blob: 4f897999a8104e52f832ee3431c7dde49e1e8945 [file] [log] [blame]
Simon Kelley294d36d2016-07-06 21:30:25 +01001version 2.77
2 Calculate the length of TFTP error reply packet
3 correctly. This fixes a problem when the error
4 message in a TFTP packet exceeds the arbitrary
5 limit of 500 characters. The message was correctly
6 truncated, but not the packet length, so
7 extra data was appended. This is a possible
8 security risk, since the extra data comes from
9 a buffer which is also used for DNS, so that
10 previous DNS queries or replies may be leaked.
11 Thanks to Mozilla for funding the security audit
12 which spotted this bug.
13
Ivan Kokshaysky1d076672016-07-11 18:36:05 +010014 Fix logic error in Linux netlink code. This could
15 cause dnsmasq to enter a tight loop on systems
16 with a very large number of network interfaces.
17 Thanks to Ivan Kokshaysky for the diagnosis and
18 patch.
19
Kevin Darbyshire-Bryant06093a92016-07-11 21:03:27 +010020 Fix problem with --dnssec-timestamp whereby receipt
21 of SIGHUP would erroneously engage timestamp checking.
22 Thanks to Kevin Darbyshire-Bryant for this work.
Simon Kelleyc8328ec2016-08-05 16:54:58 +010023
24 Bump zone serial on reloading /etc/hosts and friends
25 when providing authoritative DNS. Thanks to Harrald
26 Dunkel for spotting this.
Kevin Darbyshire-Bryant06093a92016-07-11 21:03:27 +010027
Simon Kelley294d36d2016-07-06 21:30:25 +010028
Simon Kelleyd2aa7df2015-08-03 21:52:12 +010029version 2.76
30 Include 0.0.0.0/8 in DNS rebind checks. This range
31 translates to hosts on the local network, or, at
32 least, 0.0.0.0 accesses the local host, so could
33 be targets for DNS rebinding. See RFC 5735 section 3
34 for details. Thanks to Stephen Röttger for the bug report.
Ed Bardsleya7369be2015-08-05 21:17:18 +010035
36 Enhance --add-subnet to allow arbitrary subnet addresses.
37 Thanks to Ed Barsley for the patch.
Simon Kelley77607cb2015-09-10 23:08:43 +010038
39 Respect the --no-resolv flag in inotify code. Fixes bug
40 which caused dnsmasq to fail to start if a resolv-file
41 was a dangling symbolic link, even of --no-resolv set.
42 Thanks to Alexander Kurtz for spotting the problem.
43
Edwin Török41a8d9e2015-11-14 17:45:48 +000044 Fix crash when an A or AAAA record is defined locally,
45 in a hosts file, and an upstream server sends a reply
46 that the same name is empty. Thanks to Edwin Török for
47 the patch.
48
André Glüpkereddf3652016-01-12 12:54:17 +000049 Fix failure to correctly calculate cache-size when
50 reading a hosts-file fails. Thanks to André Glüpker
51 for the patch.
52
Simon Kelleyd05dd582016-01-19 21:23:30 +000053 Fix wrong answer to simple name query when --domain-needed
54 set, but no upstream servers configured. Dnsmasq returned
55 REFUSED, in this case, when it should be the same as when
56 upstream servers are configured - NOERROR. Thanks to
57 Allain Legacy for spotting the problem.
58
59 Return REFUSED when running out of forwarding table slots,
60 not SERVFAIL.
61
Hans Dedecker926332a2016-01-23 10:48:12 +000062 Add --max-port configuration. Thanks to Hans Dedecker for
63 the patch.
Simon Kelley1e505122016-01-25 21:29:23 +000064
65 Add --script-arp and two new functions for the dhcp-script.
66 These are "arp" and "arp-old" which announce the arrival and
67 removal of entries in the ARP or nieghbour tables.
68
69 Extend --add-mac to allow a new encoding of the MAC address
70 as base64, by configurting --add-mac=base64
Simon Kelleyfdc97e12016-02-13 17:47:17 +000071
Simon Kelley1e505122016-01-25 21:29:23 +000072 Add --add-cpe-id option.
73
Simon Kelleyfdc97e12016-02-13 17:47:17 +000074 Don't crash with divide-by-zero if an IPv6 dhcp-range
75 is declared as a whole /64.
76 (ie xx::0 to xx::ffff:ffff:ffff:ffff)
77 Thanks to Laurent Bendel for spotting this problem.
78
Simon Kelleye06e6e32016-02-24 21:26:16 +000079 Add support for a TTL parameter in --host-record and
80 --cname.
81
82 Add --dhcp-ttl option.
Simon Kelleyfdc97e12016-02-13 17:47:17 +000083
Simon Kelleybec366b2016-02-24 22:03:26 +000084 Add --tftp-mtu option. Thanks to Patrick McLean for the
85 initial patch.
86
Simon Kelleya2bc2542016-04-21 22:34:22 +010087 Check return-code of inet_pton() when parsing dhcp-option.
88 Bad addresses could fail to generate errors and result in
89 garbage dhcp-options being sent. Thanks to Marc Branchaud
90 for spotting this.
91
Simon Kelley14ffa072016-04-25 16:36:44 +010092 Fix wrong value for EDNS UDP packet size when using
93 --servers-file to define upstream DNS servers. Thanks to
94 Scott Bonar for the bug report.
95
Simon Kelley69cbf782016-05-03 21:33:38 +010096 Move the dhcp_release and dhcp_lease_time tools from
97 contrib/wrt to contrib/lease-tools.
98
99 Add dhcp_release6 to contrib/lease-tools. Many thanks
100 to Sergey Nechaev for this code.
101
Simon Kelleyb9702602016-05-03 22:34:06 +0100102 To avoid filling logs in configurations which define
103 many upstream nameservers, don't log more that 30 servers.
104 The number to be logged can be changed as SERVERS_LOGGED
Simon Kelley68bea102016-05-11 22:15:06 +0100105 in src/config.h.
106
107 Swap the values if BC_EFI and x86-64_EFI in --pxe-service.
108 These were previously wrong due to an error in RFC 4578.
109 If you're using BC_EFI to boot 64-bit EFI machines, you
110 will need to update your config.
111
112 Add ARM32_EFI and ARM64_EFI as valid architectures in
113 --pxe-service.
Simon Kelleyb9702602016-05-03 22:34:06 +0100114
Simon Kelley0a4a0492016-05-15 20:13:45 +0100115 Fix PXE booting for UEFI architectures. Modify PXE boot
116 sequence in this case to force the client to talk to dnsmasq
117 over port 4011. This makes PXE and especially proxy-DHCP PXE
118 work with these archictectures.
119
120 Workaround problems with UEFI PXE clients. There exist
121 in the wild PXE clients which have problems with PXE
122 boot menus. To work around this, when there's a single
123 --pxe-service which applies to client, then that target
124 will be booted directly, rather then sending a
125 single-item boot menu.
126
127 Many thanks to Jarek Polok, Michael Kuron and Dreamcat4
128 for their work on the long-standing UEFI PXE problem.
129
Simon Kelleyda2cad42016-05-18 15:14:08 +0100130 Subtle change in the semantics of "basename" in
131 --pxe-service. The historical behaviour has always been
132 that the actual filename downloaded from the TFTP server
133 is <basename>.<layer> where <layer> is an integer which
134 corresponds to the layer parameter supplied by the client.
135 It's not clear what the function of the "layer"
136 actually is in the PXE protocol, and in practise layer
137 is always zero, so the filename is <basename>.0
138 The new behaviour is the same as the old, except when
139 <basename> includes a file suffix, in which case
140 the layer suffix is no longer added. This allows
141 sensible suffices to be used, rather then the
142 meaningless ".0". Only in the unlikely event that you
143 have a config with a basename which already has a
144 suffix, is this an incompatible change, since the file
145 downloaded will change from name.suffix.0 to just
146 name.suffix
147
Simon Kelleybec366b2016-02-24 22:03:26 +0000148
Simon Kelley63ec5d12015-07-30 20:59:07 +0100149version 2.75
150 Fix reversion on 2.74 which caused 100% CPU use when a
151 dhcp-script is configured. Thanks to Adrian Davey for
152 reporting the bug and testing the fix.
153
154
Simon Kelley90cb2222015-07-05 21:59:10 +0100155version 2.74
156 Fix reversion in 2.73 where --conf-file would attempt to
157 read the default file, rather than no file.
158
Simon Kelley362c9302015-07-06 21:48:49 +0100159 Fix inotify code to handle dangling symlinks better and
160 not SEGV in some circumstances.
161
Simon Kelley13480e82015-07-16 22:23:13 +0100162 DNSSEC fix. In the case of a signed CNAME generated by a
163 wildcard which pointed to an unsigned domain, the wrong
164 status would be logged, and some necessary checks omitted.
165
Simon Kelley362c9302015-07-06 21:48:49 +0100166
Simon Kelley00cd9d52014-10-02 21:44:21 +0100167version 2.73
168 Fix crash at startup when an empty suffix is supplied to
169 --conf-dir, also trivial memory leak. Thanks to
170 Tomas Hozza for spotting this.
Simon Kelley800c5cc2014-12-15 17:50:15 +0000171
172 Remove floor of 4096 on advertised EDNS0 packet size when
173 DNSSEC in use, the original rationale for this has long gone.
174 Thanks to Anders Kaseorg for spotting this.
175
Simon Kelleyad946d52014-12-15 17:52:22 +0000176 Use inotify for checking on updates to /etc/resolv.conf and
177 friends under Linux. This fixes race conditions when the files are
Simon Kelley04918052015-01-26 11:23:43 +0000178 updated rapidly and saves CPU by noy polling. To build
179 a binary that runs on old Linux kernels without inotify,
180 use make COPTS=-DNO_INOTIFY
Simon Kelley3ad3f3b2014-12-16 18:25:17 +0000181
182 Fix breakage of --domain=<domain>,<subnet>,local - only reverse
183 queries were intercepted. THis appears to have been broken
184 since 2.69. Thanks to Josh Stone for finding the bug.
Simon Kelley47669362014-12-17 12:41:56 +0000185
186 Eliminate IPv6 privacy addresses and deprecated addresses from
187 the answers given by --interface-name. Note that reverse queries
188 (ie looking for names, given addresses) are not affected.
189 Thanks to Michael Gorbach for the suggestion.
Simon Kelley094b5c32014-12-21 16:11:52 +0000190
191 Fix crash in DNSSEC code with long RRs. Thanks to Marco Davids
192 for the bug report.
Glen Huang32fc6db2014-12-27 15:28:12 +0000193
194 Add --ignore-address option. Ignore replies to A-record
195 queries which include the specified address. No error is
196 generated, dnsmasq simply continues to listen for another
197 reply. This is useful to defeat blocking strategies which
198 rely on quickly supplying a forged answer to a DNS
199 request for certain domains, before the correct answer can
200 arrive. Thanks to Glen Huang for the patch.
Simon Kelleyad946d52014-12-15 17:52:22 +0000201
Simon Kelley97e618a2015-01-07 21:55:43 +0000202 Revisit the part of DNSSEC validation which determines if an
203 unsigned answer is legit, or is in some part of the DNS
204 tree which should be signed. Dnsmasq now works from the
205 DNS root downward looking for the limit of signed
206 delegations, rather than working bottom up. This is
207 both more correct, and less likely to trip over broken
208 nameservers in the unsigned parts of the DNS tree
209 which don't respond well to DNSSEC queries.
Simon Kelley00cd9d52014-10-02 21:44:21 +0100210
Simon Kelley25cf5e32015-01-09 15:53:03 +0000211 Add --log-queries=extra option, which makes logs easier
212 to search automatically.
213
RinSatsuki28de3872015-01-10 15:22:21 +0000214 Add --min-cache-ttl option. I've resisted this for a long
215 time, on the grounds that disbelieving TTLs is never a
216 good idea, but I've been persuaded that there are
217 sometimes reasons to do it. (Step forward, GFW).
218 To avoid misuse, there's a hard limit on the TTL
219 floor of one hour. Thansk to RinSatsuki for the patch.
Simon Kelley39341552015-01-18 22:11:10 +0000220
221 Cope with multiple interfaces with the same link-local
222 address. (IPv6 addresses are scoped, so this is allowed.)
223 Thanks to Cory Benfield for help with this.
Simon Kelley5f4dc5c2015-01-20 20:51:02 +0000224
225 Add --dhcp-hostsdir. This allows addition of new host
226 configurations to a running dnsmasq instance much more
227 cheaply than having dnsmasq re-read all its existing
228 configuration each time.
RinSatsuki28de3872015-01-10 15:22:21 +0000229
Win King Wan61b838d2015-01-21 20:41:48 +0000230 Don't reply to DHCPv6 SOLICIT messages if we're not
231 configured to do stateful DHCPv6. Thanks to Win King Wan
232 for the patch.
233
Simon Kelley6ef15b32015-01-31 22:44:26 +0000234 Fix broken DNSSEC validation of ECDSA signatures.
Simon Kelleyf6e62e22015-03-01 18:17:54 +0000235
236 Add --dnssec-timestamp option, which provides an automatic
Simon Kelley38440b22015-04-12 21:52:47 +0100237 way to detect when the system time becomes valid after
238 boot on systems without an RTC, whilst allowing DNS
239 queries before the clock is valid so that NTP can run.
240 Thanks to Kevin Darbyshire-Bryant for developing this idea.
Stefan Tomanek30d08792015-03-31 22:32:11 +0100241
242 Add --tftp-no-fail option. Thanks to Stefan Tomanek for
243 the patch.
Simon Kelley04b0ac02015-04-06 17:19:13 +0100244
Simon Kelley38440b22015-04-12 21:52:47 +0100245 Fix crash caused by looking up servers.bind, CHAOS text
246 record, when more than about five --servers= lines are
247 in the dnsmasq config. This causes memory corruption
248 which causes a crash later. Thanks to Matt Coddington for
249 sterling work chasing this down.
250
251 Fix crash on receipt of certain malformed DNS requests.
252 Thanks to Nick Sampanis for spotting the problem.
Simon Kelley0df29f52015-04-16 15:24:52 +0100253 Note that this is could allow the dnsmasq process's
254 memory to be read by an attacker under certain
255 circumstances, so it has a CVE, CVE-2015-3294
Simon Kelley38440b22015-04-12 21:52:47 +0100256
257 Fix crash in authoritative DNS code, if a .arpa zone
258 is declared as authoritative, and then a PTR query which
259 is not to be treated as authoritative arrived. Normally,
260 directly declaring .arpa zone as authoritative is not
261 done, so this crash wouldn't be seen. Instead the
262 relevant .arpa zone should be specified as a subnet
263 in the auth-zone declaration. Thanks to Johnny S. Lee
264 for the bugreport and initial patch.
Simon Kelley04b0ac02015-04-06 17:19:13 +0100265
Simon Kelley78c61842015-04-16 15:05:30 +0100266 Fix authoritative DNS code to correctly reply to NS
267 and SOA queries for .arpa zones for which we are
268 declared authoritative by means of a subnet in auth-zone.
269 Previously we provided correct answers to PTR queries
270 in such zones (including NS and SOA) but not direct
271 NS and SOA queries. Thanks to Johnny S. Lee for
Simon Kelleya5ae1f82015-04-25 21:46:10 +0100272 pointing out the problem.
273
274 Fix logging of DHCPREPLY which should be suppressed
275 by quiet-dhcp6. Thanks to J. Pablo Abonia for
276 spotting the problem.
Simon Kelley78c61842015-04-16 15:05:30 +0100277
Simon Kelleya77cec82015-05-08 16:25:38 +0100278 Try and handle net connections with broken fragmentation
279 that lose large UDP packets. If a server times out,
280 reduce the maximum UDP packet size field in the EDNS0
281 header to 1280 bytes. If it then answers, make that
282 change permanent.
283
Simon Kelleyb059c962015-05-08 20:25:51 +0100284 Check IPv4-mapped IPv6 addresses when --stop-rebind
285 is active. Thanks to Jordan Milne for spotting this.
286
Simon Kelleyca85a282015-05-13 22:33:04 +0100287 Allow DHCPv4 options T1 and T2 to be set using --dhcp-option.
288 Thanks to Kevin Benton for patches and work on this.
289
Simon Kelley89130d92015-06-03 22:30:59 +0100290 Fix code for DHCPCONFIRM DHCPv6 messages to confirm addresses
291 in the correct subnet, even of not in dynamic address
292 allocation range. Thanks to Steve Hirsch for spotting
293 the problem.
Nicolas Cavallaric6d82c92015-06-09 20:42:20 +0100294
295 Add AddDhcpLease and DeleteDhcpLease DBus methods. Thanks
296 to Nicolas Cavallari for the patch.
Neil Jerram4918bd52015-06-10 22:23:20 +0100297
298 Allow configuration of router advertisements without the
299 "on-link" bit set. Thanks to Neil Jerram for the patch.
300
301 Extend --bridge-interface to DHCPv6 and router
302 advertisements. Thanks to Neil Jerram for the patch.
Simon Kelley89130d92015-06-03 22:30:59 +0100303
Simon Kelley97e618a2015-01-07 21:55:43 +0000304
Simon Kelley8e9ffba2014-05-20 20:38:25 +0100305version 2.72
Simon Kelleyc4a09372014-06-02 20:30:07 +0100306 Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.
307
308 Add support for "ipsets" in *BSD, using pf. Thanks to
309 Sven Falempim for the patch.
Simon Kelley8e9ffba2014-05-20 20:38:25 +0100310
Simon Kelleya0358e52014-06-07 13:38:48 +0100311 Fix race condition which could lock up dnsmasq when an
312 interface goes down and up rapidly. Thanks to Conrad
313 Kostecki for helping to chase this down.
Daniel Collinsc4638f92014-06-07 21:21:44 +0100314
315 Add DBus methods SetFilterWin2KOption and SetBogusPrivOption
316 Thanks to the Smoothwall project for the patch.
Simon Kelleycdb755c2014-06-18 20:52:53 +0100317
318 Fix failure to build against Nettle-3.0. Thanks to Steven
319 Barth for spotting this and finding the fix.
Simon Kelleya0358e52014-06-07 13:38:48 +0100320
Simon Kelley6d8e8ac2014-07-13 22:12:45 +0100321 When assigning existing DHCP leases to intefaces by comparing
322 networks, handle the case that two or more interfaces have the
323 same network part, but different prefix lengths (favour the
324 longer prefix length.) Thanks to Lung-Pin Chang for the
325 patch.
326
Simon Kelleyb5ea1cc2014-07-29 16:34:14 +0100327 Add a mode which detects and removes DNS forwarding loops, ie
328 a query sent to an upstream server returns as a new query to
329 dnsmasq, and would therefore be forwarded again, resulting in
330 a query which loops many times before being dropped. Upstream
331 servers which loop back are disabled and this event is logged.
332 Thanks to Smoothwall for their sponsorship of this feature.
333
Simon Kelley3e1551a2014-09-09 21:46:07 +0100334 Extend --conf-dir to allow filtering of files. So
335 --conf-dir=/etc/dnsmasq.d,\*.conf
336 will load all the files in /etc/dnsmasq.d which end in .conf
Ilya Ponetaev5bf50af2014-09-09 12:46:21 +0100337
Simon Kelley288df492014-09-18 21:48:51 +0100338 Fix bug when resulted in NXDOMAIN answers instead of NODATA in
339 some circumstances.
Simon Kelley57826492014-09-18 22:08:58 +0100340
341 Fix bug which caused dnsmasq to become unresponsive if it
342 failed to send packets due to a network interface disappearing.
343 Thanks to Niels Peen for spotting this.
Simon Kelleybf2db4b2014-09-18 22:10:46 +0100344
345 Fix problem with --local-service option on big-endian platforms
346 Thanks to Richard Genoud for the patch.
347
Simon Kelleyad4a8ff2015-04-09 21:48:00 +0100348
Simon Kelley9d1b22a2014-04-29 13:02:41 +0100349version 2.71
350 Subtle change to error handling to help DNSSEC validation
351 when servers fail to provide NODATA answers for
352 non-existent DS records.
353
354 Tweak code which removes DNSSEC records from answers when
355 not required. Fixes broken answers when additional section
356 has real records in it. Thanks to Marco Davids for the bug
357 report.
358
359 Fix DNSSEC validation of ANY queries. Thanks to Marco Davids
360 for spotting that too.
361
Simon Kelleyb692f232014-05-09 10:29:43 +0100362 Fix total DNS failure and 100% CPU use if cachesize set to zero,
363 regression introduced in 2.69. Thanks to James Hunt and
364 the Ubuntu crowd for assistance in fixing this.
365
Simon Kelley9d1b22a2014-04-29 13:02:41 +0100366
Simon Kelley63758382014-04-16 22:20:55 +0100367version 2.70
368 Fix crash, introduced in 2.69, on TCP request when dnsmasq
369 compiled with DNSSEC support, but running without DNSSEC
370 enabled. Thanks to Manish Sing for spotting that one.
371
Simon Kelley3b1b3e92014-04-23 15:46:05 +0100372 Fix regression which broke ipset functionality. Thanks to
373 Wang Jian for the bug report.
374
Simon Kelley63758382014-04-16 22:20:55 +0100375
Simon Kelley1ee9be42013-12-09 16:50:19 +0000376version 2.69
377 Implement dynamic interface discovery on *BSD. This allows
378 the contructor: syntax to be used in dhcp-range for DHCPv6
379 on the BSD platform. Thanks to Matthias Andree for
380 valuable research on how to implement this.
381
Simon Kelley8db957d2013-12-17 15:47:10 +0000382 Fix infinite loop associated with some --bogus-nxdomain
Simon Kelley74e6b522013-12-17 21:33:53 +0000383 configs. Thanks fogobogo for the bug report.
Simon Kelley8db957d2013-12-17 15:47:10 +0000384
Simon Kelleyae762422014-01-10 18:15:16 +0000385 Fix missing RA RDNS option with configuration like
386 --dhcp-option=option6:23,[::] Thanks to Tsachi Kimeldorfer
387 for spotting the problem.
388
Simon Kelleyc3a04082014-01-11 22:18:19 +0000389 Add [fd00::] and [fe80::] as special addresses in DHCPv6
390 options, analogous to [::]. [fd00::] is replaced with the
391 actual ULA of the interface on the machine running
392 dnsmasq, [fe80::] with the link-local address.
393 Thanks to Tsachi Kimeldorfer for championing this.
394
Simon Kelley613d6c52014-02-04 11:50:11 +0000395 DNSSEC validation and caching. Dnsmasq needs to be
396 compiled with this enabled, with
397
398 make dnsmasq COPTS=-DHAVE_DNSSEC
399
400 this add dependencies on the nettle crypto library and the
401 gmp maths library. It's possible to have these linked
402 statically with
403
404 make dnsmasq COPTS='-DHAVE_DNSSEC -DHAVE_DNSSEC_STATIC'
405
Simon Kelley198d9402014-04-09 20:36:53 +0100406 which bloats the dnsmasq binary, but saves the size of
407 the shared libraries which are much bigger.
408
Simon Kelley613d6c52014-02-04 11:50:11 +0000409 To enable, DNSSEC, you will need a set of
410 trust-anchors. Now that the TLDs are signed, this can be
411 the keys for the root zone, and for convenience they are
412 included in trust-anchors.conf in the dnsmasq
413 distribution. You should of course check that these are
414 legitimate and up-to-date. So, adding
415
416 conf-file=/path/to/trust-anchors.conf
417 dnssec
Simon Kelley1ee9be42013-12-09 16:50:19 +0000418
Simon Kelley613d6c52014-02-04 11:50:11 +0000419 to your config is all thats needed to get things
420 working. The upstream nameservers have to be DNSSEC-capable
421 too, of course. Many ISP nameservers aren't, but the
422 Google public nameservers (8.8.8.8 and 8.8.4.4) are.
423 When DNSSEC is configured, dnsmasq validates any queries
424 for domains which are signed. Query results which are
425 bogus are replaced with SERVFAIL replies, and results
426 which are correctly signed have the AD bit set. In
427 addition, and just as importantly, dnsmasq supplies
428 correct DNSSEC information to clients which are doing
429 their own validation, and caches DNSKEY, DS and RRSIG
430 records, which significantly improve the performance of
431 downstream validators. Setting --log-queries will show
432 DNSSEC in action.
433
Simon Kelley198d9402014-04-09 20:36:53 +0100434 If a domain is returned from an upstream nameserver without
435 DNSSEC signature, dnsmasq by default trusts this. This
436 means that for unsigned zone (still the majority) there
437 is effectively no cost for having DNSSEC enabled. Of course
438 this allows an attacker to replace a signed record with a
439 false unsigned record. This is addressed by the
440 --dnssec-check-unsigned flag, which instructs dnsmasq
441 to prove that an unsigned record is legitimate, by finding
442 a secure proof that the zone containing the record is not
443 signed. Doing this has costs (typically one or two extra
444 upstream queries). It also has a nasty failure mode if
445 dnsmasq's upstream nameservers are not DNSSEC capable.
446 Without --dnssec-check-unsigned using such an upstream
447 server will simply result in not queries being validated;
448 with --dnssec-check-unsigned enabled and a
449 DNSSEC-ignorant upstream server, _all_ queries will fail.
450
451 Note that DNSSEC requires that the local time is valid and
452 accurate, if not then DNSSEC validation will fail. NTP
453 should be running. This presents a problem for routers
454 without a battery-backed clock. To set the time needs NTP
455 to do DNS lookups, but lookups will fail until NTP has run.
456 To address this, there's a flag, --dnssec-no-timecheck
457 which disables the time checks (only) in DNSSEC. When dnsmasq
458 is started and the clock is not synced, this flag should
459 be used. As soon as the clock is synced, SIGHUP dnsmasq.
460 The SIGHUP clears the cache of partially-validated data and
461 resets the no-timecheck flag, so that all DNSSEC checks
462 henceforward will be complete.
463
Simon Kelley613d6c52014-02-04 11:50:11 +0000464 The development of DNSSEC in dnsmasq was started by
465 Giovanni Bajo, to whom huge thanks are owed. It has been
466 supported by Comcast, whose techfund grant has allowed for
467 an invaluable period of full-time work to get it to
468 a workable state.
469
Simon Kelleyde73a492014-02-17 21:43:27 +0000470 Add --rev-server. Thanks to Dave Taht for suggesting this.
Simon Kelley7b1eae42014-02-20 13:43:28 +0000471
472 Add --servers-file. Allows dynamic update of upstream servers
473 full access to configuration.
Simon Kelleyde73a492014-02-17 21:43:27 +0000474
Simon Kelleyc8a80482014-03-05 14:29:54 +0000475 Add --local-service. Accept DNS queries only from hosts
476 whose address is on a local subnet, ie a subnet for which
477 an interface exists on the server. This option
Simon Kelleyf00690f2014-03-12 20:07:12 +0000478 only has effect if there are no --interface --except-interface,
Simon Kelleyc8a80482014-03-05 14:29:54 +0000479 --listen-address or --auth-server options. It is intended
480 to be set as a default on installation, to allow
481 unconfigured installations to be useful but also safe from
482 being used for DNS amplification attacks.
483
Simon Kelley604f7592014-03-22 19:33:43 +0000484 Fix crashes in cache_get_cname_target() when dangling CNAMEs
485 encountered. Thanks to Andy and the rt-n56u project for
486 find this and helping to chase it down.
487
Simon Kelley10068602014-04-03 21:16:40 +0100488 Fix wrong RCODE in authoritative DNS replies to PTR queries. The
489 correct answer was included, but the RCODE was set to NXDOMAIN.
490 Thanks to Craig McQueen for spotting this.
491
Simon Kelley198d9402014-04-09 20:36:53 +0100492 Make statistics available as DNS queries in the .bind TLD as
493 well as logging them.
494
Simon Kelleyc8a80482014-03-05 14:29:54 +0000495
Simon Kelley376d48c2013-11-13 13:04:30 +0000496version 2.68
497 Use random addresses for DHCPv6 temporary address
498 allocations, instead of algorithmically determined stable
499 addresses.
500
501 Fix bug which meant that the DHCPv6 DUID was not available
502 in DHCP script runs during the lifetime of the dnsmasq
503 process which created the DUID de-novo. Once the DUID was
504 created and stored in the lease file and dnsmasq
505 restarted, this bug disappeared.
506
507 Fix bug introduced in 2.67 which could result in erroneous
508 NXDOMAIN returns to CNAME queries.
509
510 Fix build failures on MacOS X and openBSD.
511
512 Allow subnet specifications in --auth-zone to be interface
513 names as well as address literals. This makes it possible
514 to configure authoritative DNS when local address ranges
515 are dynamic and works much better than the previous
516 work-around which exempted contructed DHCP ranges from the
517 IP address filtering. As a consequence, that work-around
518 is removed. Under certain circumstances, this change wil
519 break existing configuration: if you're relying on the
520 contructed-range exception, you need to change --auth-zone
521 to specify the same interface as is used to construct your
522 DHCP ranges, probably with a trailing "/6" like this:
523 --auth-zone=example.com,eth0/6 to limit the addresses to
524 IPv6 addresses of eth0.
Simon Kelleydd9d9ce2013-11-15 11:24:00 +0000525
526 Fix problems when advertising deleted IPv6 prefixes. If
527 the prefix is deleted (rather than replaced), it doesn't
528 get advertised with zero preferred time. Thanks to Tsachi
529 for the bug report.
Simon Kelley25439062013-11-25 21:14:51 +0000530
531 Fix segfault with some locally configured CNAMEs. Thanks
532 to Andrew Childs for spotting the problem.
533
534 Fix memory leak on re-reading /etc/hosts and friends,
535 introduced in 2.67.
Simon Kelley2329bef2013-12-03 13:41:16 +0000536
537 Check the arrival interface of incoming DNS and TFTP
538 requests via IPv6, even in --bind-interfaces mode. This
539 isn't possible for IPv4 and can generate scary warnings,
540 but as it's always possible for IPv6 (the API always
541 exists) then we should do it always.
Vladislav Grishenko4c82efc2013-12-03 16:05:30 +0000542
543 Tweak the rules on prefix-lengths in --dhcp-range for
544 IPv6. The new rule is that the specified prefix length
545 must be larger than or equal to the prefix length of the
546 corresponding address on the local interface.
547
Simon Kelley376d48c2013-11-13 13:04:30 +0000548
Giacomo Tazzari797a7af2013-04-22 13:16:37 +0100549version 2.67
550 Fix crash if upstream server returns SERVFAIL when
551 --conntrack in use. Thanks to Giacomo Tazzari for finding
552 this and supplying the patch.
Simon Kelleyaa63a212013-04-22 15:01:52 +0100553
554 Repair regression in 2.64. That release stopped sending
555 lease-time information in the reply to DHCPINFORM
556 requests, on the correct grounds that it was a standards
557 violation. However, this broke the dnsmasq-specific
558 dhcp_lease_time utility. Now, DHCPINFORM returns
559 lease-time only if it's specifically requested
560 (maintaining standards) and the dhcp_lease_time utility
561 has been taught to ask for it (restoring functionality).
Simon Kelley86e92f92013-04-23 11:31:39 +0100562
563 Fix --dhcp-match, --dhcp-vendorclass and --dhcp-userclass
564 to work with BOOTP and well as DHCP. Thanks to Peter
565 Korsgaard for spotting the problem.
Simon Kelley2bb73af2013-04-24 17:38:19 +0100566
567 Add --synth-domain. Thanks to Vishvananda Ishaya for
568 suggesting this.
Simon Kelleyd5052fb2013-04-25 12:44:20 +0100569
570 Fix failure to compile ipset.c if old kernel headers are
571 in use. Thanks to Eugene Rudoy for pointing this out.
Simon Kelley3f2873d2013-05-14 11:28:47 +0100572
573 Handle IPv4 interface-address labels in Linux. These are
574 often used to emulate the old IP-alias addresses. Before,
575 using --interface=eth0 would service all the addresses of
576 eth0, including ones configured as aliases, which appear
577 in ifconfig as eth0:0. Now, only addresses with the label
578 eth0 are active. This is not backwards compatible: if you
579 want to continue to bind the aliases too, you need to add
580 eg. --interface=eth0:0 to the config.
Giacomo Tazzari797a7af2013-04-22 13:16:37 +0100581
Simon Kelleycfcad422013-05-17 11:32:03 +0100582 Fix "failed to set SO_BINDTODEVICE on DHCP socket: Socket
583 operation on non-socket" error on startup with
584 configurations which have exactly one --interface option
585 and do RA but _not_ DHCPv6. Thanks to Trever Adams for the
586 bug report.
Giacomo Tazzari797a7af2013-04-22 13:16:37 +0100587
Simon Kelley115ac3e2013-05-20 11:28:32 +0100588 Generalise --interface-name to cope with IPv6 addresses
589 and multiple addresses per interface per address family.
590
Simon Kelley3e8ed782013-05-29 14:31:33 +0100591 Fix option parsing for --dhcp-host, which was generating a
592 spurious error when all seven possible items were
593 included. Thanks to Zhiqiang Wang for the bug report.
Simon Kelleybaa80ae2013-05-29 16:32:07 +0100594
595 Remove restriction on prefix-length in --auth-zone. Thanks
596 to Toke Hoiland-Jorgensen for suggesting this.
597
Marcelo Salhab Brogliato0da5e892013-05-31 11:49:06 +0100598 Log when the maximum number of concurrent DNS queries is
599 reached. Thanks to Marcelo Salhab Brogliato for the patch.
600
Simon Kelleye2ba0df2013-05-31 17:04:25 +0100601 If wildcards are used in --interface, don't assume that
602 there will only ever be one available interface for DHCP
603 just because there is one at start-up. More may appear, so
604 we can't use SO_BINDTODEVICE. Thanks to Natrio for the bug
605 report.
606
Simon Kelleyb4b93082013-06-19 10:31:23 +0100607 Increase timeout/number of retries in TFTP to accomodate
608 AudioCodes Voice Gateways doing streaming writes to flash.
609 Thanks to Damian Kaczkowski for spotting the problem.
610
Simon Kelley625ac282013-07-02 21:19:32 +0100611 Fix crash with empty DHCP string options when adding zero
Simon Kelley3953dcc2013-07-03 20:40:45 +0100612 terminator. Thanks to Patrick McLean for the bug report.
Simon Kelley625ac282013-07-02 21:19:32 +0100613
Kyle Mesteryd859ca22013-07-24 13:11:58 +0100614 Allow hostnames to start with a number, as allowed in
615 RFC-1123. Thanks to Kyle Mestery for the patch.
616
Roy Marples3f3adae2013-07-25 16:22:46 +0100617 Fixes to DHCP FQDN option handling: don't terminate FQDN
618 if domain not known and allow a FQDN option with blank
619 name to request that a FQDN option is returned in the
620 reply. Thanks to Roy Marples for the patch.
621
Simon Kelleyd9fb0be2013-07-25 21:47:17 +0100622 Make --clear-on-reload apply to setting upstream servers
623 via DBus too.
624
Simon Kelleyef1a94a2013-07-26 13:59:03 +0100625 When the address which triggered the construction of an
626 advertised IPv6 prefix disappears, continue to advertise
627 the prefix for up to 2 hours, with the preferred lifetime
628 set to zero. This satisfies RFC 6204 4.3 L-13 and makes
629 things work better if a prefix disappears without being
630 deprecated first. Thanks to Uwe Schindler for persuasively
631 arguing for this.
632
Simon Kelleyfc4c4fd2013-07-26 15:38:59 +0100633 Fix MAC address enumeration on *BSD. Thanks to Brad Smith
634 for the bug report.
Simon Kelleyb4b93082013-06-19 10:31:23 +0100635
Simon Kelley871d4562013-07-27 21:32:32 +0100636 Support RFC-4242 information-refresh-time options in the
637 reply to DHCPv6 information-request. The lease time of the
638 smallest valid dhcp-range is sent. Thanks to Uwe Schindler
639 for suggesting this.
640
Simon Kelleyedf0bde2013-07-29 17:21:48 +0100641 Make --listen-address higher priority than --except-interface
642 in all circumstances. Thanks to Thomas Hood for the bugreport.
643
Simon Kelley2937f8a2013-07-29 19:49:07 +0100644 Provide independent control over which interfaces get TFTP
645 service. If enable-tftp is given a list of interfaces, then TFTP
646 is provided on those. Without the list, the previous behaviour
647 (provide TFTP to the same interfaces we provide DHCP to)
648 is retained. Thanks to Lonnie Abelbeck for the suggestion.
649
Simon Kelley6acef732013-09-09 15:21:39 +0100650 Add --dhcp-relay config option. Many thanks to vtsl.net
651 for sponsoring this development.
Simon Kelleyff7eea22013-09-04 18:01:38 +0100652
Simon Kelley0932f9c2013-09-05 11:30:30 +0100653 Fix crash with empty tag: in --dhcp-range. Thanks to
654 Kaspar Schleiser for the bug report.
655
Simon Kelleyceae52d2013-09-12 15:05:47 +0100656 Add "baseline" and "bloatcheck" makefile targets, for
657 revealing size changes during development. Thanks to
658 Vladislav Grishenko for the patch.
659
Simon Kelleyc8f2dd82013-09-13 11:22:55 +0100660 Cope with DHCPv6 clients which send REQUESTs without
661 address options - treat them as SOLICIT with rapid commit.
662
Simon Kelley89500e32013-09-20 16:29:20 +0100663 Support identification of clients by MAC address in
664 DHCPv6. When using a relay, the relay must support RFC
665 6939 for this to work. It always works for directly
666 connected clients. Thanks to Vladislav Grishenko
667 for prompting this feature.
Simon Kelley861c8912013-09-25 15:30:30 +0100668
669 Remove the rule for constructed DHCP ranges that the local
670 address must be either the first or last address in the
671 range. This was originally to avoid SLAAC addresses, but
672 we now explicitly autoconfig and privacy addresses instead.
Simon Kelley89500e32013-09-20 16:29:20 +0100673
Simon Kelley889d8a12013-10-02 13:12:09 +0100674 Update Polish translation. Thanks to Jan Psota.
675
Tanguy Bouzelocef1d7422013-10-03 11:06:31 +0100676 Fix problem in DHCPv6 vendorclass/userclass matching
677 code. Thanks to Tanguy Bouzeloc for the patch.
678
Vic043c2712013-10-04 15:09:13 +0100679 Update Spanish transalation. Thanks to Vicente Soriano.
Simon Kelley871d4562013-07-27 21:32:32 +0100680
Simon Kelleyc4cd95d2013-10-10 20:58:11 +0100681 Add --ra-param option. Thanks to Vladislav Grishenko for
682 inspiration on this.
683
Simon Kelleyed4c0762013-10-08 20:46:34 +0100684 Add --add-subnet configuration, to tell upstream DNS
Simon Kelleyf65b0e52013-10-11 10:19:01 +0100685 servers where the original client is. Thanks to DNSthingy
686 for sponsoring this feature.
Simon Kelleyed4c0762013-10-08 20:46:34 +0100687
Kevin Darbyshire-Bryant8c0b73d2013-10-11 11:56:33 +0100688 Add --quiet-dhcp, --quiet-dhcp6 and --quiet-ra. Thanks to
689 Kevin Darbyshire-Bryant for the initial patch.
690
Simon Kelleyd56a6042013-10-11 14:39:03 +0100691 Allow A/AAAA records created by --interface-name to be the
692 target of --cname. Thanks to Hadmut Danisch for the
693 suggestion.
694
Simon Kelley24b5a5d2013-10-11 15:19:28 +0100695 Avoid treating a --dhcp-host which has an IPv6 address
696 as eligable for use with DHCPv4 on the grounds that it has
697 no address, and vice-versa. Thanks to Yury Konovalov for
698 spotting the problem.
699
Simon Kelley45cca582013-10-15 10:20:13 +0100700 Do a better job caching dangling CNAMEs. Thanks to Yves
701 Dorfsman for spotting the problem.
702
Vic043c2712013-10-04 15:09:13 +0100703
Simon Kelley333b2ce2013-01-07 21:46:03 +0000704version 2.66
705 Add the ability to act as an authoritative DNS
706 server. Dnsmasq can now answer queries from the wider 'net
707 with local data, as long as the correct NS records are set
708 up. Only local data is provided, to avoid creating an open
709 DNS relay. Zone transfer is supported, to allow secondary
710 servers to be configured.
711
712 Add "constructed DHCP ranges" for DHCPv6. This is intended
713 for IPv6 routers which get prefixes dynamically via prefix
714 delegation. With suitable configuration, stateful DHCPv6
715 and RA can happen automatically as prefixes are delegated
716 and then deprecated, without having to re-write the
717 dnsmasq configuration file or restart the daemon. Thanks to
718 Steven Barth for extensive testing and development work on
719 this idea.
Simon Kelley71c73ac2013-01-08 21:22:24 +0000720
721 Fix crash on startup on Solaris 11. Regression probably
Simon Kelley22ce5502013-01-22 13:53:04 +0000722 introduced in 2.61. Thanks to Geoff Johnstone for the
723 patch.
724
725 Add code to make behaviour for TCP DNS requests that same
726 as for UDP requests, when a request arrives for an allowed
727 address, but via a banned interface. This change is only
728 active on Linux, since the relevant API is missing (AFAIK)
729 on other platforms. Many thanks to Tomas Hozza for
730 spotting the problem, and doing invaluable discovery of
731 the obscure and undocumented API required for the solution.
Simon Kelleya21e27b2013-02-17 16:41:35 +0000732
733 Don't send the default DHCP option advertising dnsmasq as
734 the local DNS server if dnsmasq is configured to not act
735 as DNS server, or it's configured to a non-standard port.
Simon Kelleydd1721c2013-02-18 21:04:04 +0000736
737 Add DNSMASQ_CIRCUIT_ID, DNSMASQ_SUBCRIBER_ID,
738 DNSMASQ_REMOTE_ID variables to the environment of the
Simon Kelley3d77c042013-03-22 10:03:50 +0000739 lease-change script (and the corresponding Lua). These hold
Simon Kelleydd1721c2013-02-18 21:04:04 +0000740 information inserted into the DHCP request by a DHCP relay
741 agent. Thanks to Lakefield Communications for providing a
742 bounty for this addition.
743
Simon Kelley4038ae22013-02-19 16:47:07 +0000744 Fixed crash, introduced in 2.64, whilst handling DHCPv6
745 information-requests with some common configurations.
746 Thanks to Robert M. Albrecht for the bug report and
747 chasing the problem.
748
Jason A. Donenfeld13d86c72013-02-22 18:20:53 +0000749 Add --ipset option. Thanks to Jason A. Donenfeld for the
750 patch.
751
Simon Kelleyc7961072013-02-28 15:17:58 +0000752 Don't erroneously reject some option names in --dhcp-match
Simon Kelley3d77c042013-03-22 10:03:50 +0000753 options. Thanks to Benedikt Hochstrasser for the bug report.
Simon Kelley49333cb2013-03-15 20:30:51 +0000754
755 Allow a trailing '*' wildcard in all interface-name
756 configurations. Thanks to Christian Parpart for the patch.
Simon Kelleyc7961072013-02-28 15:17:58 +0000757
Simon Kelley56a11422013-04-02 17:02:58 +0100758 Handle the situation where libc headers define
759 SO_REUSEPORT, but the kernel in use doesn't, to cope with
760 the introduction of this option to Linux. Thanks to Rich
761 Felker for the bug report.
762
Simon Kelleycd1e04a2013-04-02 20:11:48 +0100763 Update Polish translation. Thanks to Jan Psota.
Simon Kelley0b0a73c2013-04-11 14:07:02 +0100764
765 Fix crash if the configured DHCP lease limit is
766 reached. Regression occurred in 2.61. Thanks to Tsachi for
767 the bug report.
Simon Kelleycd1e04a2013-04-02 20:11:48 +0100768
Simon Kelley834f36f2013-04-17 13:52:49 +0100769 Update the French translation. Thanks to Gildas le Nadan.
770
Simon Kelley49333cb2013-03-15 20:30:51 +0000771
Simon Kelleyee86ce62012-12-07 11:54:46 +0000772version 2.65
773 Fix regression which broke forwarding of queries sent via
774 TCP which are not for A and AAAA and which were directed to
775 non-default servers. Thanks to Niax for the bug report.
776
Simon Kelleyb5a8dd12012-12-10 11:37:25 +0000777 Fix failure to build with DHCP support excluded. Thanks to
778 Gustavo Zacarias for the patch.
Simon Kelley1d6c6392012-12-14 11:19:36 +0000779
780 Fix nasty regression in 2.64 which completely broke cacheing.
Simon Kelleyb5a8dd12012-12-10 11:37:25 +0000781
782
Simon Kelley2e34ac12012-08-29 14:15:25 +0100783version 2.64
784 Handle DHCP FQDN options with all flag bits zero and
785 --dhcp-client-update set. Thanks to Bernd Krumbroeck for
786 spotting the problem.
787
Simon Kelley12d71ed2012-08-30 15:16:41 +0100788 Finesse the check for /etc/hosts names which conflict with
789 DHCP names. Previously a name/address pair in /etc/hosts
790 which didn't match the name/address of a DHCP lease would
791 generate a warning. Now that only happesn if there is not
792 also a match. This allows multiple addresses for a name in
793 /etc/hosts with one of them assigned via DHCP.
794
Simon Kelley4d0f5b42012-09-05 23:29:30 +0100795 Fix broken vendor-option processing for BOOTP. Thanks to
796 Hans-Joachim Baader for the bug report.
797
Simon Kelleydfb23b32012-09-18 21:44:47 +0100798 Don't report spurious netlink errors, regression in
799 2.63. Thanks to Vladislav Grishenko for the patch.
800
Simon Kelley2b127a12012-09-18 21:51:22 +0100801 Flag DHCP or DHCPv6 in starup logging. Thanks to
802 Vladislav Grishenko for the patch.
803
Simon Kelley295a54e2012-12-01 21:02:15 +0000804 Add SetServersEx method in DBus interface. Thanks to Dan
Simon Kelleyfaafb3f2012-09-20 14:17:39 +0100805 Williams for the patch.
806
Simon Kelley295a54e2012-12-01 21:02:15 +0000807 Add SetDomainServers method in DBus interface. Thanks to
808 Roy Marples for the patch.
809
Simon Kelley289a2532012-09-20 15:29:35 +0100810 Fix build with later Lua libraries. Thansk to Cristian
811 Rodriguez for the patch.
Simon Kelley2e34ac12012-08-29 14:15:25 +0100812
Simon Kelley1d860412012-09-20 20:48:04 +0100813 Add --max-cache-ttl option. Thanks to Dennis Kaarsemaker
814 for the patch.
815
Simon Kelleye4807d82012-09-27 21:52:26 +0100816 Fix breakage of --host-record parsing, resulting in
817 infinte loop at startup. Regression in 2.63. Thanks to
818 Haim Gelfenbeyn for spotting this.
819
Simon Kelley20223102012-10-15 10:41:17 +0100820 Set SO_REUSEADDRESS and SO_V6ONLY options on the DHCPv6
821 socket, this allows multiple instances of dnsmasq on a
822 single machine, in the same way as for DHCPv4. Thanks to
823 Gene Czarcinski and Vladislav Grishenko for work on this.
824
Simon Kelleybe6cfb42012-10-16 20:38:31 +0100825 Fix DHCPv6 to do access control correctly when it's
826 configured with --listen-address. Thanks to
827 Gene Czarcinski for sorting this out.
828
Simon Kelley819ff4d2012-10-21 18:25:12 +0100829 Add a "wildcard" dhcp-range which works for any IPv6
830 subnet, --dhcp-range=::,static Useful for Stateless
831 DHCPv6. Thanks to Vladislav Grishenko for the patch.
832
Simon Kelleyd1a59752012-11-05 16:50:30 +0000833 Don't include lease-time in DHCPACK replies to DHCPINFORM
834 queries, since RFC-2131 says we shouldn't. Thanks to
835 Wouter Ibens for pointing this out.
Simon Kelley8e4b8792012-11-14 14:12:56 +0000836
837 Makefile tweak to do dependency checking on header files.
838 Thanks to Johan Peeters for the patch.
Simon Kelleyd89fb4e2012-12-01 21:21:13 +0000839
840 Check interface for outgoing unsolicited router
841 advertisements, rather than relying on interface address
842 configuration. Thanks to Gene Czarinski for the patch.
Simon Kelley29d28dd2012-12-03 14:05:59 +0000843
844 Handle better attempts to transmit on interfaces which are
845 still doing DAD, and specifically do not just transmit
846 without setting source address and interface, since this
847 can cause very puzzling effects when a router
848 advertisement goes astray. Thanks again to Gene Czarinski.
849
850 Get RA timers right when there is more than one
851 dhcp-range on a subnet.
Simon Kelley289a2532012-09-20 15:29:35 +0100852
Simon Kelleyd1a59752012-11-05 16:50:30 +0000853
Simon Kelley078a6302012-06-07 13:56:23 +0100854version 2.63
855 Do duplicate dhcp-host address check in --test mode.
856
Simon Kelley8b3ae2f2012-06-13 13:43:49 +0100857 Check that tftp-root directories are accessible before
858 start-up. Thanks to Daniel Veillard for the initial patch.
859
860 Allow more than one --tfp-root flag. The per-interface
861 stuff is pointless without that.
862
Simon Kelley54dd3932012-06-20 11:23:38 +0100863 Add --bind-dynamic. A hybrid mode between the default and
864 --bind-interfaces which copes with dynamically created
865 interfaces.
Simon Kelley6b617c02012-06-29 21:15:42 +0100866
867 A couple of fixes to the build system for Android. Thanks
868 to Metin Kaya for the patches.
Simon Kelley54dd3932012-06-20 11:23:38 +0100869
Simon Kelley8bc4cec2012-07-03 21:04:11 +0100870 Remove the interface:<interface> argument in --dhcp-range, and
871 the interface argument to --enable-tftp. These were a
872 still-born attempt to allow automatic isolated
873 configuration by libvirt, but have never (to my knowledge)
874 been used, had very strange semantics, and have been
875 superceded by other mechanisms.
876
Simon Kelleyc4a7f902012-07-12 20:52:12 +0100877 Fixed bug logging filenames when duplicate dhcp-host
878 addresses are found. Thanks to John Hanks for the patch.
879
Simon Kelley611ebc52012-07-16 16:23:46 +0100880 Fix regression in 2.61 which broke caching of CNAME
881 chains. Thanks to Atul Gupta for the bug report.
882
Simon Kelleyb2714462012-07-17 12:09:26 +0100883 Allow the target of a --cname flag to be another --cname.
Simon Kelley611ebc52012-07-16 16:23:46 +0100884
Simon Kelley42243212012-07-20 15:19:18 +0100885 Teach DHCPv6 about the RFC 4242 information-refresh-time
886 option, and add parsing if the minutes, hours and days
887 format for options. Thanks to Francois-Xavier Le Bail for
888 the suggestion.
889
890 Allow "w" (for week) as multiplier in lease times, as well
891 as seconds, minutes, hours and days. Álvaro Gámez Machado
892 spotted the ommission.
Simon Kelleyc4c04882012-08-06 20:09:15 +0100893
894 Update French translation. Thanks to Gildas Le Nadan.
Simon Kelley42243212012-07-20 15:19:18 +0100895
Simon Kelleyad094272012-08-10 17:10:54 +0100896 Allow a DBus service name to be given with --enable-dbus
897 which overrides the default,
898 uk.org.thekelleys.dnsmasq. Thanks to Mathieu
899 Trudel-Lapierre for the patch.
900
Simon Kelleyfd05f122012-08-12 17:48:50 +0100901 Set the "prefix on-link" bit in Router
902 Advertisements. Thanks to Gui Iribarren for the patch.
903
Simon Kelley078a6302012-06-07 13:56:23 +0100904
Simon Kelley8358e0f2012-04-29 21:53:09 +0100905version 2.62
906 Update German translation. Thanks to Conrad Kostecki.
907
Simon Kelleyf632e562012-05-12 15:05:34 +0100908 Cope with router-solict packets wich don't have a valid
909 source address. Thanks to Vladislav Grishenko for the patch.
910
Simon Kelley919dd7c2012-05-12 15:23:09 +0100911 Fixed bug which caused missing periodic router
912 advertisements with some configurations. Thanks to
913 Vladislav Grishenko for the patch.
914
Simon Kelleyc64b7f62012-05-18 10:19:59 +0100915 Fixed bug which broke DHCPv6/RA with prefix lengths
916 which are not divisible by 8. Thanks to Andre Coetzee
917 for spotting this.
918
Simon Kelley18c63ef2012-05-21 14:34:15 +0100919 Fix non-response to router-solicitations when
920 router-advertisement configured, but DHCPv6 not
921 configured. Thanks to Marien Zwart for the patch.
922
Simon Kelley9f7f3b12012-05-28 21:39:57 +0100923 Add --dns-rr, to allow arbitrary DNS resource records.
924
Simon Kelley5ae34bf2012-06-04 21:14:03 +0100925 Fixed bug which broke RA scheduling when an interface had
926 two addresses in the same network. Thanks to Jim Bos for
927 his help nailing this.
928
Simon Kelleyeabc6dd2012-03-07 20:28:20 +0000929version 2.61
930 Re-write interface discovery code on *BSD to use
931 getifaddrs. This is more portable, more straightforward,
932 and allows us to find the prefix length for IPv6
933 addresses.
934
Simon Kelley01d1b8d2012-03-28 21:37:25 +0100935 Add ra-names, ra-stateless and slaac keywords for DHCPv6.
936 Dnsmasq can now synthesise AAAA records for dual-stack
937 hosts which get IPv6 addresses via SLAAC. It is also now
938 possible to use SLAAC and stateless DHCPv6, and to
939 tell clients to use SLAAC addresses as well as DHCP ones.
940 Thanks to Dave Taht for help with this.
Simon Kelley7023e382012-03-09 12:05:49 +0000941
Simon Kelley8b372702012-03-09 17:45:10 +0000942 Add --dhcp-duid to allow DUID-EN uids to be used.
943
Simon Kelley8643ec72012-03-12 20:04:14 +0000944 Explicity send DHCPv6 replies to the correct port, instead
945 of relying on clients to send requests with the correct
946 source address, since at least one client in the wild gets
Simon Kelley8358e0f2012-04-29 21:53:09 +0100947 this wrong. Thanks to Conrad Kostecki for help tracking
Simon Kelley8643ec72012-03-12 20:04:14 +0000948 this down.
Simon Kelleyeabc6dd2012-03-07 20:28:20 +0000949
Simon Kelley8643ec72012-03-12 20:04:14 +0000950 Send a preference value of 255 in DHCPv6 replies when
951 --dhcp-authoritative is in effect. This tells clients not
952 to wait around for other DHCP servers.
953
954 Better logging of DHCPv6 options.
955
Simon Kelleye759d422012-03-16 13:18:57 +0000956 Add --host-record. Thanks to Rob Zwissler for the
957 suggestion.
958
Simon Kelleya9530962012-03-20 22:07:35 +0000959 Invoke the DHCP script with action "tftp" when a TFTP file
960 transfer completes. The size of the file, address to which
961 it was sent and complete pathname are supplied. Note that
962 version 2.60 introduced some script incompatibilties
963 associated with DHCPv6, and this is a further change. To
964 be safe, scripts should ignore unknown actions, and if
965 not IPv6-aware, should exit if the environment
966 variable DNSMASQ_IAID is set. The use-case for this is
967 to track netboot/install. Suggestion from Shantanu
968 Gadgil.
969
970 Update contrib/port-forward/dnsmasq-portforward to reflect
971 the above.
972
973 Set the environment variable DNSMASQ_LOG_DHCP when running
974 the script id --log-dhcp is in effect, so that script can
Simon Kelley52d4abf2012-03-21 21:39:48 +0000975 taylor their logging verbosity. Suggestion from Malte
976 Forkel.
977
978 Arrange that addresses specified with --listen-address
979 work even if there is no interface carrying the
980 address. This is chiefly useful for IPv4 loopback
981 addresses, where any address in 127.0.0.0/8 is a valid
982 loopback address, but normally only 127.0.0.1 appears on
983 the lo interface. Thanks to Mathieu Trudel-Lapierre for
984 the idea and initial patch.
Simon Kelleya9530962012-03-20 22:07:35 +0000985
Simon Kelley7d2b5c92012-03-23 10:00:02 +0000986 Fix crash, introduced in 2.60, when a DHCPINFORM is
987 received from a network which has no valid dhcp-range.
988 Thanks to Stephane Glondu for the bug report.
989
Simon Kelleyc8257542012-03-28 21:15:41 +0100990 Add a new DHCP lease time keyword, "deprecated" for
991 --dhcp-range. This is only valid for IPv6, and sets the
992 preffered lease time for both DHCP and RA to zero. The
993 effect is that clients can continue to use the address
994 for existing connections, but new connections will use
995 other addresses, if they exist. This makes hitless
996 renumbering at least possible.
997
998 Fix bug in address6_available() which caused DHCPv6 lease
Simon Kelley8358e0f2012-04-29 21:53:09 +0100999 aquisition to fail if more than one dhcp-range in use.
Simon Kelley18f0fb02012-03-31 21:18:55 +01001000
1001 Provide RDNSS and DNSSL data in router advertisements,
1002 using the settings provided for DHCP options
1003 option6:domain-search and option6:dns-server.
Simon Kelley6c559c32012-04-02 20:40:34 +01001004
1005 Tweak logo/favicon.ico to add some transparency. Thanks to
1006 SamLT for work on this.
Simon Kelleyc8257542012-03-28 21:15:41 +01001007
Simon Kelley1023dcb2012-04-09 18:00:08 +01001008 Don't cache data from non-recursive nameservers, since it
1009 may erroneously look like a valid CNAME to a non-exitant
1010 name. Thanks to Ben Winslow for finding this.
Simon Kelley9380ba72012-04-16 14:41:56 +01001011
1012 Call SO_BINDTODEVICE on the DHCP socket(s) when doing DHCP
Simon Kelley8358e0f2012-04-29 21:53:09 +01001013 on exactly one interface and --bind-interfaces is set. This
Simon Kelley9380ba72012-04-16 14:41:56 +01001014 makes the OpenStack use-case of one dnsmasq per virtual
1015 interface work. This is only available on Linux; it's not
1016 supported on other platforms. Thanks to Vishvananda Ishaya
Simon Kelleye46164e2012-04-16 16:39:38 +01001017 and the OpenStack team for the suggestion.
1018
1019 Updated French translation. Thanks to Gildas Le Nadan.
Simon Kelleyd1c759c2012-04-16 17:26:19 +01001020
1021 Give correct from-cache answers to explict CNAME queries.
1022 Thanks to Rob Zwissler for spotting this.
Simon Kelley1023dcb2012-04-09 18:00:08 +01001023
Simon Kelleyfc92ead2012-04-22 21:28:24 +01001024 Add --tftp-lowercase option. Thanks to Oliver Rath for the
Simon Kelley61ce6002012-04-20 21:28:49 +01001025 patch.
Simon Kelleydcffad22012-04-24 15:25:18 +01001026
1027 Ensure that the DBus DhcpLeaseUpdated events are generated
1028 when a lease goes through INIT_REBOOT state, even if the
Simon Kelley8358e0f2012-04-29 21:53:09 +01001029 dhcp-script is not in use. Thanks to Antoaneta-Ecaterina
Simon Kelleydcffad22012-04-24 15:25:18 +01001030 Ene for the patch.
Simon Kelley19d69be2012-04-27 10:14:34 +01001031
1032 Fix failure of TFTP over IPv4 on OpenBSD platform. Thanks
1033 to Brad Smith for spotting this.
Simon Kelley61ce6002012-04-20 21:28:49 +01001034
Simon Kelleyc8257542012-03-28 21:15:41 +01001035
Simon Kelleyc72daea2012-01-05 21:33:27 +00001036version 2.60
1037 Fix compilation problem in Mac OS X Lion. Thanks to Olaf
1038 Flebbe for the patch.
Simon Kelley74c95c22011-10-19 09:33:39 +01001039
Simon Kelleyc72daea2012-01-05 21:33:27 +00001040 Fix DHCP when using --listen-address with an IP address
1041 which is not the primary address of an interface.
1042
1043 Add --dhcp-client-update option.
1044
1045 Add Lua integration. Dnsmasq can now execute a DHCP
1046 lease-change script written in Lua. This needs to be
1047 enabled at compile time by setting HAVE_LUASCRIPT in
1048 src/config.h or running "make COPTS=-DHAVE_LUASCRIPT"
1049 Thanks to Jan-Piet Mens for the idea and proof-of-concept
1050 implementation.
1051
1052 Tidied src/config.h to distinguish between
1053 platform-dependent compile-time options which are selected
1054 automatically, and builder-selectable compile time
1055 options. Document the latter better, and describe how to
1056 set them from the make command line.
1057
1058 Tidied up IPPROTO_IP/SOL_IP (and IPv6 equivalent)
1059 confusion. IPPROTO_IP works everywhere now.
1060
1061 Set TOS on DHCP sockets, this improves things on busy
1062 wireless networks. Thanks to Dave Taht for the patch.
1063
Simon Kelley984d2fd2012-01-06 14:34:32 +00001064 Determine VERSION automatically based on git magic:
1065 release tags or hash values.
Simon Kelleyc72daea2012-01-05 21:33:27 +00001066
Simon Kelleya2761752012-01-18 16:07:21 +00001067 Improve start-up speed when reading large hosts files
1068 containing many distinct addresses.
1069
1070 Fix problem if dnsmasq is started without the stdin,
1071 stdout and stderr file descriptors open. This can manifest
1072 itself as 100% CPU use. Thanks to Chris Moore for finding
1073 this.
1074
Simon Kelley9bbc8872012-02-09 21:33:09 +00001075 Fix shell-scripting bug in bld/pkg-wrapper. Thanks to
1076 Mark Mitchell for the patch.
1077
Simon Kelley751d6f42012-02-10 15:24:51 +00001078 Allow the TFP server or boot server in --pxe-service, to
1079 be a domain name instead of an IP address. This allows for
1080 round-robin to multiple servers, in the same way as
1081 --dhcp-boot. A good suggestion from Cristiano Cumer.
1082
Simon Kelleyfdacfb02012-02-28 15:20:25 +00001083 Support BUILDDIR variable in the Makefile. Allows builds
1084 for multiple archs from the same source tree with eg.
1085 make BUILDDIR=linux (relative to dnsmasq tree)
1086 make BUILDDIR=/tmp/openbsd (absolute path)
Simon Kelleye5ffdb92012-02-13 14:19:25 +00001087 If BUILDDIR is not set, compilation happens in the src
Simon Kelleyb36ae192012-02-13 12:54:34 +00001088 directory, as before. Suggestion from Mark Mitchell.
1089
Simon Kelleyfdacfb02012-02-28 15:20:25 +00001090 Support DHCPv6. Support is there for the sort of things
1091 the existing v4 server does, including tags, options,
1092 static addresses and relay support. Missing is prefix
1093 delegation, which is probably not required in the dnsmasq
1094 niche, and an easy way to accept prefix delegations from
1095 an upstream DHCPv6 server, which is. Future plans include
1096 support for DHCPv6 router option and MAC address option
1097 (to make selecting clients by MAC address work like IPv4).
1098 These will be added as the standards mature.
1099 This code has been tested, but this is the first release,
1100 so don't bet the farm on it just yet. Many thanks to all
1101 testers who have got it this far.
Simon Kelley1adadf52012-02-13 22:15:58 +00001102
Simon Kelleyac8540c2012-02-26 20:57:31 +00001103 Support IPv6 router advertisements. This is a
1104 simple-minded implementation, aimed at providing the
1105 vestigial RA needed to go alongside IPv6. Is picks up
1106 configuration from the DHCPv6 conf, and should just need
1107 enabling with --enable-ra.
1108
Simon Kelley552af8b2012-02-29 20:10:31 +00001109 Fix long-standing wrinkle with --localise-queries that
1110 could result in wrong answers when DNS packets arrive
1111 via an interface other than the expected one. Thanks to
1112 Lorenzo Milesi and John Hanks for spotting this one.
Simon Kelley71ee7ee2012-03-03 18:06:49 +00001113
1114 Update French translation. Thanks to Gildas Le Nadan.
Simon Kelley552af8b2012-02-29 20:10:31 +00001115
Simon Kelleydf66e342012-03-04 20:04:22 +00001116 Update Polish translation. Thanks to Jan Psota.
1117
1118
Simon Kelleyc72daea2012-01-05 21:33:27 +00001119version 2.59
1120 Fix regression in 2.58 which caused failure to start up
1121 with some combinations of dnsmasq config and IPv6 kernel
1122 network config. Thanks to Brielle Bruns for the bug
1123 report.
1124
1125 Improve dnsmasq's behaviour when network interfaces are
1126 still doing duplicate address detection (DAD). Previously,
1127 dnsmasq would wait up to 20 seconds at start-up for the
1128 DAD state to terminate. This is broken for bridge
1129 interfaces on recent Linux kernels, which don't start DAD
1130 until the bridge comes up, and so can take arbitrary
1131 time. The new behaviour lets dnsmasq poll for an arbitrary
1132 time whilst providing service on other interfaces. Thanks
1133 to Stephen Hemminger for pointing out the problem.
Simon Kelley74c95c22011-10-19 09:33:39 +01001134
1135
Simon Kelley7de060b2011-08-26 17:24:52 +01001136version 2.58
1137 Provide a definition of the SA_SIZE macro where it's
1138 missing. Fixes build failure on openBSD.
1139
1140 Don't include a zero terminator at the end of messages
1141 sent to /dev/log when /dev/log is a datagram socket.
1142 Thanks to Didier Rabound for spotting the problem.
1143
1144 Add --dhcp-sequential-ip flag, to force allocation of IP
1145 addresses in ascending order. Note that the default
1146 pseudo-random mode is in general better but some
1147 server-deployment applications need this.
1148
1149 Fix problem where a server-id of 0.0.0.0 is sent to a
1150 client when a dhcp-relay is in use if a client renews a
1151 lease after dnsmasq restart and before any clients on the
1152 subnet get a new lease. Thanks to Mike Ruiz for assistance
1153 in chasing this one down.
1154
1155 Don't return NXDOMAIN to an AAAA query if we have CNAME
1156 which points to an A record only: NODATA is the correct
1157 reply in this case. Thanks to Tom Fernandes for spotting
1158 the problem.
1159
1160 Relax the need to supply a netmask in --dhcp-range for
1161 networks which use a DHCP relay. Whilst this is still
1162 desireable, in the absence of a netmask dnsmasq will use
1163 a default based on the class (A, B, or C) of the address.
1164 This should at least remove a cause of mysterious failure
1165 for people using RFC1918 addresses and relays.
1166
1167 Add support for Linux conntrack connection marking. If
1168 enabled with --conntrack, the connection mark for incoming
1169 DNS queries will be copied to the outgoing connections
1170 used to answer those queries. This allows clever firewall
1171 and accounting stuff. Only available if dnsmasq is
1172 compiled with HAVE_CONNTRACK and adds a dependency on
1173 libnetfilter-conntrack. Thanks to Ed Wildgoose for the
1174 initial idea, testing and sponsorship of this function.
1175
1176 Provide a sane error message when someone attempts to
1177 match a tag in --dhcp-host.
1178
1179 Tweak the behaviour of --domain-needed, to avoid problems
1180 with recursive nameservers downstream of dnsmasq. The new
1181 behaviour only stops A and AAAA queries, and returns
1182 NODATA rather than NXDOMAIN replies.
1183
1184 Efficiency fix for very large DHCP configurations, thanks
1185 to James Gartrell and Mike Ruiz for help with this.
1186
1187 Allow the TFTP-server address in --dhcp-boot to be a
1188 domain-name which is looked up in /etc/hosts. This can
1189 give multiple IP addresses which are used round-robin,
1190 thus doing TFTP server load-balancing. Thanks to Sushil
1191 Agrawal for the patch.
1192
1193 When two tagged dhcp-options for a particular option
1194 number are both valid, use the one which is valid without
1195 a tag from the dhcp-range. Allows overriding of the value
1196 of a DHCP option for a particular host as well as
1197 per-network values. So
1198 --dhcp-range=set:interface1,......
1199 --dhcp-host=set:myhost,.....
1200 --dhcp-option=tag:interface1,option:nis-domain,"domain1"
1201 --dhcp-option=tag:myhost,option:nis-domain,"domain2"
1202 will set the NIS-domain to domain1 for hosts in the range, but
1203 override that to domain2 for a particular host.
1204
1205 Fix bug which resulted in truncated files and timeouts for
1206 some TFTP transfers. The bug only occurs with netascii
1207 transfers and needs an unfortunate relationship between
1208 file size, blocksize and the number of newlines in the
1209 last block before it manifests itself. Many thanks to
1210 Alkis Georgopoulos for spotting the problem and providing
1211 a comprehensive test-case.
1212
1213 Fix regression in TFTP server on *BSD platforms introduced
1214 in version 2.56, due to confusion with sockaddr
Simon Kelleyde604c12012-10-19 09:50:01 +01001215 length. Many thanks to Loic Pefferkorn for finding this.
Simon Kelley7de060b2011-08-26 17:24:52 +01001216
1217 Support scope-ids in IPv6 addresses of nameservers from
1218 /etc/resolv.conf and in --server options. Eg
1219 nameserver fe80::202:a412:4512:7bbf%eth0 or
1220 server=fe80::202:a412:4512:7bbf%eth0. Thanks to
1221 Michael Stapelberg for the suggestion.
1222
1223 Update Polish translation, thanks to Jan Psota.
1224
1225 Update French translation. Thanks to Gildas Le Nadan.
1226
1227
Simon Kelley572b41e2011-02-18 18:11:18 +00001228version 2.57
1229 Add patches to allow build under Android.
1230
1231 Provide our own header for the DNS protocol, rather than
1232 relying on arpa/nameser.h. This has proved more or less
1233 defective over the years and the final straw is that it's
1234 effectively empty on Android.
1235
1236 Fix regression in 2.56 which caused hex constants in
1237 configuration to be rejected if they contain the '*'
1238 wildcard.
1239
1240 Correct wrong casts of arguments to ctype.h functions,
1241 isdigit(), isxdigit() etc. Thanks to Matthias Andree for
1242 spotting this.
1243
1244 Allow build with IDN support independently from i18n.
1245 IDN support continues to be included automatically
1246 when i18n is included.
1247 'make COPTS=-DHAVE_IDN' is the magic incantation.
1248
1249 Modify check on extraneous command line junk (added in
1250 2.56) so that it doesn't complain about extra _empty_
1251 arguments. Otherwise this breaks libvirt.
1252
1253
Simon Kelley28866e92011-02-14 20:19:14 +00001254version 2.56
1255 Add a patch to allow dnsmasq to get interface names right in a
1256 Solaris zone. Thanks to Dj Padzensky for this.
1257
1258 Improve data-type parsing heuristics so that
1259 --dhcp-option=option:domain-search,.
1260 treats the value as a string and not an IP address.
1261 Thanks to Clemens Fischer for spotting that.
1262
1263 Add IPv6 support to the TFTP server. Many thanks to Jan
1264 'RedBully' Seiffert for the patches.
1265
1266 Log DNS queries at level LOG_INFO, rather then
1267 LOG_DEBUG. This makes things consistent with DHCP
1268 logging. Thanks to Adam Pribyl for spotting the problem.
1269
1270 Ensure that dnsmasq terminates cleanly when using
1271 --syslog-async even if it cannot make a connection to the
1272 syslogd.
1273
1274 Add --add-mac option. This is to support currently
1275 experimental DNS filtering facilities. Thanks to Benjamin
1276 Petrin for the orignal patch.
1277
1278 Fix bug which meant that tags were ignored in dhcp-range
1279 configuration specifying PXE-proxy service. Thanks to
1280 Cristiano Cumer for spotting this.
1281
1282 Raise an error if there is extra junk, not part of an
1283 option, on the command line.
1284
1285 Flag a couple of log messages in cache.c as coming from
1286 the DHCP subsystem. Thanks to Olaf Westrik for the patch.
1287
1288 Omit timestamps from logs when a) logging to stderr and
1289 b) --keep-in-forground is set. The logging facility on the
1290 other end of stderr can be assumned to supply them. Thanks
1291 to John Hallam for the patch.
1292
1293 Don't complain about strings longer than 255 characters in
1294 --txt-record, just split the long strings into 255
1295 character chunks instead.
1296
1297 Fix crash on double-free. This bug can only happen when
1298 dhcp-script is in use and then only in rare circumstances
1299 triggered by high DHCP transaction rate and a slow
1300 script. Thanks to Ferenc Wagner for finding the problem.
1301
1302 Only log that a file has been sent by TFTP after the
1303 transfer has completed succesfully.
1304
1305 A good suggestion from Ferenc Wagner: extend
1306 the --domain option to allow this sort of thing:
1307 --domain=thekelleys.org.uk,192.168.0.0/24,local
1308 which automatically creates
1309 --local=/thekelleys.org.uk/
1310 --local=/0.168.192.in-addr.arpa/
1311
1312 Tighten up syntax checking of hex contants in the config
1313 file. Thanks to Fred Damen for spotting this.
1314
1315 Add dnsmasq logo/icon, contributed by Justin Swift. Many
1316 thanks for that.
1317
1318 Never cache DNS replies which have the 'cd' bit set, or
1319 which result from queries forwarded with the 'cd' bit
1320 set. The 'cd' bit instructs a DNSSEC validating server
1321 upstream to ignore signature failures and return replies
1322 anyway. Without this change it's possible to pollute the
1323 dnsmasq cache with bad data by making a query with the
1324 'cd' bit set and subsequent queries would return this data
1325 without its being marked as suspect. Thanks to Anders
1326 Kaseorg for pointing out this problem.
1327
1328 Add --proxy-dnssec flag, for compliance with RFC
1329 4035. Dnsmasq will now clear the 'ad' bit in answers returned
1330 from upstream validating nameservers unless this option is
1331 set.
1332
1333 Allow a filename of "-" for --conf-file to read
1334 stdin. Suggestion from Timothy Redaelli.
1335
1336 Rotate the order of SRV records in replies, to provide
1337 round-robin load balancing when all the priorities are
1338 equal. Thanks to Peter McKinney for the suggestion.
1339
1340 Edit
1341 contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist
1342 so that it doesn't log all queries to a file by
1343 default. Thanks again to Peter McKinney.
1344
1345 By default, setting an IPv4 address for a domain but not
1346 an IPv6 address causes dnsmasq to return
1347 an NODATA reply for IPv6 (or vice-versa). So
1348 --address=/google.com/1.2.3.4 stops IPv6 queries for
1349 *google.com from being forwarded. Make it possible to
1350 override this behaviour by defining the sematics if the
1351 same domain appears in both --server and --address.
1352 In that case, the --address has priority for the address
1353 family in which is appears, but the --server has priority
1354 of the address family which doesn't appear in --adddress
1355 So:
1356 --address=/google.com/1.2.3.4
1357 --server=/google.com/#
1358 will return 1.2.3.4 for IPv4 queries for *.google.com but
1359 forward IPv6 queries to the normal upstream nameserver.
1360 Similarly when setting an IPv6 address
1361 only this will allow forwarding of IPv4 queries. Thanks to
1362 William for pointing out the need for this.
1363
1364 Allow more than one --dhcp-optsfile and --dhcp-hostsfile
1365 and make them understand directories as arguments in the
1366 same way as --addn-hosts. Suggestion from John Hanks.
1367
1368 Ignore rebinding requests for leases we don't know
1369 about. Rebind is broadcast, so we might get to overhear a
1370 request meant for another DHCP server. NAKing this is
1371 wrong. Thanks to Brad D'Hondt for assistance with this.
1372
Simon Kelley572b41e2011-02-18 18:11:18 +00001373 Fix cosmetic bug which produced strange output when
1374 dumping cache statistics with some configurations. Thanks
1375 to Fedor Kozhevnikov for spotting this.
Simon Kelley28866e92011-02-14 20:19:14 +00001376
1377
Simon Kelleyc52e1892010-06-07 22:01:39 +01001378version 2.55
Simon Kelley28866e92011-02-14 20:19:14 +00001379 Fix crash when /etc/ethers is in use. Thanks to
1380 Gianluigi Tiesi for finding this.
Simon Kelleyc52e1892010-06-07 22:01:39 +01001381
Simon Kelley28866e92011-02-14 20:19:14 +00001382 Fix crash in netlink_multicast(). Thanks to Arno Wald for
1383 finding this one.
Simon Kelleyc52e1892010-06-07 22:01:39 +01001384
Simon Kelley28866e92011-02-14 20:19:14 +00001385 Allow the empty domain "." in dhcp domain-search (119)
1386 options.
Simon Kelleyc52e1892010-06-07 22:01:39 +01001387
1388
1389version 2.54
Simon Kelley28866e92011-02-14 20:19:14 +00001390 There is no version 2.54 to avoid confusion with 2.53,
1391 which incorrectly identifies itself as 2.54.
Simon Kelleyc52e1892010-06-07 22:01:39 +01001392
1393
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001394version 2.53
1395 Fix failure to compile on Debian/kFreeBSD. Thanks to
1396 Axel Beckert and Petr Salinger.
1397
1398 Fix code to avoid scary strict-aliasing warnings
1399 generated by gcc 4.4.
1400
1401 Added FAQ entry warning about DHCP failures with Vista
1402 when firewalls block 255.255.255.255.
1403
1404 Fixed bug which caused bad things to happen if a
1405 resolv.conf file which exists is subsequently removed.
1406 Thanks to Nikolai Saoukh for the patch.
1407
1408 Rationalised the DHCP tag system. Every configuration item
1409 which can set a tag does so by adding "set:<tag>" and
1410 every configuration item which is conditional on a tag is
1411 made so by "tag:<tag>". The NOT operator changes to '!',
1412 which is a bit more intuitive too. Dhcp-host directives
1413 can set more than one tag now. The old '#' NOT,
1414 "net:" prefix and no-prefixes are still honoured, so
1415 no existing config file needs to be changed, but
1416 the documentation and new-style config files should be
1417 much less confusing.
1418
1419 Added --tag-if to allow boolean operations on tags.
1420 This allows complicated logic to be clearer and more
1421 general. A great suggestion from Richard Voigt.
1422
1423 Add broadcast/unicast information to DHCP logging.
1424
1425 Allow --dhcp-broadcast to be unconditional.
1426
1427 Fixed incorrect behaviour with NOT <tag> conditionals in
1428 dhcp-options. Thanks to Max Turkewitz for assistance
1429 finding this.
1430
1431 If we send vendor-class encapsulated options based on the
1432 vendor-class supplied by the client, and no explicit
1433 vendor-class option is given, echo back the vendor-class
1434 from the client.
1435
1436 Fix bug which stopped dnsmasq from matching both a
1437 circuitid and a remoteid. Thanks to Ignacio Bravo for
1438 finding this.
1439
1440 Add --dhcp-proxy, which makes it possible to configure
1441 dnsmasq to use a DHCP relay agent as a full proxy, with
1442 all DHCP messages passing through the proxy. This is
1443 useful if the relay adds extra information to the packets
1444 it forwards, but cannot be configured with the RFC 5107
1445 server-override option.
1446
1447 Added interface:<iface name> part to dhcp-range. The
1448 semantics of this are very odd at first sight, but it
1449 allows a single line of the form
1450 dhcp-range=interface:virt0,192.168.0.4,192.168.0.200
1451 to be added to dnsmasq configuration which then supplies
1452 DHCP and DNS services to that interface, without affecting
1453 what services are supplied to other interfaces and
1454 irrespective of the existance or lack of
1455 interface=<interface>
1456 lines elsewhere in the dnsmasq configuration. The idea is
1457 that such a line can be added automatically by libvirt
1458 or equivalent systems, without disturbing any manual
1459 configuration.
1460
1461 Similarly to the above, allow --enable-tftp=<interface>
1462
1463 Allow a TFTP root to be set separately for requests via
1464 different interfaces, --tftp-root=<path>,<interface>
1465
1466 Correctly handle and log clashes between CNAMES and
1467 DNS names being given to DHCP leases. This fixes a bug
1468 which caused nonsense IP addresses to be logged. Thanks to
1469 Sergei Zhirikov for finding and analysing the problem.
1470
1471 Tweak flush_log so as to avoid leaving the log
1472 file in non-blocking mode. O_NONBLOCK is a property of the
1473 file, not the process/descriptor.
1474
1475 Fix contrib/Solaris10/create_package
1476 (/usr/man -> /usr/share/man) Thanks to Vita Batrla.
1477
1478 Fix a problem where, if a client got a lease, then went
1479 to another subnet and got another lease, then moved back,
1480 it couldn't resume the old lease, but would instead get
1481 a new address. Thanks to Leonardo Rodrigues for spotting
1482 this and testing the fix.
1483
1484 Fix weird bug which sometimes omitted certain characters
1485 from the start of quoted strings in dhcp-options. Thanks
1486 to Dayton Turner for spotting the problem.
1487
1488 Add facility to redirect some domains to the standard
1489 upstream servers: this allows something like
1490 --server=/google.com/1.2.3.4 --server=/www.google.com/#
1491 which will send queries for *.google.com to 1.2.3.4,
1492 except *www.google.com which will be forwarded as usual.
1493 Thanks to AJ Weber for prompting this addition.
1494
1495 Improve the hash-algorithm used to generate IP addresses
1496 from MAC addresses during initial DHCP address
1497 allocation. This improves performance when large numbers
1498 of hosts with similar MAC addresses all try and get an IP
1499 address at the same time. Thanks to Paul Smith for his
1500 work on this.
1501
1502 Tweak DHCP code so that --bridge-interface can be used to
1503 select which IP alias of an interface should be used for
1504 DHCP purposes on Linux. If eth0 has an alias eth0:dhcp
1505 then adding --bridge-interface=eth0:dhcp,eth0 will use
1506 the address of eth0:dhcp to determine the correct subnet
1507 for DHCP address allocation. Thanks to Pawel Golaszewski
1508 for prompting this and Eric Cooper for further testing.
1509
1510 Add --dhcp-generate-names. Suggestion by Ferenc Wagner.
1511
1512 Tweak DNS server selection algorithm when there is more
1513 than one server available for a domain, eg.
1514 --server=/mydomain/1.1.1.1
1515 --server=/mydomain/2.2.2.2
1516 Thanks to Alberto Cuesta-Canada for spotting a weakness
1517 here.
1518
1519 Add --max-ttl. Thanks to Fredrik Ringertz for the patch.
1520
1521 Allow --log-facility=- to force all logging to
1522 stderr. Suggestion from Clemens Fischer.
1523
1524 Fix regression which caused configuration like
1525 --address=/.domain.com/1.2.3.4 to be rejected. The dot to the
1526 left of the domain has been implied and not required for a
1527 long time, but it should be accepted for backward
1528 compatibility. Thanks to Andrew Burcin for spotting this.
1529
1530 Add --rebind-domain-ok and --rebind-localhost-ok.
1531 Suggestion from Clemens Fischer.
1532
1533 Log replies to queries of type TXT, when --log-queries
1534 is set.
1535
1536 Fix compiler warnings when compiled with -DNO_DHCP. Thanks
1537 to Shantanu Gadgil for the patch.
1538
1539 Updated French translation. Thanks to Gildas Le Nadan.
1540
1541 Updated Polish translation. Thanks to Jan Psota.
1542
1543 Updated German translation. Thanks to Matthias Andree.
1544
1545 Added contrib/static-arp, thanks to Darren Hoo.
1546
1547 Fix corruption of the domain when a name from /etc/hosts
1548 overrides one supplied by a DHCP client. Thanks to Fedor
1549 Kozhevnikov for spotting the problem.
1550
1551 Updated Spanish translation. Thanks to Chris Chatham.
1552
1553
Simon Kelley316e2732010-01-22 20:16:09 +00001554version 2.52
1555 Work around a Linux kernel bug which insists that the
1556 length of the option passed to setsockopt must be at least
1557 sizeof(int) bytes, even if we're calling SO_BINDTODEVICE
1558 and the device name is "lo". Note that this is fixed
1559 in kernel 2.6.31, but the workaround is harmless and
1560 allows earlier kernels to be used. Also fix dnsmasq
1561 bug which reported the wrong address when this failed.
1562 Thanks to Fedor for finding this.
1563
1564 The API for IPv6 PKTINFO changed around Linux kernel
1565 2.6.14. Workaround the case where dnsmasq is compiled
1566 against newer headers, but then run on an old kernel:
1567 necessary for some *WRT distros.
1568
1569 Re-read the set of network interfaces when re-loading
1570 /etc/resolv.conf if --bind-interfaces is not set. This
1571 handles the case that loopback interfaces do not exist
1572 when dnsmasq is first started.
1573
1574 Tweak the PXE code to support port 4011. This should
1575 reduce broadcasts and make things more reliable when other
1576 servers are around. It also improves inter-operability
1577 with certain clients.
1578
1579 Make a pxe-service configuration with no filename or boot
1580 service type legal: this does a local boot. eg.
1581 pxe-service=x86PC, "Local boot"
1582
1583 Be more conservative in detecting "A for A"
1584 queries. Dnsmasq checks if the name in a type=A query looks
1585 like a dotted-quad IP address and answers the query itself
1586 if so, rather than forwarding it. Previously dnsmasq
1587 relied in the library function inet_addr() to convert
1588 addresses, and that will accept some things which are
1589 confusing in this context, like 1.2.3 or even just
1590 1234. Now we only do A for A processing for four decimal
1591 numbers delimited by dots.
1592
1593 A couple of tweaks to fix compilation on Solaris. Thanks
1594 to Joel Macklow for help with this.
1595
1596 Another Solaris compilation tweak, needed for Solaris
1597 2009.06. Thanks to Lee Essen for that.
1598
1599 Added extract packaging stuff from Lee Essen to
1600 contrib/Solaris10.
1601
1602 Increased the default limit on number of leases to 1000
1603 (from 150). This is mainly a defence against DoS attacks,
1604 and for the average "one for two class C networks"
1605 installation, IP address exhaustion does that just as
1606 well. Making the limit greater than the number of IP
1607 addresses available in such an installation removes a
1608 surprise which otherwise can catch people out.
1609
1610 Removed extraneous trailing space in the value of the
1611 DNSMASQ_TIME_REMAINING DNSMASQ_LEASE_LENGTH and
1612 DNSMASQ_LEASE_EXPIRES environment variables. Thanks to
1613 Gildas Le Nadan for spotting this.
1614
1615 Provide the network-id tags for a DHCP transaction to
1616 the lease-change script in the environment variable
1617 DNSMASQ_TAGS. A good suggestion from Gildas Le Nadan.
1618
1619 Add support for RFC3925 "Vendor-Identifying Vendor
1620 Options". The syntax looks like this:
1621 --dhcp-option=vi-encap:<enterprise number>, .........
1622
1623 Add support to --dhcp-match to allow matching against
1624 RFC3925 "Vendor-Identifying Vendor Classes". The syntax
1625 looks like this:
1626 --dhcp-match=tag,vi-encap<enterprise number>, <value>
1627
1628 Add some application specific code to assist in
1629 implementing the Broadband forum TR069 CPE-WAN
1630 specification. The details are in contrib/CPE-WAN/README
1631
1632 Increase the default DNS packet size limit to 4096, as
1633 recommended by RFC5625 section 4.4.3. This can be
1634 reconfigured using --edns-packet-max if needed. Thanks to
1635 Francis Dupont for pointing this out.
1636
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001637 Rewrite query-ids even for TSIG signed packets, since
Simon Kelley316e2732010-01-22 20:16:09 +00001638 this is allowed by RFC5625 section 4.5.
1639
1640 Use getopt_long by default on OS X. It has been supported
1641 since version 10.3.0. Thanks to Arek Dreyer for spotting
1642 this.
1643
1644 Added up-to-date startup configuration for MacOSX/launchd
1645 in contrib/MacOSX-launchd. Thanks to Arek Dreyer for
1646 providing this.
1647
1648 Fix link error when including Dbus but excluding DHCP.
1649 Thanks to Oschtan for the bug report.
1650
1651 Updated French translation. Thanks to Gildas Le Nadan.
1652
1653 Updated Polish translation. Thanks to Jan Psota.
1654
1655 Updated Spanish translation. Thanks to Chris Chatham.
1656
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001657 Fixed confusion about domains, when looking up DHCP hosts
1658 in /etc/hosts. This could cause spurious "Ignoring
1659 domain..." messages. Thanks to Fedor Kozhevnikov for
1660 finding and analysing the problem.
Simon Kelley316e2732010-01-22 20:16:09 +00001661
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001662
Simon Kelley1f15b812009-10-13 17:49:32 +01001663version 2.51
1664 Add support for internationalised DNS. Non-ASCII characters
1665 in domain names found in /etc/hosts, /etc/ethers and
1666 /etc/dnsmasq.conf will be correctly handled by translation to
1667 punycode, as specified in RFC3490. This function is only
1668 available if dnsmasq is compiled with internationalisation
1669 support, and adds a dependency on GNU libidn. Without i18n
1670 support, dnsmasq continues to be compilable with just
1671 standard tools. Thanks to Yves Dorfsman for the
1672 suggestion.
1673
1674 Add two more environment variables for lease-change scripts:
1675 First, DNSMASQ_SUPPLIED_HOSTNAME; this is set to the hostname
1676 supplied by a client, even if the actual hostname used is
1677 over-ridden by dhcp-host or dhcp-ignore-names directives.
1678 Also DNSMASQ_RELAY_ADDRESS which gives the address of
1679 a DHCP relay, if used.
1680 Suggestions from Michael Rack.
1681
1682 Fix regression which broke echo of relay-agent
1683 options. Thanks to Michael Rack for spotting this.
1684
1685 Don't treat option 67 as being interchangeable with
1686 dhcp-boot parameters if it's specified as
1687 dhcp-option-force.
1688
1689 Make the code to call scripts on lease-change compile-time
1690 optional. It can be switched off by editing src/config.h
1691 or building with "make COPTS=-DNO_SCRIPT".
1692
1693 Make the TFTP server cope with filenames from Windows/DOS
1694 which use '\' as pathname separator. Thanks to Ralf for
1695 the patch.
1696
1697 Updated Polish translation. Thanks to Jan Psota.
1698
1699 Warn if an IP address is duplicated in /etc/ethers. Thanks
1700 to Felix Schwarz for pointing this out.
1701
1702 Teach --conf-dir to take an option list of file suffices
1703 which will be ignored when scanning the directory. Useful
1704 for backup files etc. Thanks to Helmut Hullen for the
1705 suggestion.
1706
1707 Add new DHCP option named tftpserver-address, which
1708 corresponds to the third argument of dhcp-boot. This
1709 allows the complete functionality of dhcp-boot to be
1710 replicated with dhcp-option. Useful when using
1711 dhcp-optsfile.
1712
1713 Test which upstream nameserver to use every 10 seconds
1714 or 50 queries and not just when a query times out and
1715 is retried. This should improve performance when there
1716 is a slow nameserver in the list. Thanks to Joe for the
1717 suggestion.
1718
1719 Don't do any PXE processing, even for clients with the
1720 correct vendorclass, unless at least one pxe-prompt or
1721 pxe-service option is given. This stops dnsmasq
1722 interfering with proxy PXE subsystems when it is just
1723 the DHCP server. Thanks to Spencer Clark for spotting this.
1724
1725 Limit the blocksize used for TFTP transfers to a value
1726 which avoids packet fragmentation, based on the MTU of the
1727 local interface. Many netboot ROMs can't cope with
1728 fragmented packets.
1729
1730 Honour dhcp-ignore configuration for PXE and proxy-PXE
1731 requests. Thanks to Niels Basjes for the bug report.
1732
1733 Updated French translation. Thanks to Gildas Le Nadan.
1734
1735
Simon Kelley77e94da2009-08-31 17:32:17 +01001736version 2.50
Simon Kelley1f15b812009-10-13 17:49:32 +01001737 Fix security problem which allowed any host permitted to
Simon Kelley77e94da2009-08-31 17:32:17 +01001738 do TFTP to possibly compromise dnsmasq by remote buffer
1739 overflow when TFTP enabled. Thanks to Core Security
1740 Technologies and Iván Arce, Pablo Hernán Jorge, Alejandro
1741 Pablo Rodriguez, Martín Coco, Alberto Soliño Testa and
1742 Pablo Annetta. This problem has Bugtraq id: 36121
1743 and CVE: 2009-2957
1744
1745 Fix a problem which allowed a malicious TFTP client to
1746 crash dnsmasq. Thanks to Steve Grubb at Red Hat for
1747 spotting this. This problem has Bugtraq id: 36120 and
1748 CVE: 2009-2958
1749
1750
Simon Kelley03a97b62009-06-10 20:55:49 +01001751version 2.49
1752 Fix regression in 2.48 which disables the lease-change
1753 script. Thanks to Jose Luis Duran for spotting this.
1754
1755 Log TFTP "file not found" errors. These were not logged,
1756 since a normal PXELinux boot generates many of them, but
1757 the lack of the messages seems to be more confusing than
1758 routinely seeing them when there is no real error.
1759
1760 Update Spanish translation. Thanks to Chris Chatham.
1761
1762
Simon Kelley7622fc02009-06-04 20:32:05 +01001763version 2.48
1764 Archived the extensive, backwards, changelog to
1765 CHANGELOG.archive. The current changelog now runs from
1766 version 2.43 and runs conventionally.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001767
Simon Kelley7622fc02009-06-04 20:32:05 +01001768 Fixed bug which broke binding of servers to physical
1769 interfaces when interface names were longer than four
1770 characters. Thanks to MURASE Katsunori for the patch.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001771
Simon Kelley7622fc02009-06-04 20:32:05 +01001772 Fixed netlink code to check that messages come from the
1773 correct source, and not another userspace process. Thanks
1774 to Steve Grubb for the patch.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001775
Simon Kelley7622fc02009-06-04 20:32:05 +01001776 Maintainability drive: removed bug and missing feature
1777 workarounds for some old platforms. Solaris 9, OpenBSD
1778 older than 4.1, Glibc older than 2.2, Linux 2.2.x and
1779 DBus older than 1.1.x are no longer supported.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001780
Simon Kelley7622fc02009-06-04 20:32:05 +01001781 Don't read included configuration files more than once:
1782 allows complex configuration structures without problems.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001783
Simon Kelley7622fc02009-06-04 20:32:05 +01001784 Mark log messages from the various subsystems in dnsmasq:
1785 messages from the DHCP subsystem now have the ident string
1786 "dnsmasq-dhcp" and messages from TFTP have ident
1787 "dnsmasq-tftp". Thanks to Olaf Westrik for the patch.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001788
Simon Kelley7622fc02009-06-04 20:32:05 +01001789 Fix possible infinite DHCP protocol loop when an IP
1790 address nailed to a hostname (not a MAC address) and a
1791 host sometimes provides the name, sometimes not.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001792
Simon Kelley7622fc02009-06-04 20:32:05 +01001793 Allow --addn-hosts to take a directory: all the files
1794 in the directory are read. Thanks to Phil Cornelius for
1795 the suggestion.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001796
Simon Kelley7622fc02009-06-04 20:32:05 +01001797 Support --bridge-interface on all platforms, not just BSD.
Simon Kelley1ab84e22004-01-29 16:48:35 +00001798
Simon Kelley7622fc02009-06-04 20:32:05 +01001799 Added support for advanced PXE functions. It's now
1800 possible to define a prompt and menu options which will
1801 be displayed when a client PXE boots. It's also possible to
1802 hand-off booting to other boot servers. Proxy-DHCP, where
1803 dnsmasq just supplies the PXE information and another DHCP
1804 server does address allocation, is also allowed. See the
1805 --pxe-prompt and --pxe-service keywords. Thanks to
1806 Alkis Georgopoulos for the suggestion and Guilherme Moro
1807 and Michael Brown for assistance.
Simon Kelley1ab84e22004-01-29 16:48:35 +00001808
Simon Kelley7622fc02009-06-04 20:32:05 +01001809 Improvements to DHCP logging. Thanks to Tom Metro for
1810 useful suggestions.
1811
1812 Add ability to build dnsmasq without DHCP support. To do
1813 this, edit src/config.h or build with
1814 "make COPTS=-DNO_DHCP". Thanks to Mahavir Jain for the patch.
1815
1816 Added --test command-line switch - syntax check
1817 configuration files only.
Simon Kelley33820b72004-04-03 21:10:00 +01001818
Simon Kelley7622fc02009-06-04 20:32:05 +01001819 Updated French translation. Thanks to Gildas Le Nadan.
Simon Kelley9009d742008-11-14 20:04:27 +00001820
Simon Kelley73a08a22009-02-05 20:28:08 +00001821
1822version 2.47
1823 Updated French translation. Thanks to Gildas Le Nadan.
1824
1825 Fixed interface enumeration code to work on NetBSD
1826 5.0. Thanks to Roy Marples for the patch.
1827
1828 Updated config.h to use the same location for the lease
1829 file on NetBSD as the other *BSD variants. Also allow
1830 LEASEFILE and CONFFILE symbols to be overriden in CFLAGS.
1831
1832 Handle duplicate address detection on IPv6 more
1833 intelligently. In IPv6, an interface can have an address
1834 which is not usable, because it is still undergoing DAD
1835 (such addresses are marked "tentative"). Attempting to
1836 bind to an address in this state returns an error,
1837 EADDRNOTAVAIL. Previously, on getting such an error,
1838 dnsmasq would silently abandon the address, and never
1839 listen on it. Now, it retries once per second for 20
1840 seconds before generating a fatal error. 20 seconds should
1841 be long enough for any DAD process to complete, but can be
1842 adjusted in src/config.h if necessary. Thanks to Martin
1843 Krafft for the bug report.
1844
1845 Add DBus introspection. Patch from Jeremy Laine.
1846
1847 Update Dbus configuration file. Patch from Colin Walters.
1848 Fix for this bug:
1849 http://bugs.freedesktop.org/show_bug.cgi?id=18961
1850
1851 Support arbitrarily encapsulated DHCP options, suggestion
1852 and initial patch from Samium Gromoff. This is useful for
1853 (eg) gPXE, which expect all its private options to be
1854 encapsulated inside a single option 175. So, eg,
1855
1856 dhcp-option = encap:175, 190, "iscsi-client0"
1857 dhcp-option = encap:175, 191, "iscsi-client0-secret"
1858
1859 will provide iSCSI parameters to gPXE.
1860
1861 Enhance --dhcp-match to allow testing of the contents of a
1862 client-sent option, as well as its presence. This
1863 application in mind for this is RFC 4578
1864 client-architecture specifiers, but it's generally useful.
1865 Joey Korkames suggested the enhancement.
1866
1867 Move from using the IP_XMIT_IF ioctl to IP_BOUND_IF on
1868 OpenSolaris. Thanks to Bastian Machek for the heads-up.
1869
1870 No longer complain about blank lines in
1871 /etc/ethers. Thanks to Jon Nelson for the patch.
1872
1873 Fix binding of servers to physical devices, eg
1874 --server=/domain/1.2.3.4@eth0 which was broken from 2.43
1875 onwards unless --query-port=0 set. Thanks to Peter Naulls
1876 for the bug report.
1877
1878 Reply to DHCPINFORM requests even when the supplied ciaddr
1879 doesn't fall in any dhcp-range. In this case it's not
1880 possible to supply a complete configuration, but
1881 individually-configured options (eg PAC) may be useful.
1882
1883 Allow the source address of an alias to be a range:
1884 --alias=192.168.0.0,10.0.0.0,255.255.255.0 maps the whole
1885 subnet 192.168.0.0->192.168.0.255 to 10.0.0.0->10.0.0.255,
1886 as before.
1887 --alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0
1888 maps only the 192.168.0.10->192.168.0.40 region. Thanks to
1889 Ib Uhrskov for the suggestion.
1890
1891 Don't dynamically allocate DHCP addresses which may break
1892 Windows. Addresses which end in .255 or .0 are broken in
1893 Windows even when using supernetting.
1894 --dhcp-range=192.168.0.1,192.168.1.254,255,255,254.0 means
1895 192.168.0.255 is a valid IP address, but not for Windows.
1896 See Microsoft KB281579. We therefore no longer allocate
1897 these addresses to avoid hard-to-diagnose problems.
1898
1899 Update Polish translation. Thanks to Jan Psota.
1900
1901 Delete the PID-file when dnsmasq shuts down. Note that by
1902 this time, dnsmasq is normally not running as root, so
1903 this will fail if the PID-file is stored in a root-owned
1904 directory; such failure is silently ignored. To take
1905 advantage of this feature, the PID-file must be stored in a
1906 directory owned and write-able by the user running
1907 dnsmasq.
Simon Kelley7622fc02009-06-04 20:32:05 +01001908
1909
1910version 2.46
1911 Allow --bootp-dynamic to take a netid tag, so that it may
1912 be selectively enabled. Thanks to Olaf Westrik for the
1913 suggestion.
1914
1915 Remove ISC-leasefile reading code. This has been
1916 deprecated for a long time, and last time I removed it, it
1917 ended up going back by request of one user. This time,
1918 it's gone for good; otherwise it would need to be
1919 re-worked to support multiple domains (see below).
1920
1921 Support DHCP clients in multiple DNS domains. This is a
1922 long-standing request. Clients are assigned to a domain
1923 based in their IP address.
1924
1925 Add --dhcp-fqdn flag, which changes behaviour if DNS names
1926 assigned to DHCP clients. When this is set, there must be
1927 a domain associated with each client, and only
1928 fully-qualified domain names are added to the DNS. The
1929 advantage is that the only the FQDN needs to be unique,
1930 so that two or more DHCP clients can share a hostname, as
1931 long as they are in different domains.
1932
1933 Set environment variable DNSMASQ_DOMAIN when invoking
1934 lease-change script. This may be useful information to
1935 have now that it's variable.
1936
1937 Tighten up data-checking code for DNS packet
1938 handling. Thanks to Steve Dodd who found certain illegal
1939 packets which could crash dnsmasq. No memory overwrite was
1940 possible, so this is not a security issue beyond the DoS
1941 potential.
1942
1943 Update example config dhcp option 47, the previous
1944 suggestion generated an illegal, zero-length,
1945 option. Thanks to Matthias Andree for finding this.
1946
1947 Rewrite hosts-file reading code to remove the limit of
1948 1024 characters per line. John C Meuser found this.
1949
1950 Create a net-id tag with the name of the interface on
1951 which the DHCP request was received.
1952
1953 Fixed minor memory leak in DBus code, thanks to Jeremy
1954 Laine for the patch.
1955
1956 Emit DBus signals as the DHCP lease database
1957 changes. Thanks to Jeremy Laine for the patch.
1958
1959 Allow for more that one MAC address in a dhcp-host
1960 line. This configuration tells dnsmasq that it's OK to
1961 abandon a DHCP lease of the fixed address to one MAC
1962 address, if another MAC address in the dhcp-host statement
1963 asks for an address. This is useful to give a fixed
1964 address to a host which has two network interfaces
1965 (say, a laptop with wired and wireless interfaces.)
1966 It's very important to ensure that only one interface
1967 at a time is up, since dnsmasq abandons the first lease
1968 and re-uses the address before the leased time has
1969 elapsed. John Gray suggested this.
1970
1971 Tweak the response to a DHCP request packet with a wrong
1972 server-id when --dhcp-authoritative is set; dnsmasq now
1973 returns a DHCPNAK, rather than silently ignoring the
1974 packet. Thanks to Chris Marget for spotting this
1975 improvement.
1976
1977 Add --cname option. This provides a limited alias
1978 function, usable for DHCP names. Thanks to AJ Weber for
1979 suggestions on this.
1980
1981 Updated contrib/webmin with latest version from Neil
1982 Fisher.
1983
1984 Updated Polish translation. Thanks to Jan Psota.
1985
1986 Correct the text names for DHCP options 64 and 65 to be
1987 "nis+-domain" and "nis+-servers".
1988
1989 Updated Spanish translation. Thanks to Chris Chatham.
1990
1991 Force re-reading of /etc/resolv.conf when an "interface
1992 up" event occurs.
1993
1994
1995version 2.45
1996 Fix total DNS failure in release 2.44 unless --min-port
1997 specified. Thanks to Steven Barth and Grant Coady for
1998 bugreport. Also reject out-of-range port spec, which could
1999 break things too: suggestion from Gilles Espinasse.
2000
2001
2002version 2.44
2003 Fix crash when unknown client attempts to renew a DHCP
2004 lease, problem introduced in version 2.43. Thanks to
2005 Carlos Carvalho for help chasing this down.
2006
2007 Fix potential crash when a host which doesn't have a lease
2008 does DHCPINFORM. Again introduced in 2.43. This bug has
2009 never been reported in the wild.
2010
2011 Fix crash in netlink code introduced in 2.43. Thanks to
2012 Jean Wolter for finding this.
2013
2014 Change implementation of min_port to work even if min-port
2015 is large.
2016
2017 Patch to enable compilation of latest Mac OS X. Thanks to
2018 David Gilman.
2019
2020 Update Spanish translation. Thanks to Christopher Chatham.
2021
2022
2023version 2.43
2024 Updated Polish translation. Thanks to Jan Psota.
2025
2026 Flag errors when configuration options are repeated
2027 illegally.
2028
2029 Further tweaks for GNU/kFreeBSD
2030
2031 Add --no-wrap to msgmerge call - provides nicer .po file
2032 format.
2033
2034 Honour lease-time spec in dhcp-host lines even for
2035 BOOTP. The user is assumed to known what they are doing in
2036 this case. (Hosts without the time spec still get infinite
2037 leases for BOOTP, over-riding the default in the
2038 dhcp-range.) Thanks to Peter Katzmann for uncovering this.
2039
2040 Fix problem matching relay-agent ids. Thanks to Michael
2041 Rack for the bug report.
2042
2043 Add --naptr-record option. Suggestion from Johan
2044 Bergquist.
2045
2046 Implement RFC 5107 server-id-override DHCP relay agent
2047 option.
2048
2049 Apply patches from Stefan Kruger for compilation on
2050 Solaris 10 under Sun studio.
2051
2052 Yet more tweaking of Linux capability code, to suppress
2053 pointless wingeing from kernel 2.6.25 and above.
2054
2055 Improve error checking during startup. Previously, some
2056 errors which occurred during startup would be worked
2057 around, with dnsmasq still starting up. Some were logged,
2058 some silent. Now, they all cause a fatal error and dnsmasq
2059 terminates with a non-zero exit code. The errors are those
2060 associated with changing uid and gid, setting process
2061 capabilities and writing the pidfile. Thanks to Uwe
2062 Gansert and the Suse security team for pointing out
2063 this improvement, and Bill Reimers for good implementation
2064 suggestions.
2065
2066 Provide NO_LARGEFILE compile option to switch off largefile
2067 support when compiling against versions of uclibc which
2068 don't support it. Thanks to Stephane Billiart for the patch.
2069
2070 Implement random source ports for interactions with
2071 upstream nameservers. New spoofing attacks have been found
2072 against nameservers which do not do this, though it is not
2073 clear if dnsmasq is vulnerable, since to doesn't implement
2074 recursion. By default dnsmasq will now use a different
2075 source port (and socket) for each query it sends
2076 upstream. This behaviour can suppressed using the
2077 --query-port option, and the old default behaviour
2078 restored using --query-port=0. Explicit source-port
2079 specifications in --server configs are still honoured.
2080
2081 Replace the random number generator, for better
2082 security. On most BSD systems, dnsmasq uses the
2083 arc4random() RNG, which is secure, but on other platforms,
2084 it relied on the C-library RNG, which may be
2085 guessable and therefore allow spoofing. This release
2086 replaces the libc RNG with the SURF RNG, from Daniel
2087 J. Berstein's DJBDNS package.
2088
2089 Don't attempt to change user or group or set capabilities
2090 if dnsmasq is run as a non-root user. Without this, the
2091 change from soft to hard errors when these fail causes
2092 problems for non-root daemons listening on high
2093 ports. Thanks to Patrick McLean for spotting this.
2094
2095 Updated French translation. Thanks to Gildas Le Nadan.
Simon Kelley1f15b812009-10-13 17:49:32 +01002096
2097
2098version 2.42
2099 The changelog for version 2.42 and earlier is
2100 available in CHANGELOG.archive.