function inet_addr() to convert
1676 addresses, and that will accept some things which are
1677 confusing in this context, like 1.2.3 or even just
1678 1234. Now we only do A for A processing for four decimal
1679 numbers delimited by dots.
1680
1681 A couple of tweaks to fix compilation on Solaris. Thanks
1682 to Joel Macklow for help with this.
1683
1684 Another Solaris compilation tweak, needed for Solaris
1685 2009.06. Thanks to Lee Essen for that.
1686
1687 Added extract packaging stuff from Lee Essen to
1688 contrib/Solaris10.
1689
1690 Increased the default limit on number of leases to 1000
1691 (from 150). This is mainly a defence against DoS attacks,
1692 and for the average "one for two class C networks"
1693 installation, IP address exhaustion does that just as
1694 well. Making the limit greater than the number of IP
1695 addresses available in such an installation removes a
1696 surprise which otherwise can catch people out.
1697
1698 Removed extraneous trailing space in the value of the
1699 DNSMASQ_TIME_REMAINING DNSMASQ_LEASE_LENGTH and
1700 DNSMASQ_LEASE_EXPIRES environment variables. Thanks to
1701 Gildas Le Nadan for spotting this.
1702
1703 Provide the network-id tags for a DHCP transaction to
1704 the lease-change script in the environment variable
1705 DNSMASQ_TAGS. A good suggestion from Gildas Le Nadan.
1706
1707 Add support for RFC3925 "Vendor-Identifying Vendor
1708 Options". The syntax looks like this:
1709 --dhcp-option=vi-encap:<enterprise number>, .........
1710
1711 Add support to --dhcp-match to allow matching against
1712 RFC3925 "Vendor-Identifying Vendor Classes". The syntax
1713 looks like this:
1714 --dhcp-match=tag,vi-encap<enterprise number>, <value>
1715
1716 Add some application specific code to assist in
1717 implementing the Broadband forum TR069 CPE-WAN
1718 specification. The details are in contrib/CPE-WAN/README
1719
1720 Increase the default DNS packet size limit to 4096, as
1721 recommended by RFC5625 section 4.4.3. This can be
1722 reconfigured using --edns-packet-max if needed. Thanks to
1723 Francis Dupont for pointing this out.
1724
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001725 Rewrite query-ids even for TSIG signed packets, since
Simon Kelley316e2732010-01-22 20:16:09 +00001726 this is allowed by RFC5625 section 4.5.
1727
1728 Use getopt_long by default on OS X. It has been supported
1729 since version 10.3.0. Thanks to Arek Dreyer for spotting
1730 this.
1731
1732 Added up-to-date startup configuration for MacOSX/launchd
1733 in contrib/MacOSX-launchd. Thanks to Arek Dreyer for
1734 providing this.
1735
1736 Fix link error when including Dbus but excluding DHCP.
1737 Thanks to Oschtan for the bug report.
1738
1739 Updated French translation. Thanks to Gildas Le Nadan.
1740
1741 Updated Polish translation. Thanks to Jan Psota.
1742
1743 Updated Spanish translation. Thanks to Chris Chatham.
1744
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001745 Fixed confusion about domains, when looking up DHCP hosts
1746 in /etc/hosts. This could cause spurious "Ignoring
1747 domain..." messages. Thanks to Fedor Kozhevnikov for
1748 finding and analysing the problem.
Simon Kelley316e2732010-01-22 20:16:09 +00001749
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001750
Simon Kelley1f15b812009-10-13 17:49:32 +01001751version 2.51
1752 Add support for internationalised DNS. Non-ASCII characters
1753 in domain names found in /etc/hosts, /etc/ethers and
1754 /etc/dnsmasq.conf will be correctly handled by translation to
1755 punycode, as specified in RFC3490. This function is only
1756 available if dnsmasq is compiled with internationalisation
1757 support, and adds a dependency on GNU libidn. Without i18n
1758 support, dnsmasq continues to be compilable with just
1759 standard tools. Thanks to Yves Dorfsman for the
1760 suggestion.
1761
1762 Add two more environment variables for lease-change scripts:
1763 First, DNSMASQ_SUPPLIED_HOSTNAME; this is set to the hostname
1764 supplied by a client, even if the actual hostname used is
1765 over-ridden by dhcp-host or dhcp-ignore-names directives.
1766 Also DNSMASQ_RELAY_ADDRESS which gives the address of
1767 a DHCP relay, if used.
1768 Suggestions from Michael Rack.
1769
1770 Fix regression which broke echo of relay-agent
1771 options. Thanks to Michael Rack for spotting this.
1772
1773 Don't treat option 67 as being interchangeable with
1774 dhcp-boot parameters if it's specified as
1775 dhcp-option-force.
1776
1777 Make the code to call scripts on lease-change compile-time
1778 optional. It can be switched off by editing src/config.h
1779 or building with "make COPTS=-DNO_SCRIPT".
1780
1781 Make the TFTP server cope with filenames from Windows/DOS
1782 which use '\' as pathname separator. Thanks to Ralf for
1783 the patch.
1784
1785 Updated Polish translation. Thanks to Jan Psota.
1786
1787 Warn if an IP address is duplicated in /etc/ethers. Thanks
1788 to Felix Schwarz for pointing this out.
1789
1790 Teach --conf-dir to take an option list of file suffices
1791 which will be ignored when scanning the directory. Useful
1792 for backup files etc. Thanks to Helmut Hullen for the
1793 suggestion.
1794
1795 Add new DHCP option named tftpserver-address, which
1796 corresponds to the third argument of dhcp-boot. This
1797 allows the complete functionality of dhcp-boot to be
1798 replicated with dhcp-option. Useful when using
1799 dhcp-optsfile.
1800
1801 Test which upstream nameserver to use every 10 seconds
1802 or 50 queries and not just when a query times out and
1803 is retried. This should improve performance when there
1804 is a slow nameserver in the list. Thanks to Joe for the
1805 suggestion.
1806
1807 Don't do any PXE processing, even for clients with the
1808 correct vendorclass, unless at least one pxe-prompt or
1809 pxe-service option is given. This stops dnsmasq
1810 interfering with proxy PXE subsystems when it is just
1811 the DHCP server. Thanks to Spencer Clark for spotting this.
1812
1813 Limit the blocksize used for TFTP transfers to a value
1814 which avoids packet fragmentation, based on the MTU of the
1815 local interface. Many netboot ROMs can't cope with
1816 fragmented packets.
1817
1818 Honour dhcp-ignore configuration for PXE and proxy-PXE
1819 requests. Thanks to Niels Basjes for the bug report.
1820
1821 Updated French translation. Thanks to Gildas Le Nadan.
1822
1823
Simon Kelley77e94da2009-08-31 17:32:17 +01001824version 2.50
Simon Kelley1f15b812009-10-13 17:49:32 +01001825 Fix security problem which allowed any host permitted to
Simon Kelley77e94da2009-08-31 17:32:17 +01001826 do TFTP to possibly compromise dnsmasq by remote buffer
1827 overflow when TFTP enabled. Thanks to Core Security
1828 Technologies and Iván Arce, Pablo Hernán Jorge, Alejandro
1829 Pablo Rodriguez, Martín Coco, Alberto Soliño Testa and
1830 Pablo Annetta. This problem has Bugtraq id: 36121
1831 and CVE: 2009-2957
1832
1833 Fix a problem which allowed a malicious TFTP client to
1834 crash dnsmasq. Thanks to Steve Grubb at Red Hat for
1835 spotting this. This problem has Bugtraq id: 36120 and
1836 CVE: 2009-2958
1837
1838
Simon Kelley03a97b62009-06-10 20:55:49 +01001839version 2.49
1840 Fix regression in 2.48 which disables the lease-change
1841 script. Thanks to Jose Luis Duran for spotting this.
1842
1843 Log TFTP "file not found" errors. These were not logged,
1844 since a normal PXELinux boot generates many of them, but
1845 the lack of the messages seems to be more confusing than
1846 routinely seeing them when there is no real error.
1847
1848 Update Spanish translation. Thanks to Chris Chatham.
1849
1850
Simon Kelley7622fc02009-06-04 20:32:05 +01001851version 2.48
1852 Archived the extensive, backwards, changelog to
1853 CHANGELOG.archive. The current changelog now runs from
1854 version 2.43 and runs conventionally.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001855
Simon Kelley7622fc02009-06-04 20:32:05 +01001856 Fixed bug which broke binding of servers to physical
1857 interfaces when interface names were longer than four
1858 characters. Thanks to MURASE Katsunori for the patch.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001859
Simon Kelley7622fc02009-06-04 20:32:05 +01001860 Fixed netlink code to check that messages come from the
1861 correct source, and not another userspace process. Thanks
1862 to Steve Grubb for the patch.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001863
Simon Kelley7622fc02009-06-04 20:32:05 +01001864 Maintainability drive: removed bug and missing feature
1865 workarounds for some old platforms. Solaris 9, OpenBSD
1866 older than 4.1, Glibc older than 2.2, Linux 2.2.x and
1867 DBus older than 1.1.x are no longer supported.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001868
Simon Kelley7622fc02009-06-04 20:32:05 +01001869 Don't read included configuration files more than once:
1870 allows complex configuration structures without problems.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001871
Simon Kelley7622fc02009-06-04 20:32:05 +01001872 Mark log messages from the various subsystems in dnsmasq:
1873 messages from the DHCP subsystem now have the ident string
1874 "dnsmasq-dhcp" and messages from TFTP have ident
1875 "dnsmasq-tftp". Thanks to Olaf Westrik for the patch.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001876
Simon Kelley7622fc02009-06-04 20:32:05 +01001877 Fix possible infinite DHCP protocol loop when an IP
1878 address nailed to a hostname (not a MAC address) and a
1879 host sometimes provides the name, sometimes not.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001880
Simon Kelley7622fc02009-06-04 20:32:05 +01001881 Allow --addn-hosts to take a directory: all the files
1882 in the directory are read. Thanks to Phil Cornelius for
1883 the suggestion.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001884
Simon Kelley7622fc02009-06-04 20:32:05 +01001885 Support --bridge-interface on all platforms, not just BSD.
Simon Kelley1ab84e22004-01-29 16:48:35 +00001886
Simon Kelley7622fc02009-06-04 20:32:05 +01001887 Added support for advanced PXE functions. It's now
1888 possible to define a prompt and menu options which will
1889 be displayed when a client PXE boots. It's also possible to
1890 hand-off booting to other boot servers. Proxy-DHCP, where
1891 dnsmasq just supplies the PXE information and another DHCP
1892 server does address allocation, is also allowed. See the
1893 --pxe-prompt and --pxe-service keywords. Thanks to
1894 Alkis Georgopoulos for the suggestion and Guilherme Moro
1895 and Michael Brown for assistance.
Simon Kelley1ab84e22004-01-29 16:48:35 +00001896
Simon Kelley7622fc02009-06-04 20:32:05 +01001897 Improvements to DHCP logging. Thanks to Tom Metro for
1898 useful suggestions.
1899
1900 Add ability to build dnsmasq without DHCP support. To do
1901 this, edit src/config.h or build with
1902 "make COPTS=-DNO_DHCP". Thanks to Mahavir Jain for the patch.
1903
1904 Added --test command-line switch - syntax check
1905 configuration files only.
Simon Kelley33820b72004-04-03 21:10:00 +01001906
Simon Kelley7622fc02009-06-04 20:32:05 +01001907 Updated French translation. Thanks to Gildas Le Nadan.
Simon Kelley9009d742008-11-14 20:04:27 +00001908
Simon Kelley73a08a22009-02-05 20:28:08 +00001909
1910version 2.47
1911 Updated French translation. Thanks to Gildas Le Nadan.
1912
1913 Fixed interface enumeration code to work on NetBSD
1914 5.0. Thanks to Roy Marples for the patch.
1915
1916 Updated config.h to use the same location for the lease
1917 file on NetBSD as the other *BSD variants. Also allow
Josh Soref730c6742017-02-06 16:14:04 +00001918 LEASEFILE and CONFFILE symbols to be overridden in CFLAGS.
Simon Kelley73a08a22009-02-05 20:28:08 +00001919
1920 Handle duplicate address detection on IPv6 more
1921 intelligently. In IPv6, an interface can have an address
1922 which is not usable, because it is still undergoing DAD
1923 (such addresses are marked "tentative"). Attempting to
1924 bind to an address in this state returns an error,
1925 EADDRNOTAVAIL. Previously, on getting such an error,
1926 dnsmasq would silently abandon the address, and never
1927 listen on it. Now, it retries once per second for 20
1928 seconds before generating a fatal error. 20 seconds should
1929 be long enough for any DAD process to complete, but can be
1930 adjusted in src/config.h if necessary. Thanks to Martin
1931 Krafft for the bug report.
1932
1933 Add DBus introspection. Patch from Jeremy Laine.
1934
1935 Update Dbus configuration file. Patch from Colin Walters.
1936 Fix for this bug:
1937 http://bugs.freedesktop.org/show_bug.cgi?id=18961
1938
1939 Support arbitrarily encapsulated DHCP options, suggestion
1940 and initial patch from Samium Gromoff. This is useful for
1941 (eg) gPXE, which expect all its private options to be
1942 encapsulated inside a single option 175. So, eg,
1943
1944 dhcp-option = encap:175, 190, "iscsi-client0"
1945 dhcp-option = encap:175, 191, "iscsi-client0-secret"
1946
1947 will provide iSCSI parameters to gPXE.
1948
1949 Enhance --dhcp-match to allow testing of the contents of a
1950 client-sent option, as well as its presence. This
1951 application in mind for this is RFC 4578
1952 client-architecture specifiers, but it's generally useful.
1953 Joey Korkames suggested the enhancement.
1954
1955 Move from using the IP_XMIT_IF ioctl to IP_BOUND_IF on
1956 OpenSolaris. Thanks to Bastian Machek for the heads-up.
1957
1958 No longer complain about blank lines in
1959 /etc/ethers. Thanks to Jon Nelson for the patch.
1960
1961 Fix binding of servers to physical devices, eg
1962 --server=/domain/1.2.3.4@eth0 which was broken from 2.43
1963 onwards unless --query-port=0 set. Thanks to Peter Naulls
1964 for the bug report.
1965
1966 Reply to DHCPINFORM requests even when the supplied ciaddr
1967 doesn't fall in any dhcp-range. In this case it's not
1968 possible to supply a complete configuration, but
1969 individually-configured options (eg PAC) may be useful.
1970
1971 Allow the source address of an alias to be a range:
1972 --alias=192.168.0.0,10.0.0.0,255.255.255.0 maps the whole
1973 subnet 192.168.0.0->192.168.0.255 to 10.0.0.0->10.0.0.255,
1974 as before.
1975 --alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0
1976 maps only the 192.168.0.10->192.168.0.40 region. Thanks to
1977 Ib Uhrskov for the suggestion.
1978
1979 Don't dynamically allocate DHCP addresses which may break
1980 Windows. Addresses which end in .255 or .0 are broken in
1981 Windows even when using supernetting.
1982 --dhcp-range=192.168.0.1,192.168.1.254,255,255,254.0 means
1983 192.168.0.255 is a valid IP address, but not for Windows.
1984 See Microsoft KB281579. We therefore no longer allocate
1985 these addresses to avoid hard-to-diagnose problems.
1986
1987 Update Polish translation. Thanks to Jan Psota.
1988
1989 Delete the PID-file when dnsmasq shuts down. Note that by
1990 this time, dnsmasq is normally not running as root, so
1991 this will fail if the PID-file is stored in a root-owned
1992 directory; such failure is silently ignored. To take
1993 advantage of this feature, the PID-file must be stored in a
1994 directory owned and write-able by the user running
1995 dnsmasq.
Simon Kelley7622fc02009-06-04 20:32:05 +01001996
1997
1998version 2.46
1999 Allow --bootp-dynamic to take a netid tag, so that it may
2000 be selectively enabled. Thanks to Olaf Westrik for the
2001 suggestion.
2002
2003 Remove ISC-leasefile reading code. This has been
2004 deprecated for a long time, and last time I removed it, it
2005 ended up going back by request of one user. This time,
2006 it's gone for good; otherwise it would need to be
2007 re-worked to support multiple domains (see below).
2008
2009 Support DHCP clients in multiple DNS domains. This is a
2010 long-standing request. Clients are assigned to a domain
2011 based in their IP address.
2012
2013 Add --dhcp-fqdn flag, which changes behaviour if DNS names
2014 assigned to DHCP clients. When this is set, there must be
2015 a domain associated with each client, and only
2016 fully-qualified domain names are added to the DNS. The
2017 advantage is that the only the FQDN needs to be unique,
2018 so that two or more DHCP clients can share a hostname, as
2019 long as they are in different domains.
2020
2021 Set environment variable DNSMASQ_DOMAIN when invoking
2022 lease-change script. This may be useful information to
2023 have now that it's variable.
2024
2025 Tighten up data-checking code for DNS packet
2026 handling. Thanks to Steve Dodd who found certain illegal
2027 packets which could crash dnsmasq. No memory overwrite was
2028 possible, so this is not a security issue beyond the DoS
2029 potential.
2030
2031 Update example config dhcp option 47, the previous
2032 suggestion generated an illegal, zero-length,
2033 option. Thanks to Matthias Andree for finding this.
2034
2035 Rewrite hosts-file reading code to remove the limit of
2036 1024 characters per line. John C Meuser found this.
2037
2038 Create a net-id tag with the name of the interface on
2039 which the DHCP request was received.
2040
2041 Fixed minor memory leak in DBus code, thanks to Jeremy
2042 Laine for the patch.
2043
2044 Emit DBus signals as the DHCP lease database
2045 changes. Thanks to Jeremy Laine for the patch.
2046
2047 Allow for more that one MAC address in a dhcp-host
2048 line. This configuration tells dnsmasq that it's OK to
2049 abandon a DHCP lease of the fixed address to one MAC
2050 address, if another MAC address in the dhcp-host statement
2051 asks for an address. This is useful to give a fixed
2052 address to a host which has two network interfaces
2053 (say, a laptop with wired and wireless interfaces.)
2054 It's very important to ensure that only one interface
2055 at a time is up, since dnsmasq abandons the first lease
2056 and re-uses the address before the leased time has
2057 elapsed. John Gray suggested this.
2058
2059 Tweak the response to a DHCP request packet with a wrong
2060 server-id when --dhcp-authoritative is set; dnsmasq now
2061 returns a DHCPNAK, rather than silently ignoring the
2062 packet. Thanks to Chris Marget for spotting this
2063 improvement.
2064
2065 Add --cname option. This provides a limited alias
2066 function, usable for DHCP names. Thanks to AJ Weber for
2067 suggestions on this.
2068
2069 Updated contrib/webmin with latest version from Neil
2070 Fisher.
2071
2072 Updated Polish translation. Thanks to Jan Psota.
2073
2074 Correct the text names for DHCP options 64 and 65 to be
2075 "nis+-domain" and "nis+-servers".
2076
2077 Updated Spanish translation. Thanks to Chris Chatham.
2078
2079 Force re-reading of /etc/resolv.conf when an "interface
2080 up" event occurs.
2081
2082
2083version 2.45
2084 Fix total DNS failure in release 2.44 unless --min-port
2085 specified. Thanks to Steven Barth and Grant Coady for
2086 bugreport. Also reject out-of-range port spec, which could
2087 break things too: suggestion from Gilles Espinasse.
2088
2089
2090version 2.44
2091 Fix crash when unknown client attempts to renew a DHCP
2092 lease, problem introduced in version 2.43. Thanks to
2093 Carlos Carvalho for help chasing this down.
2094
2095 Fix potential crash when a host which doesn't have a lease
2096 does DHCPINFORM. Again introduced in 2.43. This bug has
2097 never been reported in the wild.
2098
2099 Fix crash in netlink code introduced in 2.43. Thanks to
2100 Jean Wolter for finding this.
2101
2102 Change implementation of min_port to work even if min-port
2103 is large.
2104
2105 Patch to enable compilation of latest Mac OS X. Thanks to
2106 David Gilman.
2107
2108 Update Spanish translation. Thanks to Christopher Chatham.
2109
2110
2111version 2.43
2112 Updated Polish translation. Thanks to Jan Psota.
2113
2114 Flag errors when configuration options are repeated
2115 illegally.
2116
2117 Further tweaks for GNU/kFreeBSD
2118
2119 Add --no-wrap to msgmerge call - provides nicer .po file
2120 format.
2121
2122 Honour lease-time spec in dhcp-host lines even for
2123 BOOTP. The user is assumed to known what they are doing in
2124 this case. (Hosts without the time spec still get infinite
2125 leases for BOOTP, over-riding the default in the
2126 dhcp-range.) Thanks to Peter Katzmann for uncovering this.
2127
2128 Fix problem matching relay-agent ids. Thanks to Michael
2129 Rack for the bug report.
2130
2131 Add --naptr-record option. Suggestion from Johan
2132 Bergquist.
2133
2134 Implement RFC 5107 server-id-override DHCP relay agent
2135 option.
2136
2137 Apply patches from Stefan Kruger for compilation on
2138 Solaris 10 under Sun studio.
2139
2140 Yet more tweaking of Linux capability code, to suppress
2141 pointless wingeing from kernel 2.6.25 and above.
2142
2143 Improve error checking during startup. Previously, some
2144 errors which occurred during startup would be worked
2145 around, with dnsmasq still starting up. Some were logged,
2146 some silent. Now, they all cause a fatal error and dnsmasq
2147 terminates with a non-zero exit code. The errors are those
2148 associated with changing uid and gid, setting process
2149 capabilities and writing the pidfile. Thanks to Uwe
2150 Gansert and the Suse security team for pointing out
2151 this improvement, and Bill Reimers for good implementation
2152 suggestions.
2153
2154 Provide NO_LARGEFILE compile option to switch off largefile
2155 support when compiling against versions of uclibc which
2156 don't support it. Thanks to Stephane Billiart for the patch.
2157
2158 Implement random source ports for interactions with
2159 upstream nameservers. New spoofing attacks have been found
2160 against nameservers which do not do this, though it is not
2161 clear if dnsmasq is vulnerable, since to doesn't implement
2162 recursion. By default dnsmasq will now use a different
2163 source port (and socket) for each query it sends
2164 upstream. This behaviour can suppressed using the
2165 --query-port option, and the old default behaviour
2166 restored using --query-port=0. Explicit source-port
2167 specifications in --server configs are still honoured.
2168
2169 Replace the random number generator, for better
2170 security. On most BSD systems, dnsmasq uses the
2171 arc4random() RNG, which is secure, but on other platforms,
2172 it relied on the C-library RNG, which may be
2173 guessable and therefore allow spoofing. This release
2174 replaces the libc RNG with the SURF RNG, from Daniel
2175 J. Berstein's DJBDNS package.
2176
2177 Don't attempt to change user or group or set capabilities
2178 if dnsmasq is run as a non-root user. Without this, the
2179 change from soft to hard errors when these fail causes
2180 problems for non-root daemons listening on high
2181 ports. Thanks to Patrick McLean for spotting this.
2182
2183 Updated French translation. Thanks to Gildas Le Nadan.
Simon Kelley1f15b812009-10-13 17:49:32 +01002184
2185
2186version 2.42
2187 The changelog for version 2.42 and earlier is
2188 available in CHANGELOG.archive.