* fixed compile issues with prior release
* fixed carrier loss not being detected for IPv4
* UUID based DUID is used where available and no prior DUID exists
Replace unportable manual calculation of alignof() that causes UB, with
a GCC extension __alignof__.
This fixes a problem reported by UBSan with the MKSANITIZER distribution.
that are not very useful (and trully if any they belong to a separate section
instead of being interspersed in the document), and organizes and formats
the information better.
Sanitizers are conflicting with this option:
When linking shared libraries, the AddressSanitizer run-time is not
linked, so -Wl,-z,defs may cause link errors (t use it with
AddressSanitizer).
https://clang.llvm.org/docs/AddressSanitizer.html
When linking shared libraries, the MemorySanitizer run-time is not
linked, so -Wl,-z,defs may cause link errors (t use it with
MemorySanitizer).
https://clang.llvm.org/docs/MemorySanitizer.html
Solution suggested by <christos>
Root cause of breaking libc++ investigated by <Yang Zheng>
- Replace non-printable multibyte char with ?-symbol.
- Put space before non-spacing char.
Fix problems reported in PR bin/53164 and
PR bin/53323, that are because we did not take into account non-printable
multibyte char of wctob(wc) == EOF && wcwidth(wc) == -1.
This change breaks the expectations of users that would like a coredump
of top(1). Other similar applications such as vmstat(1) don't do this.
Since the change was just a courtesy, revert.
* dhcp: Clarified some checksumming code, style and commentary
(thanks to Maxime Villard)
* dhcp6: IAID is now unique per IA type rather than global
* ip6: if an IA callback causes a fork, exit earlier
The cp_old array is allocated with malloc(3) and its pointer is passed to
percentages64().
In this function there happens a calculation of total_change, which value
depends on the value inside the unitialized cp_old[] array.
==26662==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x268a2c in percentages64 /usr/src/external/bsd/top/bin/../dist/machine/m_netbsd.c:1341:6
#1 0x26748b in get_system_info /usr/src/external/bsd/top/bin/../dist/machine/m_netbsd.c:478:6
#2 0x25518e in do_display /usr/src/external/bsd/top/bin/../dist/top.c:507:5
#3 0x253038 in main /usr/src/external/bsd/top/bin/../dist/top.c:975:2
#4 0x21cad1 in ___start (/usr/bin/top+0x1cad1)
SUMMARY: MemorySanitizer: use-of-uninitialized-value /usr/src/external/bsd/top/bin/../dist/machine/m_netbsd.c:1341:6 in percentages64
Exiting
Fix this issue by changling malloc(3) with calloc(3).
Detected with Memory Sanitizer during the integration of sanitizers with
the NetBSD basesystem.
Reported by <Yang Zheng>
* Routing: Fix case when cloning route changes but needs to be replaced
* DHCP6: Transpose DHCP userclass option into DHCP6
* DHCP6: Fix sending custom vendor class option
* Auth: Allow zero value replay detection data
* Auth: Allow different tokens for send and receive
* ND6: Warn if router lifetime is set to zero
* DHCP6: Softwire Address and Port-Mapped Clients, RFC7598
programs there; make all Makefiles that use bsd.hostprog.mk include it.
Namely turn off MKREPRO and don't make lint, man pages, info files etc.
Remove the Makefile.inc files that contained these same settings, and
remove the settings from Makefile.host
tcp_timer.h. This struct move is more trouble than its worth. It breaks
header compatibility with other BSD's and can't be really removed because
it is an installed header that will break other 3rd party software. I
suggest that it gets reverted!
output if the locale is non-UTF-8 locale with the following change.
https://marc.info/?l=openbsd-cvs&m=152364416720474
| Modified files:
| usr.bin/mandoc : term_ascii.c
|
| Log message:
| Make sure that mandoc only goes into UTF-8 mode if the user really
| selected UTF-8, not some other multibyte locale. This obviously
| makes no difference on OpenBSD but improves portability.
| Issue reported by <Nakayama at NetBSD> via wiz@.
--- 9.10.7 released ---
--- 9.10.7rc2 released ---
4904. [bug] Temporarily revert change #4859. [GL #124]
--- 9.10.7rc1 released ---
4889. [func] Warn about the use of old root keys without the new
root key being present. Warn about dlv.isc.org's
key being present. Warn about both managed and
trusted root keys being present. [RT #43670]
4888. [test] Initialize sockets correctly in sample-update so
that the nsupdate system test will run on Windows.
[RT #47097]
4886. [doc] Document dig -u in manpage. [RT #47150]
4885. [security] update-policy rules that otherwise ignore the name
field now require that it be set to "." to ensure
that any type list present is properly interpreted.
[RT #47126]
4882. [bug] Address potential memory leak in
dns_update_signaturesinc. [RT #47084]
4881. [bug] Only include dst_openssl.h when OpenSSL is required.
[RT #47068]
4879. [bug] dns_rdata_caa:value_len field was too small.
[RT #47086]
--- 9.10.7b1 released ---
4876. [bug] Address deadlock with accessing a keytable. [RT #47000]
4874. [bug] Wrong time display when reporting new keywarntime.
[RT #47042]
4872. [bug] Don't permit loading meta RR types such as TKEY
from master files. [RT #47009]
4871. [bug] Fix configure glitch in detecting stdatomic.h
support on systems with multiple compilers.
[RT #46959]
4870. [test] Update included ATF library to atf-0.21 preserving
the ATF tool. [RT #46967]
4869. [bug] Address some cases where NULL with zero length could
be passed to memmove which is undefined behaviour and
can lead to bad optimisation. [RT #46888]
4867. [cleanup] Normalize rndc on/off commands (validation and
querylog) so they accept the same synonyms
for on/off (yes/no, true/false, enable/disable).
Thanks to Tony Finch. [RT #47022]
4866. [port] DST library initialization verifies MD5 (when MD5
was not disabled) and SHA-1 hash and HMAC support.
[RT #46764]
4863. [bug] Fix various other bugs reported by Valgrind's
memcheck tool. [RT #46978]
4862. [bug] The rdata flags for RRSIG were not being properly set
when constructing a rdataslab. [RT #46978]
4861. [bug] The isc_crc64 unit test was not endian independent.
[RT #46973]
4860. [bug] isc_int8_t should be signed char. [RT #46973]
4859. [bug] A loop was possible when attempting to validate
unsigned CNAME responses from secure zones;
this caused a delay in returning SERVFAIL and
also increased the chances of encountering
CVE-2017-3145. [RT #46839]
4858. [security] Addresses could be referenced after being freed
in resolver.c, causing an assertion failure.
(CVE-2017-3145) [RT #46839]
4857. [bug] Maintain attach/detach semantics for event->db,
event->node, event->rdataset and event->sigrdataset
in query.c. [RT #46891]
4856. [bug] 'rndc zonestatus' reported the wrong underlying type
for a inline slave zone. [RT #46875]
4852. [bug] Add REQUIRE's and INSIST's to isc_time_formattimestamp,
isc_time_formathttptimestamp, isc_time_formatISO8601.
[RT #46892]
4851. [port] Support using kyua as well as atf-run to run the unit
tests. [RT #46853]
4846. [test] Adjust timing values in runtime system test. Address
named.pid removal races in runtime system test.
[RT #46800]
4844. [test] Address memory leaks in libatf-c. [RT #46798]
4843. [bug] dnssec-signzone free hashlist on exit. [RT #46791]
4842. [bug] Conditionally compile opensslecdsa_link.c to avoid
warnings about unused function. [RT #46790]
4841. [bug] Address -fsanitize=undefined warnings. [RT #46786]
4840. [test] Add tests to cover fallback to using ZSK on inactive
KSK. [RT #46787]
4839. [bug] zone.c:zone_sign was not properly determining
if there were active KSK and ZSK keys for
a algorithm when update-check-ksk is true
(default) leaving records unsigned with one or
more DNSKEY algorithms. [RT #46774]
4838. [bug] zone.c:add_sigs was not properly determining
if there were active KSK and ZSK keys for
a algorithm when update-check-ksk is true
(default) leaving records unsigned with one or
more DNSKEY algorithms. [RT #46754]
4837. [bug] dns_update_signatures{inc} (add_sigs) was not
properly determining if there were active KSK and
ZSK keys for a algorithm when update-check-ksk is
true (default) leaving records unsigned when there
were multiple DNSKEY algorithms for the zone.
[RT #46743]
4836. [bug] Zones created using "rndc addzone" could
temporarily fail to inherit an "allow-transfer"
ACL that had been configured in the options
statement. [RT #46603]
4833. [bug] isc_event_free should check that the event is not
linked when called. [RT #46725]
4832. [bug] Events were not being removed from zone->rss_events.
[RT #46725]
4831. [bug] Convert the RRSIG expirytime to 64 bits for
comparisions in diff.c:resign. [RT #46710]
4830. [bug] Failure to configure ATF when requested did not cause
an error in top-level configure script. [RT #46655]
4829. [bug] isc_heap_delete did not zero the index value when
the heap was created with a callback to do that.
[RT #46709]
4827. [misc] Add a precommit check script util/checklibs.sh
[RT #46215]
4826. [cleanup] Prevent potential build failures in bin/confgen/ and
bin/named/ when using parallel make. [RT #46648]
4823. [test] Refactor reclimit system test to improve its
reliability and speed. [RT #46632]
4822. [bug] Use resign_sooner in dns_db_setsigningtime. [RT #46473]
4821. [bug] When resigning ensure that the SOA's expire time is
always later that the resigning time of other records.
[RT #46473]
4820. [bug] dns_db_subtractrdataset should transfer the resigning
information to the new header. [RT #46473]
4819. [bug] Fully backout the transaction when adding a RRset
to the resigning / removal heaps fails. [RT #46473]
4818. [test] The logfileconfig system test could intermittently
report false negatives on some platforms. [RT #46615]
4817. [cleanup] Use DNS_NAME_INITABSOLUTE and DNS_NAME_INITNONABSOLUTE.
[RT #45433]
4816. [bug] Don't use a common array for storing EDNS options
in DiG as it could fill up. [RT #45611]
4815. [bug] rbt_test.c:insert_and_delete needed to call
dns_rbt_addnode instead of dns_rbt_addname. [RT #46553]
4814. [cleanup] Use AS_HELP_STRING for consistent help text. [RT #46521]
4812. [bug] Minor improvements to stability and consistency of code
handling managed keys. [RT #46468]
4810. [test] The chain system test failed if the IPv6 interfaces
were not configured. [RT #46508]
4809. [port] Check at configure time whether -latomic is needed
for stdatomic.h. [RT #46324]
4805. [bug] TCP4Active and TCP6Active weren't being updated
correctly. [RT #46454]
4804. [port] win32: access() does not work on directories as
required by POSIX. Supply a alternative in
isc_file_isdirwritable. [RT #46394]
4803. [bug] Backport fix for RT #46055 from RT #46267. [RT #46430]
4792. [bug] Fix map file header correctness check. [RT #38418]
4791. [doc] Fixed outdated documentation about export libraries.
[RT #46341]
4790. [bug] nsupdate could trigger a require when sending a
update to the second address of the server.
[RT #45731]
4788. [cleanup] When using "update-policy local", log a warning
when an update matching the session key is received
from a remote host. [RT #46213]
4787. [cleanup] Turn nsec3param_salt_totext() into a public function,
dns_nsec3param_salttotext(), and add unit tests for it.
[RT #46289]
4783. [test] dnssec: 'check that NOTIFY is sent at the end of
NSEC3 chain generation failed' required more time
on some machines for the IXFR to complete. [RT #46388]
4781. [maint] B.ROOT-SERVERS.NET is now 199.9.14.201. [RT #45889]
4780. [bug] When answering ANY queries, don't include the NS
RRset in the authority section if it was already
in the answer section. [RT #44543]
4777. [cleanup] Removed a redundant call to configure_view_acl().
[RT #46369]
4774. [bug] <isc/util.h> was incorrectly included in several
header files. [RT #46311]
4773. [doc] Fixed generating Doxygen documentation for functions
annotated using certain macros. Miscellaneous
Doxygen-related cleanups. [RT #46276]
4771. [bug] When sending RFC 5011 refresh queries, disregard
cached DNSKEY rrsets. [RT #46251]
4770. [bug] Cache additional data from priming queries as glue.
Previously they were ignored as unsigned
non-answer data from a secure zone, and never
actually got added to the cache, causing hints
to be used frequently for root-server
addresses, which triggered re-priming. [RT #45241]
4769. [bug] Enforce the requirement that the managed keys
directory (specified by "managed-keys-directory",
and defaulting to the working directory if not
specified) must be writable. [RT #46077]
4766. [cleanup] Addresss Coverity warnings. [RT #46150]
4762. [func] "update-policy local" is now restricted to updates
from local addresses. (Previously, other addresses
were allowed so long as updates were signed by the
local session key.) [RT #45492]
4761. [protocol] Add support for DOA. [RT #45612]
4759. [func] Add logging channel "trust-anchor-telementry" to
record trust-anchor-telementry in incoming requests.
Both _ta-XXXX.<anchor>/NULL and EDNS KEY-TAG options
are logged. [RT #46124]
4758. [doc] Remove documentation of unimplemented "topology".
[RT #46161]
4756. [bug] Interrupting dig could lead to an INSIST failure after
certain errors were encountered while querying a host
whose name resolved to more than one address. Change
4537 increased the odds of triggering this issue by
causing dig to hang indefinitely when certain error
paths were evaluated. dig now also retries TCP queries
(once) if the server gracefully closes the connection
before sending a response. [RT #42832, #45159]
4754. [bug] dns_zone_setview needs a two stage commit to properly
handle errors. [RT #45841]
4753. [contrib] Software obtainable from known upstream locations
(i.e., zkt, nslint, query-loc) has been removed.
Links to these and other packages can be found at
https://www.isc.org/community/tools [RT #46182]
4752. [test] Add unit test for isc_net_pton. [RT #46171]
4749. [func] The ISC DLV service has been shut down, and all
DLV records have been removed from dlv.isc.org.
- Removed references to ISC DLV in documentation
- Removed DLV key from bind.keys
- No longer use ISC DLV by default in delv
[RT #46155]
4748. [cleanup] Sprintf to snprintf coversions. [RT #46132]
4746. [cleanup] Add configured prefixes to configure summary
output. [RT #46153]
4745. [test] Add color-coded pass/fail messages to system
tests when running on terminals that support them.
[RT #45977]
4744. [bug] Suppress trust-anchor-telementry queries if
validation is disabled. [RT #46131]
4741. [bug] Make isc_refcount_current() atomically read the
counter value. [RT #46074]
4739. [cleanup] Address clang static analysis warnings. [RT #45952]
4738. [port] win32: strftime mishandles %Z. [RT #46039]
4737. [cleanup] Address Coverity warnings. [RT #46012]
4736. [cleanup] (a) Added comments to NSEC3-related functions in
lib/dns/zone.c. (b) Refactored NSEC3 salt formatting
code. (c) Minor tweaks to lock and result handling.
[RT #46053]
4735. [bug] Add @ISC_OPENSSL_LIBS@ to isc-config. [RT #46078]
4734. [contrib] Added sample configuration for DNS-over-TLS in
contrib/dnspriv.
4730. [bug] Fix out of bounds access in DHCID totext() method.
[RT #46001]
4729. [bug] Don't use memset() to wipe memory, as it may be
removed by compiler optimizations when the
memset() occurs on automatic stack allocation
just before function return. [RT #45947]
4728. [func] Use C11's stdatomic.h instead of isc_atomic
where available. [RT #40668]
4727. [bug] Retransferring an inline-signed slave using NSEC3
around the time its NSEC3 salt was changed could result
in an infinite signing loop. [RT #45080]
4725. [bug] Nsupdate: "recvsoa" was incorrectly reported for
failures in sending the update message. The correct
location to be reported is "update_completed".
[RT #46014]
4722. [cleanup] Clean up uses of strcpy() and strcat() in favor of
strlcpy() and strlcat() for safety. [RT #45981]
4719. [bug] Address PVS static analyzer warnings. [RT #45946]
4717. [bug] Treat replies with QCOUNT=0 as truncated if TC=1,
FORMERR if TC=0, and log the error correctly.
[RT #45836]
4715. [bug] TreeMemMax was mis-identified as a second HeapMemMax
in the Json cache statistics. [RT #45980]
4714. [port] openbsd/libressl: add support for building with
--enable-openssl-hash. [RT #45982]
4713. [cleanup] Minor revisions to RPZ code to reduce
differences with the development branch. [RT #46037]
4712. [bug] "dig +domain" and "dig +search" didn't retain the
search domain when retrying with TCP. [RT #45547]
4711. [test] Some RR types were missing from genzones.sh.
[RT #45782]
4709. [cleanup] Use dns_name_fullhash() to hash names for RRL.
[RT #45435]
4703. [bug] BINDInstall.exe was missing some buffer length checks.
[RT #45898]
4698. [port] Add --with-python-install-dir configure option to allow
specifying a nonstandard installation directory for
Python modules. [RT #45407]
4696. [port] Enable filter-aaaa support by default on Windows
builds. [RT #45883]
4692. [bug] Fix build failures with libressl introduced in 4676.
[RT #45879]
4690. [bug] Command line options -4/-6 were handled inconsistently
between tools. [RT #45632]
4689. [cleanup] Turn on minimal responses for CDNSKEY and CDS in
addition to DNSKEY and DS. Thanks to Tony Finch.
[RT #45690]
4688. [protocol] Check and display EDNS KEY TAG options (RFC 8145) in
messages. [RT #44804]
4686. [bug] dnssec-settime -p could print a bogus warning about
key deletion scheduled before its inactivation when a
key had an inactivation date set but no deletion date
set. [RT #45807]
4685. [bug] dnssec-settime incorrectly calculated publication and
activation dates for a successor key. [RT #45806]
4684. [bug] delv could send bogus DNS queries when an explicit
server address was specified on the command line along
with -4/-6. [RT #45804]
4683. [bug] Prevent nsupdate from immediately exiting on invalid
user input in interactive mode. [RT #28194]
4682. [bug] Don't report errors on records below a DNAME.
[RT #44880]
4680. [bug] Fix failing over to another master server address when
nsupdate is used with GSS-API. [RT #45380]
4679. [cleanup] Suggest using -o when dnssec-verify finds a SOA record
not at top of zone and -o is not used. [RT #45519]
4677. [cleanup] Split up the main function in dig to better support
the iOS app version. [RT #45508]
4676. [cleanup] Allow BIND to be built using OpenSSL 1.0.X with
deprecated functions removed. [RT #45706]
4675. [cleanup] Don't use C++ keyword class. [RT #45726]
4673. [port] Silence GCC 7 warnings. [RT #45592]
4672. [bug] Fix a regression introduced by change 3938 (when
--enable-fetchlimit is NOT in use), where named
as resolver would, upon fetch timeout, repeat
fetching from the same nameserver address. This
also broke "forward first;" configurations (as
forwarders are also treated as nameservers when
fetching). [RT #45321]
4671. [bug] Fix a race condition that could cause the
resolver to crash with assertion failure when
chasing DS in specific conditions with a very
short RTT to the upstream nameserver. [RT #45168]
4670. [cleanup] Ensure that a request MAC is never sent back
in an XFR response unless the signature was
verified. [RT #45494]
4668. [bug] Use localtime_r and gmtime_r for thread safety.
[RT #45664]
4667. [cleanup] Refactor RDATA unit tests. [RT #45610]
4665. [protocol] Added support for ED25519 and ED448 DNSSEC signing
algorithms (RFC 8080). (Note: these algorithms
depend on code currently in the development branch
of OpenSSL which has not yet been released.)
[RT #44696]
4663. [cleanup] Clarify error message printed by dnssec-dsfromkey.
[RT #21731]
4662. [performance] Improve cache memory cleanup of zero TTL records
by putting them at the tail of LRU header lists.
[RT #45274]
4661. [bug] A race condition could occur if a zone was reloaded
while resigning, triggering a crash in
rbtdb.c:closeversion(). [RT #45276]
4660. [bug] Remove spurious "peer" from Windows socket log
messages. [RT #45617]
4658. [bug] Clean up build directory created by "setup.py install"
immediately. [RT #45628]
4657. [bug] rrchecker system test result could be improperly
determined. [RT #45602]
4655. [bug] Lack of seccomp could be falsely reported. [RT #45599]
4654. [cleanup] Don't use C++ keywords delete, new and namespace.
[RT #45538]
4652. [bug] Nsupdate could attempt to use a zeroed address on
server timeout. [RT #45417]
4651. [test] Silence coverity warnings in tsig_test.c. [RT #45528]
--- 9.10.6 released ---
--- 9.10.6rc2 released ---
4653. [bug] Reorder includes to move @DST_OPENSSL_INC@ and
@ISC_OPENSSL_INC@ after shipped include directories.
[RT #45581]
--- 9.10.6rc1 released ---
4647. [bug] Change 4643 broke verification of TSIG signed TCP
message sequences where not all the messages contain
TSIG records. These may be used in AXFR and IXFR
responses. [RT #45509]
4645. [bug] Fix PKCS#11 RSA parsing when MD5 is disabled.
[RT #45300]
--- 9.10.6b1 released ---
4643. [security] An error in TSIG handling could permit unauthorized
zone transfers or zone updates. (CVE-2017-3142)
(CVE-2017-3143) [RT #45383]
4642. [cleanup] Add more logging of RFC 5011 events affecting the
status of managed keys: newly observed keys,
deletion of revoked keys, etc. [RT #45354]
4641. [cleanup] Parallel builds (make -j) could fail with --with-atf /
--enable-developer. [RT #45373]
4640. [bug] If query_findversion failed in query_getdb due to
memory failure the error status was incorrectly
discarded. [RT #45331]
4636. [bug] Normalize rpz policy zone names when checking for
existence. [RT #45358]
4635. [bug] Fix RPZ NSDNAME logging that was logging
failures as NSIP. [RT #45052]
4634. [contrib] check5011.pl needs to handle optional space before
semi-colon in +multi-line output. [RT #45352]
4633. [maint] Updated AAAA (2001:500:200::b) for B.ROOT-SERVERS.NET.
4632. [security] The BIND installer on Windows used an unquoted
service path, which can enable privilege escalation.
(CVE-2017-3141) [RT #45229]
4631. [security] Some RPZ configurations could go into an infinite
query loop when encountering responses with TTL=0.
(CVE-2017-3140) [RT #45181]
4629. [bug] dns_client_startupdate could not be called with a
running client. [RT #45277]
4628. [bug] Fixed a potential reference leak in query_getdb().
[RT #45247]
4627. [func] Deprecate 'dig +sit', it is replaced by 'dig +cookie'.
[RT #45245]
4626. [test] Added more tests for handling of different record
ordering in CNAME and DNAME responses. [QA #430]
4624. [bug] Check isc_mem_strdup results in dns_view_setnewzones.
[RT #45210]
4622. [bug] Remove unnecessary escaping of semicolon in CAA and
URI records. [RT #45216]
4621. [port] Force alignment of oid arrays to silence loader
warnings. [RT #45131]
4620. [port] Handle EPFNOSUPPORT being returned when probing
to see if a socket type is supported. [RT #45214]
4617. [test] Update rndc system test to be more delay tolerant.
[RT #45177]
4615. [bug] AD could be set on truncated answer with no records
present in the answer and authority sections.
[RT #45140]
4614. [test] Fixed an error in the sockaddr unit test. [RT #45146]
4612. [bug] Silence 'may be use uninitalised' warning and simplify
the code in lwres/getaddinfo:process_answer.
[RT #45158]
4609. [cleanup] Rearrange makefiles to enable parallel execution
(i.e. "make -j"). [RT #45078]
4608. [func] DiG now warns about .local queries which are reserved
for Multicast DNS. [RT #44783]
4606. [port] Stop using experimental "Experimental keys on scalar"
feature of perl as it has been removed. [RT #45012]
4604. [bug] Don't use ERR_load_crypto_strings() when building
with OpenSSL 1.1.0. [RT #45117]
4603. [doc] Automatically generate named.conf(5) man page
from doc/misc/options. Thanks to Tony Finch.
[RT #43525]
4602. [func] Threads are now set to human-readable
names to assist debugging, when supported by
the OS. [RT #43234]
4601. [bug] Reject incorrect RSA key lengths during key
generation and and sign/verify context
creation. [RT #45043]
4600. [bug] Adjust RPZ trigger counts only when the entry
being deleted exists. [RT #43386]
4599. [bug] Fix inconsistencies in inline signing time
comparison that were introduced with the
introduction of rdatasetheader->resign_lsb.
[RT #42112]
4597. [bug] The validator now ignores SHA-1 DS digest type
when a DS record with SHA-384 digest type is
present and is a supported digest type.
[RT #45017]
4596. [bug] Validate glue before adding it to the additional
section. This also fixes incorrect TTL capping
when the RRSIG expired earlier than the TTL.
[RT #45062]
4593. [doc] Update README using markdown, remove outdated FAQ
file in favor of the knowledge base.
4592. [bug] A race condition on shutdown could trigger an
assertion failure in dispatch.c. [RT #43822]
4591. [port] Addressed some python 3 compatibility issues.
Thanks to Ville Skytta. [RT #44955] [RT #44956]
4590. [bug] Support for PTHREAD_MUTEX_ADAPTIVE_NP was not being
properly detected. [RT #44871]
4589. [cleanup] "configure -q" is now silent. [RT #44829]
4588. [bug] nsupdate could send queries for TKEY to the wrong
server when using GSSAPI. Thanks to Tomas Hozza.
[RT #39893]
4587. [bug] named-checkzone failed to handle occulted data below
DNAMEs correctly. [RT #44877]
4585. [port] win32: Set CompileAS value. [RT #42474]
4584. [bug] A number of memory usage statistics were not properly
reported when they exceeded 4G. [RT #44750]
4574. [bug] Dig leaked memory with multiple +subnet options.
[RT #44683]
4555. [func] dig +ednsopt: EDNS options can now be specified by
name in addition to numeric value. [RT #44461]
Version 4.4.1
28 February 2018
Release Notes
NEW FEATURES
Please note that that ISC DHCP is now licensed under the Mozilla Public License,
MPL 2.0. Please see https://www.mozilla.org/en-US/MPL/2.0/ to read the MPL 2.0
license terms.
The areas of focus for ISC DHCP 4.4 were:
1. Dynamic DNS additions
2. dhclient improvements
3. Support for dynamic shared libraries
Dynamic DNS Improvements:
- We added three new server configuration parameters which influence DDNS
conflict resolution:
1. ddns-dual-stack-mixed-mode - alters DNS conflict resolution behavior
to mitigate issues with non-compliant clients in dual stack environments.
2. ddns-guard-id-must-match - relaxes the DHCID RR client id matching
requirement of DNS conflict resolution.
3. ddns-other-guard-is-dynamic - alters dual-stack-mixed-mode behavior to
allow unguarded DNS entries to be overwritten in certain cases
- The server now honors update-static-leases parameter for static DHCPv6
hosts.
dhclient Improvements:
- We've added three command line parameters to dhclient:
1. --prefix-len-hint - directs dhclient to use the given length as
the prefix length hint when requesting prefixes
2. --decline-wait-time - instructs the client to wait the given number
of seconds after declining an IPv4 address before issuing a discover
3. --address-prefix-len - specifies the prefix length passed by dhclient
into the client script (via the environment variable ip6_prefixlen) with
each IPv6 address. We added this parameter because we have changed the
default value from 64 to 128 in order to be compliant with RFC3315bis
draft (-09, page 64) and RFC5942, Section 4, point 1.
**WARNING**: The new default value of 128 may not be backwardly compatible
with your environment. If you are operating without a router, such as
between VMs on a host, you may find they cannot see each other with prefix
length of 128. In such cases, you'll need to either provide routing or use
the command line parameter to set the value to 64. Alternatively you may
change the default at compile time by setting DHCLIENT_DEFAULT_PREFIX_LEN
in includes/site.h.
- dhclient will now generate a DHCPv6 DECLINE message when the client script
indicates a DAD failure
Dynamic shared library support:
Configure script, configure.ac+lt, which supports libtool is now provided
with the source tar ball. This script can be used to configure ISC DHCP
to build with libtool and thus use dynamic shared libraries.
Other Highlights:
- The server now supports dhcp-cache-threshold for DHCPv6 operations
- The server now supports DHPv6 address allocation based on EUI-64 DUIDs
- Experimental support for alternate relay port in the both the server
and relay for IPv4, IPv6 and 4o6 (see: draft-ietf-dhc-relay-port-10.txt)
For information on how to install, configure and run this software, as
well as how to find documentation and report bugs, please consult the
README file.
ISC DHCP uses standard GNU configure for installation. Please review the
output of "./configure --help" to see what options are available.
The system has only been tested on Linux, FreeBSD, and Solaris, and may not
work on other platforms. Please report any problems and suggested fixes to
<dhcp-users@isc.org>.
ISC DHCP is open source software maintained by Internet Systems
Consortium. This product includes cryptographic software written
by Eric Young (eay@cryptsoft.com).
Changes since 4.4.0 (New Features)
- none
Changes since 4.4.0 (Bug Fixes)
- A delayed-ack value of 0 (the default), now correctly disables the delayed
feature. A change in 4.4.0 prohibited lease updates marking leases active
from be written to the lease file when delayed-ack is 0. This in turn,
caused servers to lose active lease assignments upon restart.
[ISC-Bugs #47141]
! Option reference count was not correctly decremented in error path
when parsing buffer for options. Reported by Felix Wilhelm, Google
Security Team.
[ISC-Bugs #47140]
CVE: CVE-2018-5733
! Corrected an issue where large sized 'X/x' format options were causing
option handling logic to overwrite memory when expanding them to human
readable form. Reported by Felix Wilhelm, Google Security Team.
[ISC-Bugs #47139]
CVE: CVE-2018-5732
Changes since 4.4.0b1 (New Features)
- Duplicate address detection when binding to a new IPv6 address was added
to the following dhclient scripts: linux,freebsd,netbsd,openbsd, and macos.
The scripts will check for DAD errors after binding to a new IPv6 address
for at most --dad-wait-time seconds. If a DAD error is detected the script
will exit with a value of 3, instructing dhclient to decline the address. If
dad-wait-time is zero (the default), DAD error checking is not peformed.
[ISC-Bugs 46805]
- Support for sending and receiving additional DHCP4 options has been added
to both the dhcpd and dhclient. Specifically: option codes 93,94, and 97
(RFC 4578); code 150 (RFC 5859); and codes 209,219, and 211 (RFC 5071).
Beyond configuring, sending, requesting, and receiving these options neither
server nor client apply any additional logic based on their values.
Thanks to Peter Lewis for requesting this change.
[ISC-Bugs 47062]
Changes since 4.4.0b1 (Bug Fixes)
- Added clarifying text to dhcpd.conf.5 explaining the class match expressions
cannot rely on the results of executable statements.
[ISC-Bugs #45451]
- Fixed a bug which causes dhcpd and dhclient to crash on certain
systems when given relative path names for lease or pid files on
the command line. Affected systems are those on which the C library
function, realpath() does not support a second parameter value of
NULL (see manpages for realpath(3)).
[ISC-Bugs #46957]
- Fixed a build issue when building with embedded BIND9 under OpenBSD that
was causing BIND9 build to not generate dns/enumclass.h and dns/enumtype.h.
[ISC-Bugs #46971]
- Added <dhcp>/m4/README to the distribution tarball. Some versions of
ac_local() treat the absence of the m4 subdirectory as error rather than
warning. This was causing the call to autoreconf, necessary for building
with libtool, to fail.
[ISC-Bugs #47075]
Changes since 4.4.0a1 (New Features)
- Added experimental support for relay port (draft-ietf-dhc-relay-port-10.txt)
feature for DHCPv4, DHCPv6 and DHCPv4-over-DHCPv6. Relay port has to be
enabled at compile time via --enable-relay-port and is fully backward
compatible (i.e. works with previous implementations of servers and relays
using the standard ports). A new --rp <relay-port> command line option
specifies to dhcrelay an alternate source port for upstream (i.e. toward
the server) messages. Thanks to Naiming Shen and Enke Chen of Cisco
systems for submitting these patches.
[ISC-Bugs #44535]
- Added --release-on-roam to dhcpd server. When enabled and the server detects
that a DHCPv6 client (IAID+DUID) has roamed to a new network, it will release
the pre-existing leases on the old network and emit a log statement similar
to the following:
"Client: <id> roamed to new network, releasing lease: <address>"
The server will carry out all of the same steps that would normally occur
when a client explicitly releases a lease. This behavior is disabled by
default and may only be specified globally. Prior to this the server renders
the leases unavailable until they expire or the server is restarted. Clients
that need leases in multiple networks must supply a unique IAID in each IA.
When release-on-roam is disabled (the default) the server maintains the
prior behavior of making such leases unavailable until they expire or the
server is restarted. Clients that need leases in multiple networks must
supply a unique IAID in each IA. This parameter may only be specified at
the global level. Thanks to Fernando Soto from BlueCat Networks for
suggesting this change.
[ISC-Bugs #44576]
[ISC-Bugs #46849]
- Support for delayed-ack is now compiled in by default. Prior to this
it had to be enabled at compile time via --enable-delayed-acks. The
default value for delayed-ack, however, has been changed from 28 to 0
(i.e. disabled). This was done to minimize the impact on users not
currently using the feature. Please note that the delayed-ack feature
is not currently compatible with support for DHPCv4-over-DHCPv6 so
when a 4to6 port command line argument enables this in the server the
delayed-ack value is reset to 0.
[ISC-Bugs #42446]
- The server (-6) now honors the parameter, update-static-leases, for static
(fixed-address6) DHCPv6 leases. It is worth noting that because stateful
data is not retained by the server for static leases, each time a client
requests or renews a static lease, the server will perform DDNS updates for
it. This may have significant performance implications for environments
with many clients that request or renew static leases often. Similarly,
the DNS entries will not be removed by server when a client issues a RELEASE
nor if the lease is deleted from the configuration. In such cases the DNS
entries must be removed manually. This feature is disabled by default.
Thanks to both Bill Shirley and dgutier-at-cern-dot-ch for requesting
this change.
[ISC-Bugs #34097]
[ISC-Bugs #41054]
[ISC-Bugs #41450]
- Added to the server (-6) a new statement, local-address6, which specifies
the source address of packets sent by the server. An additional flag,
bind-local-address6, disabled by default, binds the service socket to
to local-address6. Note that bind-local-address does not work with direct
clients: a relay has to forward packets to the server using the
local-address6 destination.
[ISC-Bugs #46084]
Changes since 4.4.0a1 (Bugs)
- The server now recognizes environment variables PATH_DHCPD_DB and
PATH_DHCPD_PID. These had been incorrectly compiled out of the code
unless DHCPv6 support was disabled. Additionally, the server man
pages were corrected to accurately reflect how the server chooses
file names (see lease-file-name and pid-file-name statements). Thanks
to Fernando Soto at Bluecat Networks for bringing this matter to our
attention.
[ISC-Bugs #46859]
- Removed an "Impossible condition" error upon exit in the dhcpd server that
has been shutdown via OMAPI. This condition was only apparent under Solaris
when building with --enable-use-sockets and --enable-ipv4-pktinfo.
[ISC-Bugs #36118]
- Corrected some minor Coverity issues: CID 1426059, 1426058, and 1426057.
[ISC-Bugs #46836]
- Added missing text to dhclient.8 and expanded release note coverage
for --address-prefix-len changes.
Changes since 4.3.6 (New Features)
- Added --enable-bind-install to install embedded bind includes and
libraries. Default is to not install them (it was the previous
behavior). If you'd like to change the includedir and/or libdir
installation directories to something different than for ISC DHCP
you must pass them using the --with-bind-extra-config configuration
arguments.
[ISC-Bugs #39318]
- Added support of dynamic shared libraries with libtool. A new
--enable-libtool configuration parameter is available but
should not be used directly: *please* read the build configuration
section in the README file for the recommended procedure.
[ISC-Bugs #29402]
- IPv6 operation now supports an EUI-64 based address allocation which will
calculate addresses for clients with EUI-64 DUIDs based on those DUIDs when
enabled by setting use-eui-64 true. The parameter may defined down to the
pool scope. Note this feature must be compiled in by defining EUI_64 in
includes/site.h. This flag is undefined by default.
[ISC-Bugs #43927]
- The directory includes/isc-dhcp and it's only occupant, dst.h, have
been removed from the source tree. They are obsolete for branches
other than v4_1_esv.
[ISC-bugs #45541]
- Replaced ISC licensing with Mozilla Public License, MPL 2.0 licensing
throughout. Please see https://www.mozilla.org/en-US/MPL/2.0/ to read
the MPL 2.0 license terms.
[ISC-Bugs #45541]
- Load balancing for failover peers can now be disabled by setting
"load balance max secs" to 0. Doing so for both peers means both
servers will respond to all DHCPDISCOVERs or DHCPREQUESTs as soon as
they are received.
[ISC-Bugs #39669]
- Added a new dhclient command line parameter, --prefix-len-hint <length>.
When used in conjunction with -P, it directs dhclient to use the given
length as the prefix length hint when requesting prefixes. Thanks to both
Indy, of the FireballISO open source project and H. Peter Anvin for
suggesting this change.
[ISC-Bugs #43792]
[ISC-Bugs #35112]
[ISC-Bugs #32228]
[ISC-Bugs #29470]
- dhclient will now wait for 10 seconds after declining an IPv4 address
before issuing a discover. This is in keeping with RFC 2131, section 3.1.5.
Prior to this dhclient did not wait at all. The amount of time dhclient
waits can be specified via a new command line parameter:
--decline-wait-time <seconds>. A value of zero equates to no wait at all.
Thanks to Pavel Kankovsky for bringing this matter to our attention.
**NOTE: THIS IS CHANGE IN DEFAULT BEHAVIOR.
[ISC-Bugs #45457]
- dhclient will now include the lease address when logging DHCPOFFERs,
DHCPREQUESTs, DHCPACKs, DHCPRELEASEs, and DHCPDECLINEs. Additionally,
DHCPOFFERs will be logged before their corresponding DHCPREQUESTs are
sent and logged.
[ISC-Bugs #2729]
- When given the -T command line argument, in addition to reading the
current lease file, the server will write the leases to a temporary
lease file. This can help detect issues in server configuration that
only surface when leases are written to the file. The current lease
file will not be modified and the temporary lease file is removed upon
completion of the test.
[ISC-Bugs #22267]
- dhclient will now generate a DHCPv6 DECLINE message containing all IA_NA
addresses which for which the client script indicates a DAD failure. After
receiving the DECLINE reply, dhclient will restart the solicit process.
Note, the client script must exit with a value of 3 to signify that the
address failed DAD. Thanks to Jiri Popelka of Red Hat for submitting the
patch that was the foundation for this change.
**NOTE: THIS IS CHANGE IN DEFAULT BEHAVIOR.
[ISC-Bugs #21237]
[ISC-Bugs #23357]
[ISC-Bugs #36966]
- Replaced compilation option, enable-secs-byteorder, with a run-time, server
configuration parameter, check-secs-byte-order. When enabled, the
server will check for clients that do the byte ordering on the secs field
incorrectly. This field should be in network byte order but some clients
get it wrong. When this parameter is enabled the server will examine the
secs field and if it looks wrong (high byte non zero and low byte zero) swap
the bytes. The default is disabled. This parameter is only useful when
doing load balancing within failover.
[ISC-Bugs #45364]
- The default value for server (-6) parameter, prefix-length-mode, has been
changed from "exact" to "prefer". In "prefer" mode the server will offer
the first available prefix with the same length as that requested by the
client. If none are found then it will offer the first available prefix of
any length. This is more in line with with RFC 8168 and should improve
the out-of-the-box user experience.
**NOTE: THIS IS CHANGE IN DEFAULT BEHAVIOR.
[ISC-Bugs #45615]
- Added support for 'dhcp-cache-threshold' to IPv6 operation: If a client
renews before 'dhcp-cache-threshold' percent of its lease has elapsed
(default 25%), the server will reuse the allocated lease (provide a
lease within the currently allocated lease-time) rather than extend or
renew the lease. This allows the server to reply without needlessly
writing leases to disk. The preferred and valid lease lifetimes
sent to the client will be reduced by the age of the lease. The option
may be specified down to the pool level and is supported for all three
pool types: NA, TA, and PD.
[ISC-Bugs #45292]
- Added three new server configuration parameters which influence DDNS:
1. ddns-dual-stack-mixed-mode - alters DNS conflict resolution behavior
to mitigate issues with non-compliant clients in dual stack environments.
2. ddns-guard-id-must-match - relaxes the DHCID RR client id matching
requirement of DNS conflict resolution.
3. ddns-other-guard-is-dynamic - alters dual-stack-mixed-mode behavior to
allow unguarded DNS entries to be overwritten in certain cases
[ISC-Bugs #42620]
[ISC-Bugs #42621]
[ISC-Bugs #44753]
- A "key-algorithm <algorithm>" statement has been added to omshell to
allow the specification of the key algorithm to use during transaction
authentication. Prior to this it was hard-coded to be hmac-md5. It now
supports all of the same algorithms as the dhcpd server: hmac-md5 (the
default), hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and hmac-sha512.
[ISC-Bugs #46771]
- Added a server configuration parameter, persist-eui-64-leases, which
determines whether or not EUI-64 based leases are written to the
leases file. Default is true.
[ISC-Bugs #45046]
- Changed the default value of the prefix length passed by dhclient into the
client script for each IPv6 address from 64 to 128. This was done to comply
with RFC3315bis draft (-09, page 64) and RFC5942, Section 4, point 1.
In addition, dhclient now supports a command line argument,
--address-prefix-len, which may be used to override the default value.
**WARNING**: This change may not be backwardly compatible with your
environment. If you are operating without a router, such as between VMs on
a host, you may find they cannot see each with prefix length of 128. In
such cases, you'll need to either provide routing or use the command line
parameter to set the value to 64. Alternatively you may change the default
at compile time by setting DHCLIENT_DEFAULT_PREFIX_LEN in includes/site.h.
[ISC-Bugs #23252]
[ISC-Bugs #37221]
- Modified dhclient (-6) to bypass sending a confirm (INIT REBOOT) when it has
only expired address associations. Thanks to Jiri Popelka at Red Hat for
raising the issue and submitting the patch.
[ISC-Bugs #22675]
Changes since 4.3.6 (Bugs):
- Corrected an issue where the server would return a client's previously
released prefix lease even when the client provides a prefix length
hint that does not match the prior lease. Now the server will only
return the previous lease if it exactly matches the hint. If not
it will attempt to allocate a new prefix based on the hint and the
prefix-length-mode. Thanks to Tim DeNike - Lightspeed Communications
for pointing out the error of our ways.
[ISC-bugs #45780]
- Added explicit include of BIND9 isc/util.h to adapt to revisions
in BIND9 (see BIND9 ticket #46311). Prior to this the build was failing
with implicit function declarations errors for POST() and INSIST().
[ISC-bugs #46332]
- Added to code ignore empty IPv4 host name option (code 12). While RFC 2132
states the option cannot be empty, some clients are apparently capable of
sending it. Prior to this the server was attempting to use it and store it
in the lease file causing issues with DDNS and so forth.
[ISC-bugs #43786]
- Corrected dhclient command line parsing for --dad-wait-time that causes
even valid values to fail as invalid on some environments.
[ISC-Bugs #46535]
- Replaced iasubopt::heap_index with separate values for active and inactive
heaps: iasubopt::active_index and iasubopt::inactive_index. This was done
to accommodate a change in behavior in BIND9 isc_heap_delete().
[ISC-bugs #46719]
! Plugged a socket descriptor leak in OMAPI, that can occur when there is
data pending to be written to an OMAPI connection, when the connection
is closed by the reader. Thanks to Pavel Zhukov at RedHat for bringing
this issue to our attention and whose patch helped guide us in the right
direction.
[ISC-Bugs #46767]
- The ability of the server to send back dhcp6.vendor-opts values has been
restored. A change in 4.3.5 (see #29246) which enabled it to send back the
FQDN option unfortunately broke its ability send back dhcp6.vendor-opts.
Thanks to Sumant Gupta (sumantgupta at gmail dot com) of Landis+Gry for
bringing this issue to our attention.
[ISC-Bugs #46427]
Changes since 4.3.6b1
- None
Changes since 4.3.5
- The server now allows the client identifier (option 61) to own leases
in more than one subnet concurrently. Prior to this the server would
incorrectly release an existing lease in one subnet prior to assigning
a lease in another subnet. Note that the prior behavior can be still
be achieved by enabling one-lease-per-client. Thanks to both David Zych at
the University of Illinois and Norm Proffitt of Infoblox for reporting
the issue; and Norm for suggesting a solution.
[ISC-Bugs #41358]
- When replying to a DHCPINFORM, the server will now include options specified
at the pool scope, provided the ciaddr field of the DHCPINFORM is populated.
Prior to this the server only evaluated options down to the subnet scope.
Thanks to Fernando Soto at BlueCat Networks for reporting the issue.
[ISC-Bugs #43219]
[ISC-Bugs #45051]
- When memory allocation fails in a repeated way the process writes
"Run out of memory." on the standard error and exists with status 1.
[ISC-Bugs #32744]
- The new lmdb (Lightning Memory DataBase) bind9 configure option is
now disabled by default to avoid the presence of this library to be
detected which can lead to a link failure.
[ISC-Bugs #45069]
- The linux interface discovery code has been modified to use getifaddrs()
as is done for BSD and OS-X. Prior to this the code would only recognize
the first address on an interface and thereby omit vlans.
Thanks to Jiri Popelka at Redhat, Marius Tomaschewski at SUSE, and Wei
Kong at Novell, who all submitted patches.
[ISC-Bugs #28761]
[ISC-Bugs #31992]
[ISC-Bugs #25428]
[ISC-Bugs #31940]
[ISC-Bugs #32935]
- Fixed a bug in OMAPI that causes omshell to crash when a name-value
pair with a zero length value is shipped in an object. Thanks to
Fernando Soto at BlueCat Networks for reporting the issue and
supplying the patch.
[ISC-Bugs #29108]
- On 64-bit platforms, dhclient now generates the correct value for the
script environment variable, "expiry", the lease expiry value exceeds
0x7FFFFFFF. Prior to this such values would produce negative values
for expiry in the script environment.
[ISC-Bugs #43326]
- Common timer logic was modified to cap the maximum timeout values at
0x7FFFFFFF - 1. Values larger than that were causing fatal timer out of
range errors on 64-bit platforms. Thanks to Jiri Popelka at Red Hat for
reporting the issue.
[ISC-Bugs #28038]
- DHCP6 FQDN option unpacking code now correctly handles values that contain
spaces, special, or non-printable characters. Prior to this the buffer
size needed was underestimated causing a conversion error message to
be logged and DNS updates to be skipped. Thanks to Fernando Soto at
BlueCat Networks for bringing the matter to our attention.
[ISC-Bugs #43592]
- When running in -6 mode, dhclient can enforce the require option statement
and will discard offered leases that do not contain all the required
options specified in the client configuration. If not enabled the client
will still consider such leases. This must be enabled at compile time
(see ENFORCE_DHCPV6_CLIENT_REQUIRE in includes/site.h). Thanks to
Mritunjaykumar Dubey at Nokia for reporting the issue.
[ISC-Bugs #41473]
- Altered DHCPv4 lease time calculation to avoid roll over errors on 64-bit
OS systems when using -1 or large values for default-lease-time. Rollover
values will be replaced with 0x7FFFFFFF - 1. This alleviates unintentionally
short expiration times being handed out when infinite lease times (-1) in
conjunction with failover. Our thanks to Alessandro Gherardi for bringing
the issue to our attention.
[ISC-Bugs #41976]
- Added new compile time option --with-srv-conf-file which specifies a
default location of the server configuration file.
[ISC-Bugs #44765]
- Added --dad-wait-time parameter to dhclient. It specifies the maximum time,
in seconds, that the client process should wait for the duplicate address
detection to complete before initiating DHCP requests. This value is
propagated to the dhclient script and the script is responsible for waiting
the specified amount of time or until DAD has completed. If the script does
not support it, specifying this parameter has no effect. The default value
is 0 which specifies that the script should not wait for DAD. With this
change the following scripts have been modified to support the new parameter:
freebsd, linux, macos, netbsd, openbsd.
[ISC-Bugs #36169]
- The server nows checks both the address and length of a prefix delegation
when attempting to match it to a prefix pool. This ensures the server
responds properly when pool configurations change such that once valid,
"in-pool" delegations are now treated as being invalid. During lease
file loading at startup, the server will discard any PD leases that
are deemed "out-of-pool" either by address or mis-matched prefix length.
Clients seeking to renew or rebind such leases will get a response of
No Binding in the case of the former, and the prefix delegation with
lifetimes set to zero in the case of the latter. Thanks to Mark Nejedlo
at TDS Telecom for reporting this issue.
[ISC-Bugs #35378]
- Modified DDNS support initialization such that DNS related ports will only be
opened by the server (dhcpd) at startup if ddns-update-style is not "none";
by dhclient only if and when the it first attempts an update; and never by
dhcrelay. Prior to this all three always did the initialization at startup
which causes them to always open on and listen for traffic on two random
ports. Thanks to Rodney Beede for reporting this issue.
[ISC-Bugs #45290]
[ISC-Bugs #33377]
- Added error logging to two memory allocation failure checks. Thanks to Bill
Parker (wp02855 at gmail dot com) for reporting the issue.
[ISC-Bugs #41185]
- Corrected a dhclient -6 issue that caused the client to crash with an
"Impossible condition" error after de-preferencing its only IA binding.
The crash occurred when server configuration changes rendered the existing
binding out-of-range and no other leases were available to offer. Thanks
to Pierre Clerissi for bringing this issue to our attention.
[ISC-Bugs #44373]
- By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h, dhclient will
now call the script with reason set to FAIL when run with -1 (one try) and
there are no server responses. This applies to IPv4 mode only. Thanks for a
patch by Martin Pitt which got to us via Andrew Pollock.
[ISC-bugs #18183]
- The server now detects failover peers that are not referenced in at least
one pool when run with the command line option for test mode, -T. Prior to
this the check was performed too far down stream to be detected in test mode.
[ISC-Bugs #29892]
- Linux script updated. The script is now based on Debian version. It uses
ip tool from iproute2 package and ifconfig is no longer used. This also
addresses an issue of calling arping with inappropriate parameter.
[ISC-bugs #19430]
[ISC-bugs #18111]
- Changed severity of the log message indicating UDP checksum errors in
the received packets from 'info' to 'debug' to avoid logging excessive
number of false positives when UDP checksum offloading is enabled.
[ISC-bugs #41757]
- The directory minires has been removed from the source tree. It has
long been obsolete for branches other than v4_1_esv. Additionally,
includes/minires.h was renamed includes/ns_name.h.
[ISC-bugs #45471]
- Replaced ifconfig parameters "add" and "delete" with "alias" and "-alias"
for IPv6 mode in the client scripts, netbsd and openbsd. This was
preventing IPv6 addresses from being added or removed from interfaces.
Thanks to Tim Dean for reporting this issue.
[ISC-bugs #31573]
Changes since 4.3.5b1
- Corrected a bug which could cause the server to sporadically crash while
loading lease files with the lease-id-format is set to "hex". Our thanks
to Jay Ford, University of Iowa for reporting the issue.
[ISC-Bugs #43185]
- Eliminated a noisy, but otherwise harmless debug log statment that may
appear during server startup when building with --enable-binary-leases
and configuring multiple pools in a shared network. Thanks to Fernando
Soto from BlueCat Networks for reporting the issue and supplying a patch.
[ISC-Bugs #43262]
Changes since 4.3.4
- Fixed util/bindvar.sh error handling.
[ISC-Bugs #41973]
- Correct error message in relay to use remote id length instead
of circuit id length.
[ISC-Bugs #42556]
- Add logic to test directory Makefiles to avoid copying Attfile(s)
when building within the source tree. This eliminates a noisy but
otherwise harmless error message when running "make check".
[ISC-Bugs #41883]
- Leases are now scrubbed of certain prior use information when pool
re-balancing reassigns them from one FO peer to the other. This
corrects an issue where leases that were offered but not used
by the client retained the client hostname from the original
client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
for reporting the issue.
[ISC-Bugs #42008]
- In the LDAP code and schema add some missing '6' characters to use
the v6 instead of the v4 versions. Thanks to Denis Taranushin for
reporting this issue and supplying its patch.
[ISC-Bugs #42666]
- Correct how the pick-first-value expression is written to a lease
file. Previously it was written as a concat expression due to
a cut and paste error.
[ISC-Bugs #42253]
- Modify the DDNS code to clean up the PTR record even if there
are issues while cleaning up the A or AAAA records.
[ISC-Bugs #23954]
- Added global configuration parameter, abandon-lease-time, which determines
the amount of time a lease remains abandoned. The default is 84600 seconds.
Additionaly, the server now conducts a ping check (if ping checks are
enabled) prior to offering an abandoned lease to client. Our thanks to
David Zych at University of Illinois for reporting the issue and working
with us to produce a viable solution.
[ISC-Bugs #41815]
- Correct handling of interface names during interface discovery. This
addresses an issue where interface names of 15 characters in length
could lead to crashes or interface recognition errors during startup
of dhcpd, dhclient, and dhcrelay.
[ISC-Bugs #42226]
- Updates to contrib/dhcp-lease-list.pl to make it more friendly.
The updates are: looking for the lease file in more places and skipping
the "processing complete" output when creating machine readable
output. Thanks to Cameron Paine (cbp at null dot net) for the
patch.
[ISC-Bugs #42113]
- When reusing a lease for dhcp-cache-threshold return the hostname
to the original lease. Also if the host pointer, UID or hardware address
change don't allow reuse of the lease.
Thanks to Michael Vincent for reporting this and helping us
verify the problem and fix.
[ISC-Bugs #42849]
- Change dmalloc to use a size_t as the length argument to bring it
in line with the call it will make to malloc().
[ISC-Bugs #40843]
- If the failover socket can't be bound, close it. Otherwise if the
user configures an incorrect address in the failover stanza the
server will continue to open new sockets every 90 seconds until
it runs out.
[ISC-Bugs #42452]
- Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
allow interfaces to be upstream or downstream respectively. Upstream
interfaces will accept and forward only BOOTP replies, while downstream
interfaces will accept and forward only BOOTP requests.
[ISC-Bugs #41547]
- Clean up some memory references in the vendor-class construct.
[ISC-Bugs #42984]
Changes since 4.3.4b1
- None
Changes since 4.3.3
- Corrected a static analyzer warning in common/execute.c
[ISC-Bugs #40374]
- ISC DHCP now follows the common convention to use the base name a
program is invoked with (aka argv[0], vs. a builtin name) for
logs. This should help differentiate syslog entries for DHCPv4 and
DHCPv6 servers. You can define OLD_LOG_NAME in includes/site.h to
keep the previous behavior.
[ISC-Bugs #38692]
- The Linux packet filter code now correctly treats only the least significant
12 bits in an inbound packet's TCI value as the VLAN id (per IEEE 802.1Q).
Prior to this it was using the entire 16 bit value as the VLAN id and
incorrectly discarding packets. Thanks to Jiri Popelka at Red Hat for
reporting this issue and supplying its patch.
[ISC-Bugs #40591]
- Fixed several static analysis issues such as potential null
references, unchecked strdup returns. Thanks to Bill Parker (wp02855 at
gmail dot com) who identified these issues and supplied patches to
address them.
[ISC-Bugs #40754]
[ISC-Bugs #40823]
- Corrected compilation errors that prohibited building the server
and its ATF unit tests when failover is disabled.
[ISC-Bugs #40372]
- Added the lease address to the end of the debug level log message
emitted when an existing lease is renewed within the dhcp-cache-threshold.
Thanks to Nathan Neulinger at Missouri S&T for suggesting the change.
[ISC-Bugs #40598]
- Added dhcpv6 and delayed-ack to settings listed in the "Features:"
section of the configure script output. Additionally, all of the
features reported on will now always show either a "yes" or "no"
value. Prior to this features left to their default setting would
not show a value.
[ISC-Bugs #40381]
- Added a parameter, authoring-byte-order, to the lease file. This value
is automatically added to the top of new lease files by the server and
indicates the internal byte order (big endian or little endian) of the
server. This permits lease files generated on a server with one form of
byte order to be used on a server with the opposite form. Our thanks to
Timothe Litt for calling this to our attention and for the suggestions
he provided.
[ISC-Bugs #38396]
- Fixed a small memory leak in the DHCPv6 version of the client code.
This is unlikely to cause significant issues in actual use.
[ISC-Bugs #40990]
- Corrected a few minor memory leaks in omapi's dereferencing of
host objects. Thanks to Jiri Popelka at Red Hat for reporting
the issue and supplying the patches.
[ISC-Bugs #33990]
[ISC-Bugs #41325]
- Cleaned up some of the Make infrastructure to make --with-libbind
work better. Though it still only works with an absolute path.
[ISC-Bugs #39210]
- Made the embedded bind libraries able to be cross compiled
(please refer to the bind9 documentation to learn how to cross
compile DHCP and its bind library dependency).
[ISC-Bugs #38836]
- Update the client code to better support getting IA_NAs and IA_PDs
in the same packet, see RFC7550 for some discussion.
[ISC-Bugs #40190]
! Update the bounds checking when receiving a packet.
Thanks to Sebastian Poehn from Sophos for the bug report and a suggested
patch.
[ISC-Bugs #41267]
CVE: CVE-2015-8605
- When handling an incorrect command line for dhcpd, dhclient or dhcrelay
print out a specific error message about the first error in addition
to the usage string. This may be disabled by editing includes/site.h.
[ISC-Bugs #40321]
[ISC-Bugs #41454]
- The configure script will now exit with an error message if it cannot find
a GNU-style make tool (needed when building BIND libraries) or pkg-config
(needed to locate ATF used for building unit tests). Prior to this the
script would exit indicating success causing subsequent attempts to build
the software to fail.
[ISC-Bugs #40371]
- Properly terminate strings before passing them to regex and fix
a boundary error when creating certain new data strings.
Thanks to Andrey Jr. Melnikov for the bug report.
[ISC-Bugs #41217]
- Option expressions, such as prepend and append, are now supported when
running dhclient for IPv6. Prior to this such statements in the
client configuration file would be parsed but have no affect. Thanks
to Jiri Popelka at Red Hat for reporting the issue.
[ISC-Bugs #39952]
- A failover primary server will now accept a binding status update from the
secondary which transitions a lease from ACTIVE to ABANDONED. This accounts
for instances in which a client declines a lease and only the secondary
server receives it. Prior to this the primary server would reject such an
update as an "invalid state transition".
[ISC_BUGS #25189]
- Properly allocate memory for a bpf filter.
Thanks to Bill Parker (wp02855 at gmail dot com) who identified this issue.
[ISC-Bugs #41485]
- Updated contrib/dhcp-lease-list.pl to handle garbage in the oui file better
and to print out the hostnames a bit better.
Thanks to Antoine Beaupré from Debian for the suggested patch.
[ISC-Bugs #41288]
- The DHCPv6 server now handles long valid and preferred lease times better.
Values that would cause the internal end time of the lease to wrap are
modified to work as infinite.
[ISC-Bugs #40773]
- Updated support for cross compiling by allowing the library archiver
to be set at configure time via the environment variable 'AR'.
[ISC-Bugs #41536]
- The server will now match DHCPv6 relayed clients to host declarations
which include the "hardware" statement, if the relay connected to the
client supplies the client's hardware address via client-linklayer-address
option as per RFC 6939.
[ISC-Bugs #40334]
- Allow a filename to be specified instead of /dev/random during
configuration. This is passed to the BIND configuration to allow
for cross compilation.
[ISC-Bugs #33835]
- Add more option definitions.
[ISC-Bugs #40562]
- Correct outputting of long lines in the lease file when writing
a lease that includes long strings in an execute statement.
[ISC-Bugs #40994]
- The server will now correctly treat a lease as reserved when the client
requests an infinite lease time (i.e. OxFFFFFFFF) and "infinite-is-reserved"
is enabled. Prior to this the server would halt. In addition, corrections
were made to the server to allow a lease's flags field to be set via omapi.
Prior to this, the server, depending on the host architecture, would
incorrectly parse the new flags value from the omapi message.
[ISC-Bugs #31179]
- ISC DHCP can now be configured and built from a directory other than
the top level source directory. Note that "make distcheck" uses this
feature.
[ISC-Bugs #39262]
- Add support for RFC 3527 to dhcrelay. A new, dhcrelay command line argument,
"-U <interface>" enables the addition of a RFC 3527 compliant link selection
suboption to the agent option added for clients directly connected to the
relay.
[ISC-Bugs #34875]
[ISC-Bugs #41708]
- Add a new global DHCPv6 option, dhcpv6-set-tee-times, which when enabled
instructs the server to calculate T1 and T2 as recommended in RFC 3315,
Section 22.4.
[ISC-Bugs #25687]
- Corrected minor Coverity issues.
[ISC-Bugs #35144]
- Add support for RFC 7341 DHCPv4 over DHCPv6 with a new configuration
option "--enable-dhcpv4o6". Note this feature requires DHCPv6 support
and is not compatible with delayed-ack. Both client and server use 2
processes which communicate over UDP on a pair of sockets. The new
"-4o6 <port>" command line argument enables DHCPv4 over DHCPv6 support
and specifies the consecutive ports to use for inter-process communication.
Please look at doc/DHCPv4-over-DHCPv6 for more details.
[ISC-Bugs #35711]
- Correct interface name formation when using DLPI under Solaris 11. As of
Solaris 11, ethernet device files are located in "/dev/net". The configure
script has been modified to detect this situation and adjust the directory
used accordingly. Thanks to Jarkko Torppa for reporting this issue and
submitting a patch
[ISC-Bugs #37954]
[ISC-Bugs #40752]
- Add a dereference call when handling an error condition while
decoding a packet.
[ISC-Bugs #41774]
- Add a new parameter, lease-id-format, to both dhcpd and dhclient. The
parameter controls the format in which certain values are written to lease
files. Formats supported are octal - quoted string containing octal
escapes, and hex - unquoted, colon separated hex digits. Thanks to
Jay Ford, University of Iowa for bringing the issue to our attention.
[ISC-Bugs #26378]
! Add an option in site.h to limit the number of failover and control
connections the server will accept. By default this is 200.
[ISC-Bugs #41845]
CVE: CVE-2016-2774
* [Sec 3454] Unauthenticated packet can reset authenticated interleave
associations. HStenn.
* [Sec 3453] Interleaved symmetric mode cannot recover from bad state. HStenn.
* [Sec 3415] Permit blocking authenticated symmetric/passive associations.
Implement ippeerlimit. HStenn, JPerlinger.
* [Sec 3414] ntpq: decodearr() can write beyond its 'buf' limits
- initial patch by <stenn@ntp.org>, extended by <perlinger@ntp.org>
* [Sec 3412] ctl_getitem(): Don't compare names past NUL. <perlinger@ntp.org>
* [Sec 3012] Sybil vulnerability: noepeer support. HStenn, JPerlinger.
* [Bug 3457] OpenSSL FIPS mode regression <perlinger@ntp.org>
* [Bug 3455] ntpd doesn't use scope id when binding multicast <perlinger@ntp.org>
- applied patch by Sean Haugh
* [Bug 3452] PARSE driver prints uninitialized memory. <perlinger@ntp.org>
* [Bug 3450] Dubious error messages from plausibility checks in get_systime()
- removed error log caused by rounding/slew, ensured postcondition <perlinger@ntp.org>
* [Bug 3447] AES-128-CMAC (fixes) <perlinger@ntp.org>
- refactoring the MAC code, too
* [Bug 3441] Validate the assumption that AF_UNSPEC is 0. stenn@ntp.org
* [Bug 3439] When running multiple commands / hosts in ntpq... <perlinger@ntp.org>
- applied patch by ggarvey
* [Bug 3438] Negative values and values > 999 days in... <perlinger@ntp.org>
- applied patch by ggarvey (with minor mods)
* [Bug 3437] ntpd tries to open socket with AF_UNSPEC domain
- applied patch (with mods) by Miroslav Lichvar <perlinger@ntp.org>
* [Bug 3435] anchor NTP era alignment <perlinger@ntp.org>
* [Bug 3433] sntp crashes when run with -a. <stenn@ntp.org>
* [Bug 3430] ntpq dumps core (SIGSEGV) for "keytype md2"
- fixed several issues with hash algos in ntpd, sntp, ntpq,
ntpdc and the test suites <perlinger@ntp.org>
* [Bug 3424] Trimble Thunderbolt 1024 week millenium bug <perlinger@ntp.org>
- initial patch by Daniel Pouzzner
* [Bug 3423] QNX adjtime() implementation error checking is
wrong <perlinger@ntp.org>
* [Bug 3417] ntpq ifstats packet counters can be negative
made IFSTATS counter quantities unsigned <perlinger@ntp.org>
* [Bug 3411] problem about SIGN(6) packet handling for ntp-4.2.8p10
- raised receive buffer size to 1200 <perlinger@ntp.org>
* [Bug 3408] refclock_jjy.c: Avoid a wrong report of the coverity static
analysis tool. <abe@ntp.org>
* [Bug 3405] update-leap.in: general cleanup, HTTPS support. Paul McMath.
* [Bug 3404] Fix openSSL DLL usage under Windows <perlinger@ntp.org>
- fix/drop assumptions on OpenSSL libs directory layout
* [Bug 3399] NTP: linker error in 4.2.8p10 during Linux cross-compilation
- initial patch by timeflies@mail2tor.com <perlinger@ntp.org>
* [Bug 3398] tests fail with core dump <perlinger@ntp.org>
- patch contributed by Alexander Bluhm
* [Bug 3397] ctl_putstr() asserts that data fits in its buffer
rework of formatting & data transfer stuff in 'ntp_control.c'
avoids unecessary buffers and size limitations. <perlinger@ntp.org>
* [Bug 3394] Leap second deletion does not work on ntpd clients
- fixed handling of dynamic deletion w/o leap file <perlinger@ntp.org>
* [Bug 3391] ntpd segfaults on startup due to small warmup thread stack size
- increased mimimum stack size to 32kB <perlinger@ntp.org>
* [Bug 3367] Faulty LinuxPPS NMEA clock support in 4.2.8 <perlinger@ntp.org>
- reverted handling of PPS kernel consumer to 4.2.6 behavior
* [Bug 3365] Updates driver40(-ja).html and miscopt.html <abe@ntp.org>
* [Bug 3358] Spurious KoD log messages in .INIT. phase. HStenn.
* [Bug 3016] wrong error position reported for bad ":config pool"
- fixed location counter & ntpq output <perlinger@ntp.org>
* [Bug 2900] libntp build order problem. HStenn.
* [Bug 2878] Tests are cluttering up syslog <perlinger@ntp.org>
* [Bug 2737] Wrong phone number listed for USNO. ntp-bugs@bodosom.net,
perlinger@ntp.org
* [Bug 2557] Fix Thunderbolt init. ntp-bugs@bodosom.net, perlinger@ntp.
* [Bug 948] Trustedkey config directive leaks memory. <perlinger@ntp.org>
* Use strlcpy() to copy strings, not memcpy(). HStenn.
* Typos. HStenn.
* test_ntp_scanner_LDADD needs ntpd/ntp_io.o. HStenn.
* refclock_jjy.c: Add missing "%s" to an msyslog() call. HStenn.
* Build ntpq and libntpq.a with NTP_HARD_*FLAGS. perlinger@ntp.org
* Fix trivial warnings from 'make check'. perlinger@ntp.org
* Fix bug in the override portion of the compiler hardening macro. HStenn.
* record_raw_stats(): Log entire packet. Log writes. HStenn.
* AES-128-CMAC support. BInglis, HStenn, JPerlinger.
* sntp: tweak key file logging. HStenn.
* sntp: pkt_output(): Improve debug output. HStenn.
* update-leap: updates from Paul McMath.
* When using pkg-config, report --modversion. HStenn.
* Clean up libevent configure checks. HStenn.
* sntp: show the IP of who sent us a crypto-NAK. HStenn.
* Allow .../N to specify subnet bits for IPs in ntp.keys. HStenn, JPerlinger.
* authistrustedip() - use it in more places. HStenn, JPerlinger.
* New sysstats: sys_lamport, sys_tsrounding. HStenn.
* Update ntp.keys .../N documentation. HStenn.
* Distribute testconf.yml. HStenn.
* Add DPRINTF(2,...) lines to receive() for packet drops. HStenn.
* Rename the configuration flag fifo variables. HStenn.
* Improve saveconfig output. HStenn.
* Decode restrict flags on receive() debug output. HStenn.
* Decode interface flags on receive() debug output. HStenn.
* Warn the user if deprecated "driftfile name WanderThreshold" is used. HStenn.
* Update the documentation in ntp.conf.def . HStenn.
* restrictions() must return restrict flags and ippeerlimit. HStenn.
* Update ntpq peer documentation to describe the 'p' type. HStenn.
* Rename restrict 'flags' to 'rflags. Use an enum for the values. HStenn.
* Provide dump_restricts() for debugging. HStenn.
* Use consistent 4th arg type for [gs]etsockopt. JPerlinger.
* Some tests might need LIBM. HStenn.
* update-leap: Allow -h/--help early. HStenn.
* dhcp6: fix a null termination overflow on status messages
* options: static routes can be setup in global context again
* routes: dhcpcd added host routes are now reported correctly
* Added support for setproctitle(3)
* Kernel RA is no longer disabled when IPv6 is disabled in dhcpcd
* DHCPv6 PD is no longer stopped if no Routers are found
* If the DHCP leased address is deleted, enter the reboot state
* DHCPv6 unicast is no longer performed when not in master mode
* dhcpcd will now detect netlink/route socket overflows ad re-sync
that are needed by the new dtrace. these don't do anything yet,
but dtrace doesn't mind. I'll do a full resync to the latest FreeBSD
libproc / librtld_db later.
Dec 11, 2017
Bugfixes
ignore fallthrough compiler warning in flex EOF rule.
Fix warnings emitted by clang for --enable-packed. Alignment is not a problem for x86_64, don't enable packed when the platform requires aligned access.
Fix spelling error in xfr-inspect.
Fix 3392: Fix regression in 4.1.18 for notify lists with ip4 and ip6 targets.
Add test for support of -Wno-address-of-packed-member for --enable-packed.
NSD 4.1.18
Nov 30, 2017
Features
xfr-inspect, it is not installed, it prints xfr files from /tmp made with 'make xfr-inspect' in the source dir.
retry timeout between sending notifies dropped from 15 to 3 sec.
NSD sends 16 notifies simultaneously.
configure --enable-packed reduces memory usage, at expense of unaligned reads. Saves about 17%.
Save memory by selectively allocate precompiled nsec3 hashes, saves about 16% memory.
make ip-transparent option work on OpenBSD.
Save about 2% memory by changing usage count size in name tree.
Fix#2871: Increase number of sockets for xfrd transfers.
Bugfixes
Fix gcc 7.1.1 warnings.
Fix writev compile warning on FreeBSD.
Fix#1446: A corrupted zone file "propagates" to good ones.
nsd-control zonestatus prints wait time between attempts, for zones that are in that waiting time.
Fix collision printout of nsec3 to print name, hash and reverse.
Fix#1567: Change crit to err log level for gettimeofday failure. Add defines for compile without syslog.
Fix crash for DS query when parent and child zones both configured in nsd.conf and parent zone has not loaded properly.
NSD 4.1.17
Jul 21, 2017
Features
zone parser parses type AVC (it has TXT format).
Fix#1272: use writev to put tcp length field with data for outgoing zone transfer requests.
Bugfixes
Fix potential null pointer in nsec3 adjustment tree.
Fix text format of deletes for CDS and CDNSKEY, single 0 to represent empty base64 or hex string.
NSD 4.1.16
Apr 25, 2017
Features
zone parser can parse acronyms for algorithms ED25519 and ED448.
Fix 1243: Option to make NSD emit really minimal responses, minimal-responses: yes in nsd.conf.
Bugfixes
Calculate new udb index after growing the array, fix from Chaofeng Liu.
Fix missing _t to _type conversion for disable-radix-tree option.
Printout serial error with hint it may be too big.
Fix 1228: OpenSSL include is not guarded with HAVE_SSL
Patch for expire state in multi-master when masters includes broken master, from Manabu Sonoda.
minor manpage fix.
NSD 4.1.15
Feb 16, 2017
Bugfixes
Fix nsd-control and ipv6 only.
Squelch zone transfer error address family not supported by protocol at low verbosity levels.
Fix#1195: Fix so that NSD fails on non-compliant values for Serial.
Fix to rename _t typedefs because POSIX reserves them.
Fix that nsec3 hash collisions only reported on verbosity level 3.
Download: unbound-1.6.8.tar.gz
SHA1 checksum: 492737be9647c26ee39d4d198f2755062803b412
SHA256 checksum: e3b428e33f56a45417107448418865fe08d58e0e7fea199b855515f60884dd49
PGP signature: unbound-1.6.8.tar.gz.asc
Date: 19 Jan, 2018
Bug Fixes
Fix for CVE-2017-15105: vulnerability in the processing of wildcard synthesized NSEC records.
Older versions
Unbound 1.6.7
Download: unbound-1.6.7.tar.gz
SHA1 checksum: 098f8acfc3e9d1cab54f07863e61eabbb67c80dc
SHA256 checksum: 4e7bd43d827004c6d51bef73adf941798e4588bdb40de5e79d89034d69751c9f
PGP signature: unbound-1.6.7.tar.gz.asc
Date: 10 Oct, 2017
Features
Set trust-anchor-signaling default to yes
#1440: [dnscrypt] client nonce cache.
#1435: Allow UDP to be disabled separately upstream and downstream.
Bug Fixes
Fix that looping modules always stop the query, and don't pass control.
Fix unbound-host to report error for DNSSEC state of failed lookups.
Spelling fixes, from Josh Soref.
Fix#1400: allowing use of global cache on ECS-forwarding unless always-forward.
use a cachedb answer even if it's "expired" when serve-expired is yes (patch from Jinmei Tatuya).
trigger refetching of the answer in that case (this will bypass cachedb lookup)
allow storing a 0-TTL answer from cachedb in the in-memory message cache when serve-expired is yes
Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
Log name of looping module
Fix#1450: Generate again patch contrib/aaaa-filter-iterator.patch (by Danilo G. Baio).
Fix param unused warning for windows exportsymbol compile.
Use RCODE from A query on DNS64 synthesized answer.
Fix trust-anchor-signaling works in libunbound.
Fix spelling in unbound-control man page.
Unbound 1.6.6
Download: unbound-1.6.6.tar.gz
SHA1 checksum: d205c03a402f5d900d5bad3d036849a12804a49e
SHA256 checksum: 972b14dc33093e672652a7b2b5f159bab2198b0fe9c9e1c5707e1895d4d4b390
PGP signature: unbound-1.6.6.tar.gz.asc
Date: 18 Sep, 2017
Features
unbound-control dump_infra prints port number for address if not 53.
Fix#1344: RFC6761-reserved domains: test. and invalid.
Fix#1349: allow suppression of pidfiles (from Daniel Kahn Gillmor). With the -p option unbound does not create a pidfile.
Added stats for queries that have been ratelimited by domain recursion.
Patch to show DNSCrypt status in help output, from Carsten Strotmann.
Fix#1407: Add ECS options check to unbound-checkconf.
Fix#1415: [dnscrypt] shared secret cache, patch from Manu Bretelle.
Bug Fixes
fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
First fix for zero b64 and hex text zone format in sldns.
Better fixup of dnscrypt_cert_chacha test for different escapes.
Fix that infra cache host hash does not change after reconfig.
Fix python example0 return module wait instead of error for pass.
enhancement for hardened-tls for DNS over TLS. Removed duplicated security settings.
Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned on.
Fix#1331: libunbound segfault in threaded mode when context is deleted.
Fix pythonmod link line option flag.
Fix openssl 1.1.0 load of ssl error strings from ssl init.
Fix 1332: Bump verbosity of failed chown'ing of the control socket.
Redirect all localhost names to localhost address for RFC6761.
Fix#1350: make cachedb backend configurable (from JINMEI Tatuya).
Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02), config.sub(2016-09-05).
annotate case statement fallthrough for gcc 7.1.1.
flex output from flex 2.6.1.
snprintf of thread number does not warn about truncated string.
squelch TCP fast open error on FreeBSD when kernel has it disabled, unless verbosity is high.
remove warning from windows compile.
Fix compile with libnettle
Fix DSA configure switch (--disable dsa) for libnettle and libnss.
Fix#1365: Add Ed25519 support using libnettle.
Fix#1394: mix of serve-expired and response-ip could cause a crash.
Remove unused iter_env member (ip6arpa_dname)
Do not reset rrset.bogus stats when called using stats_noreset.
Do not add rrset_bogus and query ratelimiting stats per thread, these module stats are global.
Fix#1397: Recursive DS lookups for AS112 zones names should recurse.
Fix#1398: make cachedb secret configurable.
Remove spaces from Makefile.
Fix issue on macOX 10.10 where TCP fast open is detected but not implemented causing TCP to fail. The fix allows fallback to regular TCP in this case and is also more robust for cases where connectx() fails for some reason.
Fix#1402: squelch invalid argument error for fd_set_block on windows.
Fix to reclaim tcp handler when it is closed due to dnscrypt buffer allocation failure.
Fix#1415: patch to free dnscrypt environment on reload.
iana portlist update
Small fixes for the shared secret cache patch.
Fix WKS records on kvm autobuild host, with default protobyname entries for udp and tcp.
Fix#1414: fix segfault on parse failure and log_replies.
zero qinfo in handle_request, this zeroes local_alias and also the qname member.
new keys and certs for dnscrypt tests.
fixup WKS test on buildhost without servicebyname.
updated contrib/fastrpz.patch to apply with configparser changes.
Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
Fix#1424: cachedb:testframe is not thread safe.
Fix#1417: [dnscrypt] shared secret cache counters, and works when dnscrypt is not enabled. And cache size configuration option.
Fix#1418: [ip ratelimit] initialize slabhash using ip-ratelimit-slabs.
Recommend 1472 buffer size in unbound.conf
Fix#1412: QNAME minimisation strict mode not honored
Fix#1434: Fix windows openssl 1.1.0 linking.
Add dns64 for client-subnet in unbound-checkconf.
Unbound 1.6.5
Download: unbound-1.6.5.tar.gz
SHA1 checksum: ecb260b94d139d84fae2bff80f9701f53a329e26
SHA256 checksum: e297aa1229015f25bf24e4923cb1dadf1f29b84f82a353205006421f82cc104e
PGP signature: unbound-1.6.5.tar.gz.asc
Date: 21 Aug, 2017
Bug Fixes
Fix install of trust anchor when two anchors are present, makes both valid. Checks hash of DS but not signature of new key. This fixes the root.key file if created when unbound is installed between sep11 and oct11 2017.
Unbound 1.6.4
Download: unbound-1.6.4.tar.gz
SHA1 checksum: 836ecc48518b9159f600a738c276423ef1f95021
SHA256 checksum: df0a88816ec31ccb8284c9eb132e1166fbf6d9cde71fbc4b8cd08a91ee777fed
PGP signature: unbound-1.6.4.tar.gz.asc
Date: 27 Jun, 2017
Features
Implemented trust anchor signaling using key tag query.
unbound-checkconf -o allows query of dnstap config variables. Also unbound-control get_option. Also for dnscrypt.
unbound.h exports the shm stats structures. They use type long long and no ifdefs, and ub_ before the typenames.
Implemented opportunistic IPsec support module (ipsecmod).
Added redirect-bogus.patch to contrib directory.
Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
renumbering B-Root's IPv6 address to 2001:500:200::b.
Fix#1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
Fix#1277: disable domain ratelimit by setting value to 0.
Added fastrpz patch to contrib
Bug Fixes
Added ECS unit test (from Manu Bretelle).
ECS documentation fix (from Manu Bretelle).
Fix#1252: more indentation inconsistencies.
Fix#1253: unused variable in edns-subnet/addrtree.c:getbit().
Fix#1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
iana portlist update
Based on #1257: check parse limit before t increment in sldns RR string parse routine.
Fix#1258: Windows 10 X64 unbound 1.6.2 service will not start. and fix that 64bit getting installed in C:\Program Files (x86).
Fix#1259: "--disable-ecdsa" argument overwritten by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
iana portlist update
Added test for leak of stub information.
Fix sldns wire2str printout of RR type CAA tags.
Fix sldns int16_data parse.
Fix sldns parse and printout of TSIG RRs.
sldns SMIMEA and AVC definitions, same as getdns definitions.
Fix tcp-mss failure printout text.
Set SO_REUSEADDR on outgoing tcp connections to fix the bind before connect limited tcp connections. With the option tcp connections can share the same source port (for different destinations).
Add 'c' to getopt() in testbound.
Adjust servfail by iterator to not store in cache when serve-expired is enabled, to avoid overwriting useful information there.
Fix queries for nameservers under a stub leaking to the internet.
document trust-anchor-signaling in example config file.
updated configure, dependencies and flex output.
better module memory lookup, fix of unbound-control shm names for module memory printout of statistics.
Fix type AVC sldns rrdef.
Some whitespace fixup.
Fix#1265: contrib/unbound.service contains hardcoded path.
Fix#1265 to use /bin/kill.
Fix#1267: Libunbound validator/val_secalgo.c uses obsolete APIs, and compatibility with BoringSSL.
Fix#1268: SIGSEGV after log_reopen.
exec_prefix is by default equal to prefix.
printout localzone for duplicate local-zone warnings.
Fix assertion for low buffer size and big edns payload when worker overrides udpsize.
Support for openssl EVP_DigestVerify.
Fix#1269: inconsistent use of built-in local zones with views.
Add defaults for new local-zone trees added to views using unbound-control.
Fix#1273: cachedb.c doesn't compile with -Wextra.
If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
Also use global local-zones when there is a matching view that does not have any local-zone specified.
Fix fastopen EPIPE fallthrough to perform connect.
Fix#1274: automatically trim chroot path from dnscrypt key/cert paths (from Manu Bretelle).
Fix#1275: cached data in cachedb is never used.
Fix that unbound-control can set val_clean_additional and val_permissive_mode.
Add dnscrypt XChaCha20 tests.
Detect chacha for dnscrypt at configure time.
dnscrypt unit tests with chacha.
Added domain name based ECS whitelist.
Fix#1278: Incomplete wildcard proof.
Fix#1279: Memory leak on reload when python module is enabled.
Fix#1280: Unbound fails assert when response from authoritative contains malformed qname. When 0x20 caps-for-id is enabled, when assertions are not enabled the malformed qname is handled correctly.
More fixes in depth for buffer checks in 0x20 qname checks.
Fix stub zone queries leaking to the internet for harden-referral-path ns checks.
Fix query for refetch_glue of stub leaking to internet.
Fix#1301: memory leak in respip and tests.
Free callback in edns-subnetmod on exit and restart.
Fix memory leak in sldns_buffer_new_frm_data.
Fix memory leak in dnscrypt config read.
Fix dnscrypt chacha cert support ifdefs.
Fix dnscrypt chacha cert unit test escapes in grep.
Fix to unlock view in view test.
Fix warning in pythonmod under clang compiler.
Fix lintian typo.
Fix#1316: heap read buffer overflow in parse_edns_options.
Unbound 1.6.3
Download: unbound-1.6.3.tar.gz
SHA1 checksum: 4477627c31e8728058565f3bae3a12a1544d8a9c
SHA256 checksum: 4c7e655c1d0d2d133fdeb81bc1ab3aa5c155700f66c9f5fb53fa6a5c3ea9845f
PGP signature: unbound-1.6.3.tar.gz.asc
Date: 13 Jun, 2017
Bug Fixes
Fix#1280: Unbound fails assert when response from authoritative contains malformed qname. When 0x20 caps-for-id is enabled, when assertions are not enabled the malformed qname is handled correctly.
Unbound 1.6.2
Download: unbound-1.6.2.tar.gz
SHA1 checksum: de370b1ac8e260db9c4c1504453752713dd8818f
SHA256 checksum: 1a323d72c32180b7141c9e6ebf199fc68a0208dfebad4640cd2c4c27235e3b9c
PGP signature: unbound-1.6.2.tar.gz.asc
Date: 24 Apr, 2017
Features
Add trustanchor.unbound CH TXT that gets a response with a number of TXT RRs with a string like "example.com. 2345 1234" with the trust anchors and their keytags.
Patch for view functionality for local-data-ptr from Björn Ketelaars.
Response actions based on IP address from Jinmei Tatuya (Infoblox).
Patch from Luiz Fernando Softov for Stats Shared Memory.
unbound-control stats_shm command prints stats using shared memory, which uses less cpu.
--disable-sha1 disables SHA1 support in RRSIG, so from DNSKEY and DS records. NSEC3 is not disabled.
#1217. DNSCrypt support, with --enable-dnscrypt, libsodium and then enabled in the config file from Manu Bretelle.
Merge EDNS Client subnet implementation from feature branch into main branch, using new EDNS processing framework.
harden-algo-downgrade: no also makes unbound more lenient about digest algorithms in DS records.
Bug Fixes
sldns has ED25519 and ED448 algorithm number and name for display.
sldns updated for vfixed and buffer resize indication from getdns.
iana portlist update
Fix#1224: Fix that defaults should not fall back to "Program Files (x86) if Unbound is 64bit by default on windows.
Fix doc/CNAME-basedRedirectionDesignNotes.pdf zone static to redirect.
make depend, autoconf, doxygen and lint fixed up.
include sys/time.h for new shm code on NetBSD.
Fix#1227: Fix that Unbound control allows weak ciphersuits.
Fix#1226: provide official 32bit binary for windows.
For #1227: if we have sha256, set the cipher list to have no known vulns.
Fix testpkts.c, check if DO bit is set, not only if there is an OPT record.
Fix#1229: Systemd service sandboxing in contrib/unbound.service.
Fix#1230: swig version 2.0.1 is required for pythonmod, with 1.3.40 it crashes when running repeatly unbound-control reload.
fix enum conversion warnings
fake-sha1 test option; print warning if used. To make unit tests.
unbound-control list local zone and data commands listed in the help output.
Fix#1234: shortening DNAME loop produces duplicate DNAME records in ANSWER section.
testbound understands Deckard MATCH rcode question answer commands.
Fix#1235: Fix too long DNAME expansion produces SERVFAIL instead of YXDOMAIN + query loop, reported by Petr Spacek.
Fix that SHM is not inited if not enabled.
Fix that looped DNAMEs do not cause unbound to spend effort.
trustanchor tags are sorted. reusable routine to fetch taglist.
Fix#1237 - Wrong resolving in chain, for norec queries that get SERVFAIL returned.
make depend, autoconf, remove warnings about statement before var.
lru_demote and lruhash_insert_or_retrieve functions for getdns.
fixup for lruhash (whitespace and header file comment).
dnscrypt tests.
Fix doxygen for dnscrypt files.
Fix#1238: segmentation fault when adding through the remote interface a per-view local zone to a view with no previous (configured) local zones.
Fix#1229: Systemd service sandboxing, options in wrong sections.
Fix#1239: configure fails to find python distutils if python prints warning.
Fix to prevent non-referal query from being cached as referal when the no_cache_store flag was set.
Remove (now unused) event2 include from dnscrypt code.
Fix#1217: Add metrics to unbound-control interface showing crypted, cert request, plaintext and malformed queries (from Manu Bretelle).
Do not add current time twice to TTL before ECS cache store.
Do not touch rrset cache after ECS cache message generation.
Use LDNS_EDNS_CLIENT_SUBNET as default ECS opcode.
Fix#1244: document that use of chroot requires trust anchor file to be under chroot.
Small fixup for documentation.
Fix respip for braces when locks arent used.
Fix pythonmod for cb changes.
Generalise inplace callback (de)registration
(de)register inplace callbacks for module id
No unbound-control set_option for ECS options
Deprecated client-subnet-opcode config option
Introduced client-subnet-always-forward config option
Changed max-client-subnet-ipv6 default to 56 (as in RFC)
Removed extern ECS config options
module_restart_next now calls clear on all following modules
Also create ECS module qstate on module_event_pass event
remove malloc from inplace_cb_register
Unlock view in respip unit test
Some whitespace fixup.
Remove ECS option after REFUSED answer.
Fix small memory leak in edns_opt_copy_alloc.
Respip dereference after NULL check.
Zero initialize addrtree allocation.
Use correct identifier for SHM destroy.
Display ECS module memory usage.
Fix#1247: unbound does not shorten source prefix length when forwarding ECS.
Properly check for allocation failure in local_data_find_tag_datas.
Fix#1249: unbound doesn't return FORMERR to bogus ECS.
Set SHM ECS memory usage to 0 when module not loaded.
subnet mem value is available in shm, also when not enabled, to make the struct easier to memmap by other applications, independent of the configuration of unbound.
Fix#1250: inconsistent indentation in services/listen_dnsport.c.
Unbound 1.6.1
Download: unbound-1.6.1.tar.gz
SHA1 checksum: 41369fcfd37844b02b7293b37ec78e69f0db34c7
SHA256 checksum: 42df63f743c0fe8424aeafcf003ad4b880b46c14149d696057313f5c1ef51400
PGP signature: unbound-1.6.1.tar.gz.asc
Date: 21 Feb, 2017
Features
configure --enable-systemd and lets unbound use systemd sockets if you enable use-systemd: yes in unbound.conf. Also there are contrib/unbound.socket and contrib/unbound.service: systemd files for unbound, install them in /usr/lib/systemd/system. Contributed by Sami Kerola and Pavel Odintsov.
[bugzilla: 1187 ]
Source IP rate limiting, patch from Larissa Feng.
[bugzilla: 1184 ]
Log DNS replies. This includes the same logging information that DNS queries and response code and response size, patch from Larissa Feng.
Include root trust anchor id 20326 in unbound-anchor.
64bit is default for windows builds.
Bug Fixes
[bugzilla: 1176 ]
Fix stack size too small for Alpine Linux.
Fix unbound-control and ipv6 only.
[bugzilla: 1182 ]
Fix Resource leak (socket), at startup.
[bugzilla: 1178 ]
Fix attempt to fix setup error at end, pop result values at end of install.
iana portlist update
Fix inet_ntop and inet_pton warnings in windows compile.
[bugzilla: 1191 ]
Fix remove comment about view deletion.
[bugzilla: 1188 ]
Fix unresolved symbol 'fake_dsa' in libunbound.so when built with Nettle
[bugzilla: 1190 ]
Fix to not echo back EDNS options in local-zone error response.
[bugzilla: 1194 ]
Fix if cross build fails when $host isn't `uname` for getentropy.
Fix reload chdir failure when also chrooted to that directory.
Fix to return formerr for queries for meta-types, to avoid packet amplification if this meta-type is sent on to upstream.
[bugzilla: 1201 ]
Fix missing unlock in answer_from_cache error condition.
[bugzilla: 1202 ]
Fix code comment that packed_rrset_data is not always 'packed'.
Fix to also block meta types 128 through to 248 with formerr.
[bugzilla: 1206 ]
Fix that some view-related commands are missing from 'unbound-control -h'
Fix to rename ub_callback_t to ub_callback_type, because POSIX reserves _t typedefs.
Fix to rename internally used types from _t to _type, because _t type names are reserved by POSIX.
Increase MAX_MODULE to 16.
[bugzilla: 1211 ]
Fix can't enable interface-automatic if no IPv6 with more helpful error message.
fix root_anchor test for updated icannbundle.pem lower certificates.
Fix compile on solaris of the fix to use $host detect.
Fix for type name change and fix warning on windows compile.
Fix pythonmod for typedef changes.
Fix dnstap for warning of set but not used.
Fix autoconf of systemd check for lack of pkg-config.
Unbound 1.6.0
Download: unbound-1.6.0.tar.gz
SHA1 checksum: 9b7606b016b447dc837efc108cee94f3fecf4ede
SHA256 checksum: 6b7db874e6debda742fee8869d722e5a17faf1086e93c911b8564532aeeffab7
PGP signature: unbound-1.6.0.tar.gz.asc
Date: 15 Dec, 2016
Features
Added generic EDNS code for registering known EDNS option codes, bypassing the cache response stage and uniquifying mesh states. Four EDNS option lists were added to module_qstate (module_qstate.edns_opts_*) to store EDNS options from/to front/back side.
Added two flags to module_qstate (no_cache_lookup, no_cache_store) that control the modules' cache interactions.
Added code for registering inplace callback functions. The registered functions can be called just before replying with local data or Chaos, replying from cache, replying with SERVFAIL, replying with a resolved query, sending a query to a nameserver. The functions can inspect the available data and maybe change response/query related data (i.e. append EDNS options).
Updated Python module for the above.
Updated Python documentation.
Added views functionality.
Added qname-minimisation-strict config option.
Patch that resolves CNAMEs entered in local-data conf statements that point to data on the internet, from Jinmei Tatuya (Infoblox).
serve-expired config option: serve expired responses with TTL 0.
.gitattributes line for githubs code language display.
log-identity: config option to set sys log identity, patch from "Robin H. Johnson" (robbat2@gentoo.org).
Added stub-ssl-upstream and forward-ssl-upstream options.
Added local-zones and local-data bulk addition and removal functionality in unbound-control (local_zones, local_zones_remove, local_datas and local_datas_remove).
Bug Fixes
Fix#836: unbound could echo back EDNS options in an error response.
Fix#838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX.
Fix#839: Memory grows unexpectedly with large RPZ files.
Fix#840: infinite loop in unbound_munin_ plugin on unowned lockfile.
Fix#841: big local-zone's make it consume large amounts of memory.
Fix dnstap relaying "random" messages instead of resolver/forwarder responses, from Nikolay Edigaryev.
Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav.
Fix#1117: spelling errors, from Robert Edmonds.
iana portlist update.
fix memoryleak logfile when in debug mode.
Re-fix #839 from view commit overwrite.
Fixup const void cast warning.
Removed patch comments from acllist.c and msgencode.c
Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf, from Jinmei Tatuya (Infoblox).
Fix#1125: unbound could reuse an answer packet incorrectly for clients with different EDNS parameters, from Jinmei Tatuya.
Fix#1118: libunbound.pc sets strange Libs, Libs.private values.
Added Requires line to libunbound.pc
Fix#1130: whitespace in example.conf.in more consistent.
suppress compile warning in lex files.
init lzt variable, for older gcc compiler warnings.
fix --enable-dsa to work, instead of copying ecdsa enable.
Fix DNSSEC validation of query type ANY with DNAME answers.
Fixup query_info local_alias init.
Ported tests for local_cname unit test to testbound framework.
g.root-servers.net has AAAA address.
Fix#1134: unbound-control set_option -- val-override-date: -1 works immediately to ignore datetime, or back to 0 to enable it again. The -- is to ignore the '-1' as an option flag.
Patch for server.num.zero_ttl stats for count of expired replies, from Pavel Odintsov.
Fix failure to build on arm64 with no sbrk.
Set OpenSSL security level to 0 when using aNULL ciphers.
configure detects ssl security level API function in the autoconf manner. Every function on its own, so that other libraries (eg. LibreSSL) can develop their API without hindrance.
Fix#1154: segfault when reading config with duplicate zones.
Note that for harden-below-nxdomain the nxdomain must be secure, this means nsec3 with optout is insufficient.
Fix#1155: test status code of unbound-control in 04-checkconf, not the status code from the tee command.
Fix#1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing Underneath" for the harden-below-nxdomain option.
patch from Dag-Erling Smorgrav that removes code that relies on sbrk().
Make access-control-tag-data RDATA absolute. This makes the RDATA origin consistent between local-data and access-control-tag-data.
Fix NSEC ENT wildcard check. Matching wildcard does not have to be a subdomain of the NSEC owner.
QNAME minimisation uses QTYPE=A, therefore always check cache for this type in harden-below-nxdomain functionality.
Added unit test for QNAME minimisation + harden below nxdomain synergy.
Fix that with openssl 1.1 control-use-cert: no uses less cpu, by using no encryption over the unix socket.
hyphen as minus fix, by Andreas Schulze
Fix#1170: document that 'inform' local-zone uses local-data.
Fix#1173: differ local-zone type deny from unset tag_actions element.
Add DSA support for OpenSSL 1.1.0
Fix remote control without cert for LibreSSL
Fix downcast warnings from visual studio in sldns code.
Unbound 1.5.10
Download: unbound-1.5.10.tar.gz
SHA1 checksum: 6102849c400db3a4195b1f16df8f312568a6ec57
SHA256 checksum: a39b8b4fcca2a2b35a2daa53fe35150cc3f09038dc9acede09c912fc248a9486
PGP signature: unbound-1.5.10.tar.gz.asc
Date: 27 Sep, 2016
Features
Create a pkg-config file for libunbound in contrib.
TCP Fast open patch from Sara Dickinson.
Finegrained localzone control with define-tag, access-control-tag, access-control-tag-action, access-control-tag-data, local-zone-tag, and local-zone-override. And added types always_transparent, always_refuse, always_nxdomain with that.
If more than half of tcp connections are in use, a shorter timeout is used (200 msec, vs 2 minutes) to pressure tcp for new connects.
[bugzilla: 787 ]
Fix#787: outgoing-interface netblock/64 ipv6 option to use linux freebind to use 64bits of entropy for every query with random local part.
For #787: prefer-ip6 option for unbound.conf prefers to send upstream queries to ipv6 servers.
Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e.
keep debug symbols in windows build.
Bug Fixes
[bugzilla: 778 ]
Fix unbound 1.5.9: -h segfault (null deref).
Fix unbound-anchor.exe file location defaults to Program Files with (x86) appended.
Fix to not ignore return value of chown() in daemon startup.
Better help text from -h (from Ray Griffith).
[bugzilla: 773 ]
Fix Non-standard Python location build failure with pyunbound.
Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures.
Revert fix for NetworkService account on windows due to breakage it causes.
Fix that windows install will not overwrite existing service.conf file (and ignore gui config choices if it exists).
And delete service.conf.shipped on uninstall.
In unbound.conf directory: dir immediately changes to that directory, so that include: file below that is relative to that directory. With chroot, make the directory an absolute path inside chroot.
do not delete service.conf on windows uninstall.
document directory immediate fix and allow EXECUTABLE syntax in it on windows.
Fix directory: fix for unbound-checkconf, it restores cwd.
Use QTYPE=A for QNAME minimisation.
Keep track of number of time-outs when performing QNAME minimisation. Stop minimising when number of time-outs for a QNAME/QTYPE pair is more than three.
[bugzilla: 775 ]
Fix unbound-host and unbound-anchor crash on windows, ignore null delete for wsaevent.
Fix spelling in freebind option man page text.
Fix windows link of ssl with crypt32.
[bugzilla: 779 ]
Fix Union casting is non-portable.
[bugzilla: 780 ]
Fix MAP_ANON not defined in HP-UX 11.31.
[bugzilla: 781 ]
Fix prealloc() is an HP-UX system library call.
Decrease dp attempts at each QNAME minimisation iteration
[bugzilla: 784 ]
Fix Build configure assumess that having getpwnam means there is endpwent function available.
Updated repository with newer flex and bison output.
Fix static compile on windows missing gdi32.
Fix dynamic link of anchor-update.exe on windows.
Fix detect of mingw for MXE package build.
Fixes for 64bit windows compile.
[bugzilla: 788 ]
Fix for nettle 3.0: Failed to build with Nettle >= 3.0 and --with-libunbound-only --with-nettle.
Fixed unbound.doxygen for 1.8.11.
[bugzilla: 798 ]
Fix Client-side TCP fast open fails (Linux).
[bugzilla: 801 ]
Fix missing error condition handling in daemon_create_workers().
[bugzilla: 802 ]
Fix workaround for function parameters that are "unused" without log_assert.
[bugzilla: 803 ]
Fix confusing (and incorrect) code comment in daemon_cleanup().
[bugzilla: 806 ]
Fix wrong comment removed.
use sendmsg instead of sendto for TFO.
[bugzilla: 807 ]
Fix workaround for possible some "unused" function parameters in test code, from Jinmei Tatuya.
Note that OPENPGPKEY type is RFC 7929.
[bugzilla: 804 ]
Fix#804: unbound stops responding after outage. Fixes queries that attempt to wait for an empty list of subqueries.
Fix for #804: lower num_target_queries for iterator also for failed lookups.
[bugzilla: 820 ]
Fix set sldns_str2wire_rr_buf() dual meaning len parameter in each iteration in find_tag_datas().
[bugzilla: 777 ]
Fix OpenSSL 1.1.0 compatibility, patch from Sebastian A. Siewior.
RFC 7958 is now out, updated docs for unbound-anchor.
Fix for compile without warnings with openssl 1.1.0.
[bugzilla: 826 ]
Fix refuse_non_local could result in a broken response.
iana portlist update.
Fix compile with openssl 1.1.0 with api=1.1.0.
[bugzilla: 829 ]
Fix doc of sldns_wire2str_rdata_buf() return value has an off-by-one typo, from Jinmei Tatuya (Infoblox).
Fix incomplete prototypes reported by Dag-Erling Smørgrav.
[bugzilla: 828 ]
Fix missing type in access-control-tag-action redirect results in NXDOMAIN.
Take configured minimum TTL into consideration when reducing TTL to original TTL from RRSIG.
[bugzilla: 831 ]
Fix workaround for spurious fread_chk warning against petal.c
Silenced flex-generated sign-unsigned warning print with gcc diagnostic pragma.
Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len.
fix potential memory leak in daemon/remote.c and nullpointer dereference in validator/autotrust.
[bugzilla: 883 ]
Fix error for duplicate local zone entry.
[bugzilla: 835 ]
Fix --disable-dsa with nettle verify.
Added slapd support for OpenSSL 1.1.0 series (ITS#8353, ITS#8533, ITS#8634)
Fixed libldap to fail ldap_result if the handle is already bad (ITS#8585)
Fixed libldap to expose error if user specified CA doesn't exist (ITS#8529)
Fixed libldap handling of Diffie-Hellman parameters (ITS#7506)
Fixed libldap GnuTLS use after free (ITS#8385)
Fixed libldap SASL initialization (ITS#8648)
Fixed slapd bconfig rDN escape handling (ITS#8574)
Fixed slapd segfault with invalid hostname (ITS#8631)
Fixed slapd sasl SEGV rebind in same session (ITS#8568)
Fixed slapd syncrepl filter handling (ITS#8413)
Fixed slapd syncrepl infinite looping mods with delta-sync MMR (ITS#8432)
Fixed slapd callback struct so older modules without writewait should function.
Custom modules may need to be updated for sc_writewait callback (ITS#8435)
Fixed slapd-ldap/meta broken LDAP_TAILQ macro (ITS#8576)
Fixed slapd-mdb so it passes ITS6794 regression test (ITS#6794)
Fixed slapd-mdb double free with size zero paged result (ITS#8655)
Fixed slapd-meta uninitialized diagnostic message (ITS#8442)
Fixed slapo-accesslog to honor pauses during purge for cn=config update (ITS#8423)
Fixed slapo-accesslog with multiple modifications to the same attribute (ITS#6545)
Fixed slapo-relay to correctly initialize sc_writewait (ITS#8428)
Fixed slapo-sssvlv double free (ITS#8592)
Fixed slapo-unique with empty modifications (ITS#8266)
Build Environment
Added test065 for proxyauthz (ITS#8571)
Fix test008 to be portable (ITS#8414)
Fix test064 to wait for slapd to start (ITS#8644)
Fix its4336 regression test (ITS#8534)
Fix its4337 regression test (ITS#8535)
Fix regression tests to execute on all backends (ITS#8539)
Contrib
Added slapo-autogroup(5) man page (ITS#8569)
Added passwd missing conversion scripts for apr1 (ITS#6826)
Fixed contrib modules where the writewait callback was not correctly initialized (ITS#8435)
Fixed smbk5pwd to build with newer OpenSSL releases (ITS#8525)
Documentation
admin24 fixed tls_cipher_suite bindconf option (ITS#8099)
admin24 fixed typo cn=config to be slapd.d (ITS#8449)
admin24 fixed slapo-syncprov information to be curent (ITS#8253)
admin24 fixed typo in access control docs (ITS#7341, ITS#8391)
admin24 fixed minor typo in tuning guide (ITS#8499)
admin24 fixed information about the limits option (ITS#7700)
admin24 fixed missing options for syncrepl configuration (ITS#7700)
admin24 fixed accesslog documentation to note it should not be replicated (ITS#8344)
Fixed ldap.conf(5) missing information on SASL_NOCANON option (ITS#7177)
Fixed ldapsearch(1) information on the V[V] flag behavior (ITS#7177, ITS#6339)
Fixed slapd-config(5), slapd.conf(5) clarification on interval keyword for refreshAndPersist (ITS#8538)
Fixed slapd-config(5), slapd.conf(5) clarify serverID requirements (ITS#8635)
Fixed slapd-config(5), slapd.conf(5) clarification on loglevel settings (ITS#8123)
Fixed slapo-ppolicy(5) to clearly note rootdn requirement (ITS#8565)
Fixed slapo-memberof(5) to note it is not safe to use with replication (ITS#8613)
Fixed slapo-syncprov(5) documentation to be current (ITS#8253)
Fixed slapadd(8) manpage to note slapd-mdb (ITS#8215)
Fixed various minor grammar issues in the man pages (ITS#8544)
Fixed various typos (ITS#8587)
but only weird code?):
amd's amfs_program_exec() has a missing {} issue.
flex's check_options() has odd inconsistent identation that
trips the new ident checker.
ntpd's oncore_check_leap_sec() and oncore_set_traim() have
missing {} issues.
sntp's optionLoadNested() an identation weirdness that
trips the new ident checker.
vi's cl_attr() has a wrong {} issue, and its vs_paint() has
an identation weirdness that trips the new ident checker.
Bump version to 20171030 for netpgpverify fixes.
Add zsh to default_acceptable_licenses.
Undef bootstrap hack.
Fix OpenSSL 1.1.0 build
OpenSSL 1.1.0 makes xkusage and ex_flags opaque.
Use X509_check_ca rather than a custom and nearly identical implementation.
This is available since OpenSSL 0.9.8 (even in RHEL5).
This is also done because we cannot implement it identically under
OpenSSL 1.1.0 due to missing getters.
Test EXFLAG_XKUSAGE rather than zero xkusage test no usage to avoid openssl
1.1.0 getter returning a different code on this case.
Use getter for xkusage in the non-zero test case.
Provide fallback definitions for getters.
PR pkg/52298, PR pkg/52648
- HAVE_GCC=5 is now the default (vs. HAVE_GCC=53 we've been using for
GCC 5.4 and GCC 5.5.)
- remove some more GCC 4.8 code. we don't support GCC 4 here.
- adjust set lists to gcc=5 from gcc=53.
add some basic HAVE_GCC=6 handling (totally unused so far.)
* hooks: remove use of local builtin for better portability
* dhcpcd: don't log errors working out carrier for departed interfaces
* ipv4: allow configuration of static broadcast address
* if: don't set MTU during interface discovery
* if: don't activate non matching interfaces to commandline ones
* eloop-bench: fix hangs when using a large number of cycles
* dhcp: don't bind when we've just probed an address to inform
* dhcp: when unicasting on L3, unicast on L2 as well
* dhcp: when rebooting, don't set cidaddr
* dhcp6: don't listen on IPv6 addresses when not using DHCPv6
* dhcp: only set probe state when probing (fixes REBOOT reason)
* ipv6: disable kernel RA if interface is active
* hooks: set protocol to link for link layer events
h_winch, test sa_handler against all SIG_* actions defined in sys/signal.h
instead of just 0. Corrects an issue where vi crashes after a window is
resized.
* Don't flush prefix routes/routers if kernel does not support RA
* dhcp: improve errors around UDP checksum failure
* dhcp: announce existing addresses before rebooting
* bpf: rework loop so that we can close/reopen fd inside and abort
* ipv6nd: don't handle NA/RA for non active interfaces
* dhcp6: listen on all addresses in non master mode
* dhcpcd-run-hooks: set protocol in dhcpcd, don't guess
* Ensure that xid is unique across all interfaces
* dhcp6: redirect message to interface which uses the xid
* bsd: strip scope from LL addresses when detecting their addition
* ipv6nd: fix address lifetime overflow on carrier up
* dhcp6: fix confirmation of lease on carrier up
