Replace homegrown logic of calculating alignment with alignof, a C11 header
feature.
Add a check for NetBSD >= 8.0 just in case that someone will want to build
it on older NetBSD.
Issue detected with UBSan.
Comment here already says it isn't necessary and will be removed.
Hasten the process for us and avoid the problematic typedef.
This is useful because u_longlong_t would otherwise need to be
provided by compat headers.
There is an interface in grep: dfa.c with functions to test bit, set bit,
clear bit etc. They operate over the INT-wide mask (INTBITS). Use unsigned
shift in these interfaces to prevent UB.
Detected with MKSANITIZER with the undefined behavior sanitizer option.
Sponsored by <The NetBSD Foundation>
$ awk '{w=$1}' < /dev/null
/public/src.git/external/historical/nawk/bin/../dist/lex.c:476:16: runtime error: index -1 out of bounds for type 'const Keyword [46]'
There used to be documented a bug in the code that index ouf of bounds
can in theory fault (by daniel barrett).
Before assigning the pointer, first check for the index whether it's not
not -1. This was a suggested solution in the comment in the code.
The sanitizer is overcautious as this pointer wasn't dereferenced, but
fix is nonetheless.
Sponsored by <The NetBSD Foundation>
undefined reference to `typeinfo for __cxxabiv1::__class_type_info'
undefined reference to `typeinfo for __cxxabiv1::__si_class_type_info'
undefined reference to `typeinfo for __cxxabiv1::__vmi_class_type_info'
undefined reference to `typeinfo for std::type_info'
undefined reference to `__dynamic_cast'
Mark arguments to dtrace_probe_lookup() with __UNCONST().
The proper fix constifying it causes pollution of const in too many files.
This could be done with -W flags, but they are incompatible between
compilers.
This is a step forward functional MKLLVM=yes HAVE_LLVM=yes build.
Sponsored by <The NetBSD Foundation>
Constify char* types when initialized with liternals.
This could be done with -W flags, but they are incompatible between
compilers.
This is a step forward functional MKLLVM=yes HAVE_LLVM=yes build.
Sponsored by <The NetBSD Foundation>
Constify dgr_suffix.
This could be done with -W flags, but they are incompatible between
compilers.
This is a step forward functional MKLLVM=yes HAVE_LLVM=yes build.
Sponsored by <The NetBSD Foundation>
Use __UNCONST() to remove const from an argument.
This could be done with -W flags, but they are incompatible between
compilers.
This is a step forward functional MKLLVM=yes HAVE_LLVM=yes build.
Sponsored by <The NetBSD Foundation>
Add missing const keywords in dtrace_strncmp().
Initialize lim1 and lim2 to zero always. This prevents a false positive
about potentially unset but used variable.
This could be done with -W flags, but they are incompatible between
compilers.
This is a step forward functional MKLLVM=yes HAVE_LLVM=yes build.
Sponsored by <The NetBSD Foundation>
Clang/LLVM does not recognize:
- -Wno-discarded-qualifiers
This is a step forward functional MKLLVM=yes HAVE_LLVM=yes build.
Sponsored by <The NetBSD Foundation>
Add missing const keywords.
This could be done with -W flags, but they are incompatible between
compilers.
This is a step forward functional MKLLVM=yes HAVE_LLVM=yes build.
Sponsored by <The NetBSD Foundation>
Clang/LLVM does not recognize:
- -Wno-discarded-qualifiers
- -Wno-unused-but-set-variable
This is a step forward functional MKLLVM=yes HAVE_LLVM=yes build.
Sponsored by <The NetBSD Foundation>
Clang/LLVM does not recognize:
- -Wno-maybe-uninitialized
- -Wno-unused-but-set-variable
MKGCC=yes still builds the distribution.
This is a step forward functional MKLLVM=yes HAVE_LLVM=yes build.
Sponsored by <The NetBSD Foundation>
Sanitizers are conflicting with this option:
When linking shared libraries, the AddressSanitizer run-time is not
linked, so -Wl,-z,defs may cause link errors (t use it with
AddressSanitizer).
https://clang.llvm.org/docs/AddressSanitizer.html
When linking shared libraries, the MemorySanitizer run-time is not
linked, so -Wl,-z,defs may cause link errors (t use it with
MemorySanitizer).
https://clang.llvm.org/docs/MemorySanitizer.html
Solution suggested by <christos>
Root cause of breaking libc++ investigated by <Yang Zheng>
__syscall() needs to be shifted into the lower 32bits to form a proper
pointer. Temporarily steal __SYSCALL_TO_UINTPTR_T from the syscall/__syscall
test program, Kamil is working on a proper solution.
- Replace non-printable multibyte char with ?-symbol.
- Put space before non-spacing char.
Fix problems reported in PR bin/53164 and
PR bin/53323, that are because we did not take into account non-printable
multibyte char of wctob(wc) == EOF && wcwidth(wc) == -1.
This change breaks the expectations of users that would like a coredump
of top(1). Other similar applications such as vmstat(1) don't do this.
Since the change was just a courtesy, revert.
* dhcp: Clarified some checksumming code, style and commentary
(thanks to Maxime Villard)
* dhcp6: IAID is now unique per IA type rather than global
* ip6: if an IA callback causes a fork, exit earlier
The cp_old array is allocated with malloc(3) and its pointer is passed to
percentages64().
In this function there happens a calculation of total_change, which value
depends on the value inside the unitialized cp_old[] array.
==26662==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x268a2c in percentages64 /usr/src/external/bsd/top/bin/../dist/machine/m_netbsd.c:1341:6
#1 0x26748b in get_system_info /usr/src/external/bsd/top/bin/../dist/machine/m_netbsd.c:478:6
#2 0x25518e in do_display /usr/src/external/bsd/top/bin/../dist/top.c:507:5
#3 0x253038 in main /usr/src/external/bsd/top/bin/../dist/top.c:975:2
#4 0x21cad1 in ___start (/usr/bin/top+0x1cad1)
SUMMARY: MemorySanitizer: use-of-uninitialized-value /usr/src/external/bsd/top/bin/../dist/machine/m_netbsd.c:1341:6 in percentages64
Exiting
Fix this issue by changling malloc(3) with calloc(3).
Detected with Memory Sanitizer during the integration of sanitizers with
the NetBSD basesystem.
Reported by <Yang Zheng>
of /libdata/firmware and /usr/libdata/firmware are not installed
if set to "no". from the bsd.README:
MKFIRMWARE If "no", install the /libdata/firmware directory,
which is necessary for several drivers: athn(4), bwfm(4),
ipw(4), iwi(4), iwm(4), iwn(4), otus(4), rtwn(4), urtwn(4),
wpi(4), ral(4), rum(4), run(4), zyd(4), bcm43xx(4), and
the Tegra 124 SoC.
Default: yes on amd64, cobalt, evbarm evbmips, evbppc, hpcarm,
hppa, i386, mac68k, macppc, sandpoint, and sparc64, no elsewhere.
convert MKRADEONFIRMWARE and MKTEGRAFIRMWARE into FOO.arch lists,
and move their defaults above the general defaults setting.
saves about 12MB in a normal installation for other platforms.
merge a new version of the CDDL dtrace and ZFS code.
this changes the upstream vendor from OpenSolaris to FreeBSD,
and this version is based on FreeBSD svn r315983.
in addition to the 10 years of improvements from upstream,
this version also has these NetBSD-specific enhancements:
- dtrace FBT probes can now be placed in kernel modules.
- ZFS now supports mmap().
this changes the upstream vendor from OpenSolaris to FreeBSD,
and this version is based on FreeBSD svn r315983.
in addition to the 10 years of improvements from upstream,
this version also has these NetBSD-specific enhancements:
- dtrace FBT probes can now be placed in kernel modules.
- ZFS now supports mmap().
that passing variables to recursive makes with :q works as expected.
- Revert :Q to work as before.
- Adjust makefiles that use recursive make to use :q
Discussed on tech-toolchain@
XXX: pullup 8
Fix internal_mmap() on 32-bit NetBSD platforms
There is need to use internal_syscall64() instead of internal_syscall_ptr().
The offset argument of type off_t is always 64-bit.
http://llvm.org/viewvc/llvm-project?view=revision&revision=333075
PR kern/53261 by Martin Husemann
Fix internal_mmap() on 32-bit NetBSD platforms
There is need to use internal_syscall64() instead of internal_syscall_ptr().
The offset argument of type off_t is always 64-bit.
http://llvm.org/viewvc/llvm-project?view=revision&revision=333075
PR kern/53261 by Martin Husemann
Summary of changes in tzdata2018e (2018-05-01 23:42:51 -0700):
News for the tz database
Release 2018e - 2018-05-01 23:42:51 -0700
North Korea switches back to +09 on 2018-05-05 (tomorrow!)
* Routing: Fix case when cloning route changes but needs to be replaced
* DHCP6: Transpose DHCP userclass option into DHCP6
* DHCP6: Fix sending custom vendor class option
* Auth: Allow zero value replay detection data
* Auth: Allow different tokens for send and receive
* ND6: Warn if router lifetime is set to zero
* DHCP6: Softwire Address and Port-Mapped Clients, RFC7598
programs there; make all Makefiles that use bsd.hostprog.mk include it.
Namely turn off MKREPRO and don't make lint, man pages, info files etc.
Remove the Makefile.inc files that contained these same settings, and
remove the settings from Makefile.host
PR/53238: Robert Elz: Disable MKREPRO in tools; the host compiler might
not support the necessary options. This is done thusly:
1. Create Makefile.inc and set MKREPRO=no in it. Change the Makefiles that
include bsd.own.mk, to include bsd.init.mk which includes Makefile.inc
first. This will also allow us to control other tools options from a
single location if we need to.
2. Centralize NOMAN handling.
XXX: pullup-8
tcp_timer.h. This struct move is more trouble than its worth. It breaks
header compatibility with other BSD's and can't be really removed because
it is an installed header that will break other 3rd party software. I
suggest that it gets reverted!
From: ppalka <ppalka@138bc75d-0d04-0410-961f-82ee72b054a4>
Date: Wed, 27 Apr 2016 21:18:05 +0000
Subject: [PATCH] Reduce nesting of parentheses in conditionals generated by
genattrtab
gcc/ChangeLog:
* genattrtab.c (write_test_expr): New parameter EMIT_PARENS
which defaults to true. Emit an outer pair of parentheses only if
EMIT_PARENS. When continuing a chain of && or || (or & or |),
don't emit parentheses for the right-hand operand.
git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@235536
gcc/arm generates so many parens it hits a bracket depth limited which is
enforced by clang. This reduces the number of parens generated and avoids the
need to increase bracket depth.
Fixes PR toolchain/53178 properly.
* config-ml.in: Sync with gcc sources.
* config.guess: Likewise.
* config.sub: Likewise.
* configure.ac: Likewise.
* configure: Regenerate.
2017-12-14 Nick Clifton <nickc@redhat.com>
* COPYING.LIBGLOSS: Update address of FSF in copyright notice.
2017-12-12 Stafford Horne <shorne@gmail.com>
* configure.ac: Remove logic adding gdb to noconfigsdirs for or1k.
* configure: Regenerate.
2017-09-15 Nick Clifton <nickc@redhat.com>
* src-release.sh (LZIPPROG): New define. Provides the name of the
lzip program.
(do_lz): New function. Compresses a tarball using the lzip
program.
(do_compress): Add support for lzip compression.
(usage): Mention -l option.
(build_release): Support -l option to invoke lzip compression.
2017-09-15 Alan Modra <amodra@gmail.com>
* src-release.sh (do_proto_toplev): Revert last patch. Enable or
disable binutils, gas, gdb, gold, gprof, ld, libdecnumber, readline,
and sim depending on $tool and $support_files. Echo configure line.
2017-09-14 Matt Rice <ratmice@gmail.com>
* src-release.sh (do_proto_toplev): Enable gold during release process.
2017-04-13 Andrew Jenner <andrew@codesourcery.com>
* config.sub: Sync with master version in config project.
2017-04-03 Andrew Jenner <andrew@codesourcery.com>
* config.sub: Handle ia16 in $basic_machine.
bfd/
* config.bfd: Handle ia16.
gas/
* configure.tgt: Handle ia16.
ld/
* configure.tgt: Handle ia16.
2017-03-22 Nick Clifton <nickc@redhat.com>
* config.sub: Sync with master version in config project.
* config.guess: Likewise.
2017-01-23 Nick Clifton <nickc@redhat.com>
* configure.ac: Update year in copyright notice.
Sync from FSF GCC mainline, bringing in the following patches.
* Makefile.def: Likewise.
* Makefile.tpl: Likewise.
* configure: Regenerate.
* Makefile.in: Regenerate.
2016-12-21 Jakub Jelinek <jakub@redhat.com>
* configure.ac: Don't bootstrap libmpx unless --with-build-config
includes bootstrap-mpx.
2016-12-01 Matthias Klose <doko@ubuntu.com>
* configure.ac: Don't use pkg-config to check for bdw-gc.
2016-11-30 Matthias Klose <doko@ubuntu.com>
* Makefile.def: Remove reference to boehm-gc target module.
* configure.ac: Include pkg.m4, check for --with-target-bdw-gc
options and for the bdw-gc pkg-config module.
2016-11-15 Matthias Klose <doko@ubuntu.com>
* config-ml.in: Remove references to GCJ.
* configure.ac: Likewise.
2016-09-30 Jakub Jelinek <jakub@redhat.com>
* configure.ac: Add target-libffi to target_libraries.
Readd libgcj target disablings, modified to only target-libffi.
Readd target addition of go to unsupported languages.
2016-09-30 Andrew Haley <aph@redhat.com>
* Makefile.def: Remove libjava.
* Makefile.tpl: Likewise.
* configure.ac: Likewise.
2016-09-26 Anton Kolesov <Anton.Kolesov@synopsys.com>
* configure.ac: Disable "sim" directory for arc*-*-*.
2016-09-12 Maciej W. Rozycki <macro@imgtec.com>
* configure.ac: Check for the minimum in-tree MPFR version
handled.
2016-12-31 Alan Modra <amodra@gmail.com>
* config.sub: Import from upstream.
2016-12-08 Alan Modra <amodra@gmail.com>
* configure: Regenerate.
2016-12-02 Josh Conner <joshconner@google.com>
* configure.ac: Add fuchsia to targets that use ELF.
* configure: Regenerated.
2016-11-07 Doug Evans <dje@google.com>
* config.sub: Sync with upstream version 2016-11-03.
git://git.sv.gnu.org/config.git
* config.guess: Sync with upstream version 2016-10-02.
2016-09-27 Simon Marchi <simon.marchi@polymtl.ca>
* .gitignore: Add archives and make stamps.
2016-07-20 Yan-Ting Lin <currygt52@gmail.com>
* configure.ac (nds32*-*-*): Remove entry to enable gdb.
* configure: Regenerated.
output if the locale is non-UTF-8 locale with the following change.
https://marc.info/?l=openbsd-cvs&m=152364416720474
| Modified files:
| usr.bin/mandoc : term_ascii.c
|
| Log message:
| Make sure that mandoc only goes into UTF-8 mode if the user really
| selected UTF-8, not some other multibyte locale. This obviously
| makes no difference on OpenBSD but improves portability.
| Issue reported by <Nakayama at NetBSD> via wiz@.
of the generated .d files for a successful build. i've tested
that at least one recent macppc build failure is fixed with this
change (namely, try building just insn-emit.o in this subdir),
but the pattern should fix anything else left in insn*.
this really should finally fix PR#53137.
reported by thorpej on tech-toolchain - we both found the same
fix around the same time.
XXX: kamil says solaris-type hosts will fail here as they need
XXX: 'egrep' not 'grep -E'.
--- 9.10.7 released ---
--- 9.10.7rc2 released ---
4904. [bug] Temporarily revert change #4859. [GL #124]
--- 9.10.7rc1 released ---
4889. [func] Warn about the use of old root keys without the new
root key being present. Warn about dlv.isc.org's
key being present. Warn about both managed and
trusted root keys being present. [RT #43670]
4888. [test] Initialize sockets correctly in sample-update so
that the nsupdate system test will run on Windows.
[RT #47097]
4886. [doc] Document dig -u in manpage. [RT #47150]
4885. [security] update-policy rules that otherwise ignore the name
field now require that it be set to "." to ensure
that any type list present is properly interpreted.
[RT #47126]
4882. [bug] Address potential memory leak in
dns_update_signaturesinc. [RT #47084]
4881. [bug] Only include dst_openssl.h when OpenSSL is required.
[RT #47068]
4879. [bug] dns_rdata_caa:value_len field was too small.
[RT #47086]
--- 9.10.7b1 released ---
4876. [bug] Address deadlock with accessing a keytable. [RT #47000]
4874. [bug] Wrong time display when reporting new keywarntime.
[RT #47042]
4872. [bug] Don't permit loading meta RR types such as TKEY
from master files. [RT #47009]
4871. [bug] Fix configure glitch in detecting stdatomic.h
support on systems with multiple compilers.
[RT #46959]
4870. [test] Update included ATF library to atf-0.21 preserving
the ATF tool. [RT #46967]
4869. [bug] Address some cases where NULL with zero length could
be passed to memmove which is undefined behaviour and
can lead to bad optimisation. [RT #46888]
4867. [cleanup] Normalize rndc on/off commands (validation and
querylog) so they accept the same synonyms
for on/off (yes/no, true/false, enable/disable).
Thanks to Tony Finch. [RT #47022]
4866. [port] DST library initialization verifies MD5 (when MD5
was not disabled) and SHA-1 hash and HMAC support.
[RT #46764]
4863. [bug] Fix various other bugs reported by Valgrind's
memcheck tool. [RT #46978]
4862. [bug] The rdata flags for RRSIG were not being properly set
when constructing a rdataslab. [RT #46978]
4861. [bug] The isc_crc64 unit test was not endian independent.
[RT #46973]
4860. [bug] isc_int8_t should be signed char. [RT #46973]
4859. [bug] A loop was possible when attempting to validate
unsigned CNAME responses from secure zones;
this caused a delay in returning SERVFAIL and
also increased the chances of encountering
CVE-2017-3145. [RT #46839]
4858. [security] Addresses could be referenced after being freed
in resolver.c, causing an assertion failure.
(CVE-2017-3145) [RT #46839]
4857. [bug] Maintain attach/detach semantics for event->db,
event->node, event->rdataset and event->sigrdataset
in query.c. [RT #46891]
4856. [bug] 'rndc zonestatus' reported the wrong underlying type
for a inline slave zone. [RT #46875]
4852. [bug] Add REQUIRE's and INSIST's to isc_time_formattimestamp,
isc_time_formathttptimestamp, isc_time_formatISO8601.
[RT #46892]
4851. [port] Support using kyua as well as atf-run to run the unit
tests. [RT #46853]
4846. [test] Adjust timing values in runtime system test. Address
named.pid removal races in runtime system test.
[RT #46800]
4844. [test] Address memory leaks in libatf-c. [RT #46798]
4843. [bug] dnssec-signzone free hashlist on exit. [RT #46791]
4842. [bug] Conditionally compile opensslecdsa_link.c to avoid
warnings about unused function. [RT #46790]
4841. [bug] Address -fsanitize=undefined warnings. [RT #46786]
4840. [test] Add tests to cover fallback to using ZSK on inactive
KSK. [RT #46787]
4839. [bug] zone.c:zone_sign was not properly determining
if there were active KSK and ZSK keys for
a algorithm when update-check-ksk is true
(default) leaving records unsigned with one or
more DNSKEY algorithms. [RT #46774]
4838. [bug] zone.c:add_sigs was not properly determining
if there were active KSK and ZSK keys for
a algorithm when update-check-ksk is true
(default) leaving records unsigned with one or
more DNSKEY algorithms. [RT #46754]
4837. [bug] dns_update_signatures{inc} (add_sigs) was not
properly determining if there were active KSK and
ZSK keys for a algorithm when update-check-ksk is
true (default) leaving records unsigned when there
were multiple DNSKEY algorithms for the zone.
[RT #46743]
4836. [bug] Zones created using "rndc addzone" could
temporarily fail to inherit an "allow-transfer"
ACL that had been configured in the options
statement. [RT #46603]
4833. [bug] isc_event_free should check that the event is not
linked when called. [RT #46725]
4832. [bug] Events were not being removed from zone->rss_events.
[RT #46725]
4831. [bug] Convert the RRSIG expirytime to 64 bits for
comparisions in diff.c:resign. [RT #46710]
4830. [bug] Failure to configure ATF when requested did not cause
an error in top-level configure script. [RT #46655]
4829. [bug] isc_heap_delete did not zero the index value when
the heap was created with a callback to do that.
[RT #46709]
4827. [misc] Add a precommit check script util/checklibs.sh
[RT #46215]
4826. [cleanup] Prevent potential build failures in bin/confgen/ and
bin/named/ when using parallel make. [RT #46648]
4823. [test] Refactor reclimit system test to improve its
reliability and speed. [RT #46632]
4822. [bug] Use resign_sooner in dns_db_setsigningtime. [RT #46473]
4821. [bug] When resigning ensure that the SOA's expire time is
always later that the resigning time of other records.
[RT #46473]
4820. [bug] dns_db_subtractrdataset should transfer the resigning
information to the new header. [RT #46473]
4819. [bug] Fully backout the transaction when adding a RRset
to the resigning / removal heaps fails. [RT #46473]
4818. [test] The logfileconfig system test could intermittently
report false negatives on some platforms. [RT #46615]
4817. [cleanup] Use DNS_NAME_INITABSOLUTE and DNS_NAME_INITNONABSOLUTE.
[RT #45433]
4816. [bug] Don't use a common array for storing EDNS options
in DiG as it could fill up. [RT #45611]
4815. [bug] rbt_test.c:insert_and_delete needed to call
dns_rbt_addnode instead of dns_rbt_addname. [RT #46553]
4814. [cleanup] Use AS_HELP_STRING for consistent help text. [RT #46521]
4812. [bug] Minor improvements to stability and consistency of code
handling managed keys. [RT #46468]
4810. [test] The chain system test failed if the IPv6 interfaces
were not configured. [RT #46508]
4809. [port] Check at configure time whether -latomic is needed
for stdatomic.h. [RT #46324]
4805. [bug] TCP4Active and TCP6Active weren't being updated
correctly. [RT #46454]
4804. [port] win32: access() does not work on directories as
required by POSIX. Supply a alternative in
isc_file_isdirwritable. [RT #46394]
4803. [bug] Backport fix for RT #46055 from RT #46267. [RT #46430]
4792. [bug] Fix map file header correctness check. [RT #38418]
4791. [doc] Fixed outdated documentation about export libraries.
[RT #46341]
4790. [bug] nsupdate could trigger a require when sending a
update to the second address of the server.
[RT #45731]
4788. [cleanup] When using "update-policy local", log a warning
when an update matching the session key is received
from a remote host. [RT #46213]
4787. [cleanup] Turn nsec3param_salt_totext() into a public function,
dns_nsec3param_salttotext(), and add unit tests for it.
[RT #46289]
4783. [test] dnssec: 'check that NOTIFY is sent at the end of
NSEC3 chain generation failed' required more time
on some machines for the IXFR to complete. [RT #46388]
4781. [maint] B.ROOT-SERVERS.NET is now 199.9.14.201. [RT #45889]
4780. [bug] When answering ANY queries, don't include the NS
RRset in the authority section if it was already
in the answer section. [RT #44543]
4777. [cleanup] Removed a redundant call to configure_view_acl().
[RT #46369]
4774. [bug] <isc/util.h> was incorrectly included in several
header files. [RT #46311]
4773. [doc] Fixed generating Doxygen documentation for functions
annotated using certain macros. Miscellaneous
Doxygen-related cleanups. [RT #46276]
4771. [bug] When sending RFC 5011 refresh queries, disregard
cached DNSKEY rrsets. [RT #46251]
4770. [bug] Cache additional data from priming queries as glue.
Previously they were ignored as unsigned
non-answer data from a secure zone, and never
actually got added to the cache, causing hints
to be used frequently for root-server
addresses, which triggered re-priming. [RT #45241]
4769. [bug] Enforce the requirement that the managed keys
directory (specified by "managed-keys-directory",
and defaulting to the working directory if not
specified) must be writable. [RT #46077]
4766. [cleanup] Addresss Coverity warnings. [RT #46150]
4762. [func] "update-policy local" is now restricted to updates
from local addresses. (Previously, other addresses
were allowed so long as updates were signed by the
local session key.) [RT #45492]
4761. [protocol] Add support for DOA. [RT #45612]
4759. [func] Add logging channel "trust-anchor-telementry" to
record trust-anchor-telementry in incoming requests.
Both _ta-XXXX.<anchor>/NULL and EDNS KEY-TAG options
are logged. [RT #46124]
4758. [doc] Remove documentation of unimplemented "topology".
[RT #46161]
4756. [bug] Interrupting dig could lead to an INSIST failure after
certain errors were encountered while querying a host
whose name resolved to more than one address. Change
4537 increased the odds of triggering this issue by
causing dig to hang indefinitely when certain error
paths were evaluated. dig now also retries TCP queries
(once) if the server gracefully closes the connection
before sending a response. [RT #42832, #45159]
4754. [bug] dns_zone_setview needs a two stage commit to properly
handle errors. [RT #45841]
4753. [contrib] Software obtainable from known upstream locations
(i.e., zkt, nslint, query-loc) has been removed.
Links to these and other packages can be found at
https://www.isc.org/community/tools [RT #46182]
4752. [test] Add unit test for isc_net_pton. [RT #46171]
4749. [func] The ISC DLV service has been shut down, and all
DLV records have been removed from dlv.isc.org.
- Removed references to ISC DLV in documentation
- Removed DLV key from bind.keys
- No longer use ISC DLV by default in delv
[RT #46155]
4748. [cleanup] Sprintf to snprintf coversions. [RT #46132]
4746. [cleanup] Add configured prefixes to configure summary
output. [RT #46153]
4745. [test] Add color-coded pass/fail messages to system
tests when running on terminals that support them.
[RT #45977]
4744. [bug] Suppress trust-anchor-telementry queries if
validation is disabled. [RT #46131]
4741. [bug] Make isc_refcount_current() atomically read the
counter value. [RT #46074]
4739. [cleanup] Address clang static analysis warnings. [RT #45952]
4738. [port] win32: strftime mishandles %Z. [RT #46039]
4737. [cleanup] Address Coverity warnings. [RT #46012]
4736. [cleanup] (a) Added comments to NSEC3-related functions in
lib/dns/zone.c. (b) Refactored NSEC3 salt formatting
code. (c) Minor tweaks to lock and result handling.
[RT #46053]
4735. [bug] Add @ISC_OPENSSL_LIBS@ to isc-config. [RT #46078]
4734. [contrib] Added sample configuration for DNS-over-TLS in
contrib/dnspriv.
4730. [bug] Fix out of bounds access in DHCID totext() method.
[RT #46001]
4729. [bug] Don't use memset() to wipe memory, as it may be
removed by compiler optimizations when the
memset() occurs on automatic stack allocation
just before function return. [RT #45947]
4728. [func] Use C11's stdatomic.h instead of isc_atomic
where available. [RT #40668]
4727. [bug] Retransferring an inline-signed slave using NSEC3
around the time its NSEC3 salt was changed could result
in an infinite signing loop. [RT #45080]
4725. [bug] Nsupdate: "recvsoa" was incorrectly reported for
failures in sending the update message. The correct
location to be reported is "update_completed".
[RT #46014]
4722. [cleanup] Clean up uses of strcpy() and strcat() in favor of
strlcpy() and strlcat() for safety. [RT #45981]
4719. [bug] Address PVS static analyzer warnings. [RT #45946]
4717. [bug] Treat replies with QCOUNT=0 as truncated if TC=1,
FORMERR if TC=0, and log the error correctly.
[RT #45836]
4715. [bug] TreeMemMax was mis-identified as a second HeapMemMax
in the Json cache statistics. [RT #45980]
4714. [port] openbsd/libressl: add support for building with
--enable-openssl-hash. [RT #45982]
4713. [cleanup] Minor revisions to RPZ code to reduce
differences with the development branch. [RT #46037]
4712. [bug] "dig +domain" and "dig +search" didn't retain the
search domain when retrying with TCP. [RT #45547]
4711. [test] Some RR types were missing from genzones.sh.
[RT #45782]
4709. [cleanup] Use dns_name_fullhash() to hash names for RRL.
[RT #45435]
4703. [bug] BINDInstall.exe was missing some buffer length checks.
[RT #45898]
4698. [port] Add --with-python-install-dir configure option to allow
specifying a nonstandard installation directory for
Python modules. [RT #45407]
4696. [port] Enable filter-aaaa support by default on Windows
builds. [RT #45883]
4692. [bug] Fix build failures with libressl introduced in 4676.
[RT #45879]
4690. [bug] Command line options -4/-6 were handled inconsistently
between tools. [RT #45632]
4689. [cleanup] Turn on minimal responses for CDNSKEY and CDS in
addition to DNSKEY and DS. Thanks to Tony Finch.
[RT #45690]
4688. [protocol] Check and display EDNS KEY TAG options (RFC 8145) in
messages. [RT #44804]
4686. [bug] dnssec-settime -p could print a bogus warning about
key deletion scheduled before its inactivation when a
key had an inactivation date set but no deletion date
set. [RT #45807]
4685. [bug] dnssec-settime incorrectly calculated publication and
activation dates for a successor key. [RT #45806]
4684. [bug] delv could send bogus DNS queries when an explicit
server address was specified on the command line along
with -4/-6. [RT #45804]
4683. [bug] Prevent nsupdate from immediately exiting on invalid
user input in interactive mode. [RT #28194]
4682. [bug] Don't report errors on records below a DNAME.
[RT #44880]
4680. [bug] Fix failing over to another master server address when
nsupdate is used with GSS-API. [RT #45380]
4679. [cleanup] Suggest using -o when dnssec-verify finds a SOA record
not at top of zone and -o is not used. [RT #45519]
4677. [cleanup] Split up the main function in dig to better support
the iOS app version. [RT #45508]
4676. [cleanup] Allow BIND to be built using OpenSSL 1.0.X with
deprecated functions removed. [RT #45706]
4675. [cleanup] Don't use C++ keyword class. [RT #45726]
4673. [port] Silence GCC 7 warnings. [RT #45592]
4672. [bug] Fix a regression introduced by change 3938 (when
--enable-fetchlimit is NOT in use), where named
as resolver would, upon fetch timeout, repeat
fetching from the same nameserver address. This
also broke "forward first;" configurations (as
forwarders are also treated as nameservers when
fetching). [RT #45321]
4671. [bug] Fix a race condition that could cause the
resolver to crash with assertion failure when
chasing DS in specific conditions with a very
short RTT to the upstream nameserver. [RT #45168]
4670. [cleanup] Ensure that a request MAC is never sent back
in an XFR response unless the signature was
verified. [RT #45494]
4668. [bug] Use localtime_r and gmtime_r for thread safety.
[RT #45664]
4667. [cleanup] Refactor RDATA unit tests. [RT #45610]
4665. [protocol] Added support for ED25519 and ED448 DNSSEC signing
algorithms (RFC 8080). (Note: these algorithms
depend on code currently in the development branch
of OpenSSL which has not yet been released.)
[RT #44696]
4663. [cleanup] Clarify error message printed by dnssec-dsfromkey.
[RT #21731]
4662. [performance] Improve cache memory cleanup of zero TTL records
by putting them at the tail of LRU header lists.
[RT #45274]
4661. [bug] A race condition could occur if a zone was reloaded
while resigning, triggering a crash in
rbtdb.c:closeversion(). [RT #45276]
4660. [bug] Remove spurious "peer" from Windows socket log
messages. [RT #45617]
4658. [bug] Clean up build directory created by "setup.py install"
immediately. [RT #45628]
4657. [bug] rrchecker system test result could be improperly
determined. [RT #45602]
4655. [bug] Lack of seccomp could be falsely reported. [RT #45599]
4654. [cleanup] Don't use C++ keywords delete, new and namespace.
[RT #45538]
4652. [bug] Nsupdate could attempt to use a zeroed address on
server timeout. [RT #45417]
4651. [test] Silence coverity warnings in tsig_test.c. [RT #45528]
--- 9.10.6 released ---
--- 9.10.6rc2 released ---
4653. [bug] Reorder includes to move @DST_OPENSSL_INC@ and
@ISC_OPENSSL_INC@ after shipped include directories.
[RT #45581]
--- 9.10.6rc1 released ---
4647. [bug] Change 4643 broke verification of TSIG signed TCP
message sequences where not all the messages contain
TSIG records. These may be used in AXFR and IXFR
responses. [RT #45509]
4645. [bug] Fix PKCS#11 RSA parsing when MD5 is disabled.
[RT #45300]
--- 9.10.6b1 released ---
4643. [security] An error in TSIG handling could permit unauthorized
zone transfers or zone updates. (CVE-2017-3142)
(CVE-2017-3143) [RT #45383]
4642. [cleanup] Add more logging of RFC 5011 events affecting the
status of managed keys: newly observed keys,
deletion of revoked keys, etc. [RT #45354]
4641. [cleanup] Parallel builds (make -j) could fail with --with-atf /
--enable-developer. [RT #45373]
4640. [bug] If query_findversion failed in query_getdb due to
memory failure the error status was incorrectly
discarded. [RT #45331]
4636. [bug] Normalize rpz policy zone names when checking for
existence. [RT #45358]
4635. [bug] Fix RPZ NSDNAME logging that was logging
failures as NSIP. [RT #45052]
4634. [contrib] check5011.pl needs to handle optional space before
semi-colon in +multi-line output. [RT #45352]
4633. [maint] Updated AAAA (2001:500:200::b) for B.ROOT-SERVERS.NET.
4632. [security] The BIND installer on Windows used an unquoted
service path, which can enable privilege escalation.
(CVE-2017-3141) [RT #45229]
4631. [security] Some RPZ configurations could go into an infinite
query loop when encountering responses with TTL=0.
(CVE-2017-3140) [RT #45181]
4629. [bug] dns_client_startupdate could not be called with a
running client. [RT #45277]
4628. [bug] Fixed a potential reference leak in query_getdb().
[RT #45247]
4627. [func] Deprecate 'dig +sit', it is replaced by 'dig +cookie'.
[RT #45245]
4626. [test] Added more tests for handling of different record
ordering in CNAME and DNAME responses. [QA #430]
4624. [bug] Check isc_mem_strdup results in dns_view_setnewzones.
[RT #45210]
4622. [bug] Remove unnecessary escaping of semicolon in CAA and
URI records. [RT #45216]
4621. [port] Force alignment of oid arrays to silence loader
warnings. [RT #45131]
4620. [port] Handle EPFNOSUPPORT being returned when probing
to see if a socket type is supported. [RT #45214]
4617. [test] Update rndc system test to be more delay tolerant.
[RT #45177]
4615. [bug] AD could be set on truncated answer with no records
present in the answer and authority sections.
[RT #45140]
4614. [test] Fixed an error in the sockaddr unit test. [RT #45146]
4612. [bug] Silence 'may be use uninitalised' warning and simplify
the code in lwres/getaddinfo:process_answer.
[RT #45158]
4609. [cleanup] Rearrange makefiles to enable parallel execution
(i.e. "make -j"). [RT #45078]
4608. [func] DiG now warns about .local queries which are reserved
for Multicast DNS. [RT #44783]
4606. [port] Stop using experimental "Experimental keys on scalar"
feature of perl as it has been removed. [RT #45012]
4604. [bug] Don't use ERR_load_crypto_strings() when building
with OpenSSL 1.1.0. [RT #45117]
4603. [doc] Automatically generate named.conf(5) man page
from doc/misc/options. Thanks to Tony Finch.
[RT #43525]
4602. [func] Threads are now set to human-readable
names to assist debugging, when supported by
the OS. [RT #43234]
4601. [bug] Reject incorrect RSA key lengths during key
generation and and sign/verify context
creation. [RT #45043]
4600. [bug] Adjust RPZ trigger counts only when the entry
being deleted exists. [RT #43386]
4599. [bug] Fix inconsistencies in inline signing time
comparison that were introduced with the
introduction of rdatasetheader->resign_lsb.
[RT #42112]
4597. [bug] The validator now ignores SHA-1 DS digest type
when a DS record with SHA-384 digest type is
present and is a supported digest type.
[RT #45017]
4596. [bug] Validate glue before adding it to the additional
section. This also fixes incorrect TTL capping
when the RRSIG expired earlier than the TTL.
[RT #45062]
4593. [doc] Update README using markdown, remove outdated FAQ
file in favor of the knowledge base.
4592. [bug] A race condition on shutdown could trigger an
assertion failure in dispatch.c. [RT #43822]
4591. [port] Addressed some python 3 compatibility issues.
Thanks to Ville Skytta. [RT #44955] [RT #44956]
4590. [bug] Support for PTHREAD_MUTEX_ADAPTIVE_NP was not being
properly detected. [RT #44871]
4589. [cleanup] "configure -q" is now silent. [RT #44829]
4588. [bug] nsupdate could send queries for TKEY to the wrong
server when using GSSAPI. Thanks to Tomas Hozza.
[RT #39893]
4587. [bug] named-checkzone failed to handle occulted data below
DNAMEs correctly. [RT #44877]
4585. [port] win32: Set CompileAS value. [RT #42474]
4584. [bug] A number of memory usage statistics were not properly
reported when they exceeded 4G. [RT #44750]
4574. [bug] Dig leaked memory with multiple +subnet options.
[RT #44683]
4555. [func] dig +ednsopt: EDNS options can now be specified by
name in addition to numeric value. [RT #44461]
Version 4.4.1
28 February 2018
Release Notes
NEW FEATURES
Please note that that ISC DHCP is now licensed under the Mozilla Public License,
MPL 2.0. Please see https://www.mozilla.org/en-US/MPL/2.0/ to read the MPL 2.0
license terms.
The areas of focus for ISC DHCP 4.4 were:
1. Dynamic DNS additions
2. dhclient improvements
3. Support for dynamic shared libraries
Dynamic DNS Improvements:
- We added three new server configuration parameters which influence DDNS
conflict resolution:
1. ddns-dual-stack-mixed-mode - alters DNS conflict resolution behavior
to mitigate issues with non-compliant clients in dual stack environments.
2. ddns-guard-id-must-match - relaxes the DHCID RR client id matching
requirement of DNS conflict resolution.
3. ddns-other-guard-is-dynamic - alters dual-stack-mixed-mode behavior to
allow unguarded DNS entries to be overwritten in certain cases
- The server now honors update-static-leases parameter for static DHCPv6
hosts.
dhclient Improvements:
- We've added three command line parameters to dhclient:
1. --prefix-len-hint - directs dhclient to use the given length as
the prefix length hint when requesting prefixes
2. --decline-wait-time - instructs the client to wait the given number
of seconds after declining an IPv4 address before issuing a discover
3. --address-prefix-len - specifies the prefix length passed by dhclient
into the client script (via the environment variable ip6_prefixlen) with
each IPv6 address. We added this parameter because we have changed the
default value from 64 to 128 in order to be compliant with RFC3315bis
draft (-09, page 64) and RFC5942, Section 4, point 1.
**WARNING**: The new default value of 128 may not be backwardly compatible
with your environment. If you are operating without a router, such as
between VMs on a host, you may find they cannot see each other with prefix
length of 128. In such cases, you'll need to either provide routing or use
the command line parameter to set the value to 64. Alternatively you may
change the default at compile time by setting DHCLIENT_DEFAULT_PREFIX_LEN
in includes/site.h.
- dhclient will now generate a DHCPv6 DECLINE message when the client script
indicates a DAD failure
Dynamic shared library support:
Configure script, configure.ac+lt, which supports libtool is now provided
with the source tar ball. This script can be used to configure ISC DHCP
to build with libtool and thus use dynamic shared libraries.
Other Highlights:
- The server now supports dhcp-cache-threshold for DHCPv6 operations
- The server now supports DHPv6 address allocation based on EUI-64 DUIDs
- Experimental support for alternate relay port in the both the server
and relay for IPv4, IPv6 and 4o6 (see: draft-ietf-dhc-relay-port-10.txt)
For information on how to install, configure and run this software, as
well as how to find documentation and report bugs, please consult the
README file.
ISC DHCP uses standard GNU configure for installation. Please review the
output of "./configure --help" to see what options are available.
The system has only been tested on Linux, FreeBSD, and Solaris, and may not
work on other platforms. Please report any problems and suggested fixes to
<dhcp-users@isc.org>.
ISC DHCP is open source software maintained by Internet Systems
Consortium. This product includes cryptographic software written
by Eric Young (eay@cryptsoft.com).
Changes since 4.4.0 (New Features)
- none
Changes since 4.4.0 (Bug Fixes)
- A delayed-ack value of 0 (the default), now correctly disables the delayed
feature. A change in 4.4.0 prohibited lease updates marking leases active
from be written to the lease file when delayed-ack is 0. This in turn,
caused servers to lose active lease assignments upon restart.
[ISC-Bugs #47141]
! Option reference count was not correctly decremented in error path
when parsing buffer for options. Reported by Felix Wilhelm, Google
Security Team.
[ISC-Bugs #47140]
CVE: CVE-2018-5733
! Corrected an issue where large sized 'X/x' format options were causing
option handling logic to overwrite memory when expanding them to human
readable form. Reported by Felix Wilhelm, Google Security Team.
[ISC-Bugs #47139]
CVE: CVE-2018-5732
Changes since 4.4.0b1 (New Features)
- Duplicate address detection when binding to a new IPv6 address was added
to the following dhclient scripts: linux,freebsd,netbsd,openbsd, and macos.
The scripts will check for DAD errors after binding to a new IPv6 address
for at most --dad-wait-time seconds. If a DAD error is detected the script
will exit with a value of 3, instructing dhclient to decline the address. If
dad-wait-time is zero (the default), DAD error checking is not peformed.
[ISC-Bugs 46805]
- Support for sending and receiving additional DHCP4 options has been added
to both the dhcpd and dhclient. Specifically: option codes 93,94, and 97
(RFC 4578); code 150 (RFC 5859); and codes 209,219, and 211 (RFC 5071).
Beyond configuring, sending, requesting, and receiving these options neither
server nor client apply any additional logic based on their values.
Thanks to Peter Lewis for requesting this change.
[ISC-Bugs 47062]
Changes since 4.4.0b1 (Bug Fixes)
- Added clarifying text to dhcpd.conf.5 explaining the class match expressions
cannot rely on the results of executable statements.
[ISC-Bugs #45451]
- Fixed a bug which causes dhcpd and dhclient to crash on certain
systems when given relative path names for lease or pid files on
the command line. Affected systems are those on which the C library
function, realpath() does not support a second parameter value of
NULL (see manpages for realpath(3)).
[ISC-Bugs #46957]
- Fixed a build issue when building with embedded BIND9 under OpenBSD that
was causing BIND9 build to not generate dns/enumclass.h and dns/enumtype.h.
[ISC-Bugs #46971]
- Added <dhcp>/m4/README to the distribution tarball. Some versions of
ac_local() treat the absence of the m4 subdirectory as error rather than
warning. This was causing the call to autoreconf, necessary for building
with libtool, to fail.
[ISC-Bugs #47075]
Changes since 4.4.0a1 (New Features)
- Added experimental support for relay port (draft-ietf-dhc-relay-port-10.txt)
feature for DHCPv4, DHCPv6 and DHCPv4-over-DHCPv6. Relay port has to be
enabled at compile time via --enable-relay-port and is fully backward
compatible (i.e. works with previous implementations of servers and relays
using the standard ports). A new --rp <relay-port> command line option
specifies to dhcrelay an alternate source port for upstream (i.e. toward
the server) messages. Thanks to Naiming Shen and Enke Chen of Cisco
systems for submitting these patches.
[ISC-Bugs #44535]
- Added --release-on-roam to dhcpd server. When enabled and the server detects
that a DHCPv6 client (IAID+DUID) has roamed to a new network, it will release
the pre-existing leases on the old network and emit a log statement similar
to the following:
"Client: <id> roamed to new network, releasing lease: <address>"
The server will carry out all of the same steps that would normally occur
when a client explicitly releases a lease. This behavior is disabled by
default and may only be specified globally. Prior to this the server renders
the leases unavailable until they expire or the server is restarted. Clients
that need leases in multiple networks must supply a unique IAID in each IA.
When release-on-roam is disabled (the default) the server maintains the
prior behavior of making such leases unavailable until they expire or the
server is restarted. Clients that need leases in multiple networks must
supply a unique IAID in each IA. This parameter may only be specified at
the global level. Thanks to Fernando Soto from BlueCat Networks for
suggesting this change.
[ISC-Bugs #44576]
[ISC-Bugs #46849]
- Support for delayed-ack is now compiled in by default. Prior to this
it had to be enabled at compile time via --enable-delayed-acks. The
default value for delayed-ack, however, has been changed from 28 to 0
(i.e. disabled). This was done to minimize the impact on users not
currently using the feature. Please note that the delayed-ack feature
is not currently compatible with support for DHPCv4-over-DHCPv6 so
when a 4to6 port command line argument enables this in the server the
delayed-ack value is reset to 0.
[ISC-Bugs #42446]
- The server (-6) now honors the parameter, update-static-leases, for static
(fixed-address6) DHCPv6 leases. It is worth noting that because stateful
data is not retained by the server for static leases, each time a client
requests or renews a static lease, the server will perform DDNS updates for
it. This may have significant performance implications for environments
with many clients that request or renew static leases often. Similarly,
the DNS entries will not be removed by server when a client issues a RELEASE
nor if the lease is deleted from the configuration. In such cases the DNS
entries must be removed manually. This feature is disabled by default.
Thanks to both Bill Shirley and dgutier-at-cern-dot-ch for requesting
this change.
[ISC-Bugs #34097]
[ISC-Bugs #41054]
[ISC-Bugs #41450]
- Added to the server (-6) a new statement, local-address6, which specifies
the source address of packets sent by the server. An additional flag,
bind-local-address6, disabled by default, binds the service socket to
to local-address6. Note that bind-local-address does not work with direct
clients: a relay has to forward packets to the server using the
local-address6 destination.
[ISC-Bugs #46084]
Changes since 4.4.0a1 (Bugs)
- The server now recognizes environment variables PATH_DHCPD_DB and
PATH_DHCPD_PID. These had been incorrectly compiled out of the code
unless DHCPv6 support was disabled. Additionally, the server man
pages were corrected to accurately reflect how the server chooses
file names (see lease-file-name and pid-file-name statements). Thanks
to Fernando Soto at Bluecat Networks for bringing this matter to our
attention.
[ISC-Bugs #46859]
- Removed an "Impossible condition" error upon exit in the dhcpd server that
has been shutdown via OMAPI. This condition was only apparent under Solaris
when building with --enable-use-sockets and --enable-ipv4-pktinfo.
[ISC-Bugs #36118]
- Corrected some minor Coverity issues: CID 1426059, 1426058, and 1426057.
[ISC-Bugs #46836]
- Added missing text to dhclient.8 and expanded release note coverage
for --address-prefix-len changes.
Changes since 4.3.6 (New Features)
- Added --enable-bind-install to install embedded bind includes and
libraries. Default is to not install them (it was the previous
behavior). If you'd like to change the includedir and/or libdir
installation directories to something different than for ISC DHCP
you must pass them using the --with-bind-extra-config configuration
arguments.
[ISC-Bugs #39318]
- Added support of dynamic shared libraries with libtool. A new
--enable-libtool configuration parameter is available but
should not be used directly: *please* read the build configuration
section in the README file for the recommended procedure.
[ISC-Bugs #29402]
- IPv6 operation now supports an EUI-64 based address allocation which will
calculate addresses for clients with EUI-64 DUIDs based on those DUIDs when
enabled by setting use-eui-64 true. The parameter may defined down to the
pool scope. Note this feature must be compiled in by defining EUI_64 in
includes/site.h. This flag is undefined by default.
[ISC-Bugs #43927]
- The directory includes/isc-dhcp and it's only occupant, dst.h, have
been removed from the source tree. They are obsolete for branches
other than v4_1_esv.
[ISC-bugs #45541]
- Replaced ISC licensing with Mozilla Public License, MPL 2.0 licensing
throughout. Please see https://www.mozilla.org/en-US/MPL/2.0/ to read
the MPL 2.0 license terms.
[ISC-Bugs #45541]
- Load balancing for failover peers can now be disabled by setting
"load balance max secs" to 0. Doing so for both peers means both
servers will respond to all DHCPDISCOVERs or DHCPREQUESTs as soon as
they are received.
[ISC-Bugs #39669]
- Added a new dhclient command line parameter, --prefix-len-hint <length>.
When used in conjunction with -P, it directs dhclient to use the given
length as the prefix length hint when requesting prefixes. Thanks to both
Indy, of the FireballISO open source project and H. Peter Anvin for
suggesting this change.
[ISC-Bugs #43792]
[ISC-Bugs #35112]
[ISC-Bugs #32228]
[ISC-Bugs #29470]
- dhclient will now wait for 10 seconds after declining an IPv4 address
before issuing a discover. This is in keeping with RFC 2131, section 3.1.5.
Prior to this dhclient did not wait at all. The amount of time dhclient
waits can be specified via a new command line parameter:
--decline-wait-time <seconds>. A value of zero equates to no wait at all.
Thanks to Pavel Kankovsky for bringing this matter to our attention.
**NOTE: THIS IS CHANGE IN DEFAULT BEHAVIOR.
[ISC-Bugs #45457]
- dhclient will now include the lease address when logging DHCPOFFERs,
DHCPREQUESTs, DHCPACKs, DHCPRELEASEs, and DHCPDECLINEs. Additionally,
DHCPOFFERs will be logged before their corresponding DHCPREQUESTs are
sent and logged.
[ISC-Bugs #2729]
- When given the -T command line argument, in addition to reading the
current lease file, the server will write the leases to a temporary
lease file. This can help detect issues in server configuration that
only surface when leases are written to the file. The current lease
file will not be modified and the temporary lease file is removed upon
completion of the test.
[ISC-Bugs #22267]
- dhclient will now generate a DHCPv6 DECLINE message containing all IA_NA
addresses which for which the client script indicates a DAD failure. After
receiving the DECLINE reply, dhclient will restart the solicit process.
Note, the client script must exit with a value of 3 to signify that the
address failed DAD. Thanks to Jiri Popelka of Red Hat for submitting the
patch that was the foundation for this change.
**NOTE: THIS IS CHANGE IN DEFAULT BEHAVIOR.
[ISC-Bugs #21237]
[ISC-Bugs #23357]
[ISC-Bugs #36966]
- Replaced compilation option, enable-secs-byteorder, with a run-time, server
configuration parameter, check-secs-byte-order. When enabled, the
server will check for clients that do the byte ordering on the secs field
incorrectly. This field should be in network byte order but some clients
get it wrong. When this parameter is enabled the server will examine the
secs field and if it looks wrong (high byte non zero and low byte zero) swap
the bytes. The default is disabled. This parameter is only useful when
doing load balancing within failover.
[ISC-Bugs #45364]
- The default value for server (-6) parameter, prefix-length-mode, has been
changed from "exact" to "prefer". In "prefer" mode the server will offer
the first available prefix with the same length as that requested by the
client. If none are found then it will offer the first available prefix of
any length. This is more in line with with RFC 8168 and should improve
the out-of-the-box user experience.
**NOTE: THIS IS CHANGE IN DEFAULT BEHAVIOR.
[ISC-Bugs #45615]
- Added support for 'dhcp-cache-threshold' to IPv6 operation: If a client
renews before 'dhcp-cache-threshold' percent of its lease has elapsed
(default 25%), the server will reuse the allocated lease (provide a
lease within the currently allocated lease-time) rather than extend or
renew the lease. This allows the server to reply without needlessly
writing leases to disk. The preferred and valid lease lifetimes
sent to the client will be reduced by the age of the lease. The option
may be specified down to the pool level and is supported for all three
pool types: NA, TA, and PD.
[ISC-Bugs #45292]
- Added three new server configuration parameters which influence DDNS:
1. ddns-dual-stack-mixed-mode - alters DNS conflict resolution behavior
to mitigate issues with non-compliant clients in dual stack environments.
2. ddns-guard-id-must-match - relaxes the DHCID RR client id matching
requirement of DNS conflict resolution.
3. ddns-other-guard-is-dynamic - alters dual-stack-mixed-mode behavior to
allow unguarded DNS entries to be overwritten in certain cases
[ISC-Bugs #42620]
[ISC-Bugs #42621]
[ISC-Bugs #44753]
- A "key-algorithm <algorithm>" statement has been added to omshell to
allow the specification of the key algorithm to use during transaction
authentication. Prior to this it was hard-coded to be hmac-md5. It now
supports all of the same algorithms as the dhcpd server: hmac-md5 (the
default), hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and hmac-sha512.
[ISC-Bugs #46771]
- Added a server configuration parameter, persist-eui-64-leases, which
determines whether or not EUI-64 based leases are written to the
leases file. Default is true.
[ISC-Bugs #45046]
- Changed the default value of the prefix length passed by dhclient into the
client script for each IPv6 address from 64 to 128. This was done to comply
with RFC3315bis draft (-09, page 64) and RFC5942, Section 4, point 1.
In addition, dhclient now supports a command line argument,
--address-prefix-len, which may be used to override the default value.
**WARNING**: This change may not be backwardly compatible with your
environment. If you are operating without a router, such as between VMs on
a host, you may find they cannot see each with prefix length of 128. In
such cases, you'll need to either provide routing or use the command line
parameter to set the value to 64. Alternatively you may change the default
at compile time by setting DHCLIENT_DEFAULT_PREFIX_LEN in includes/site.h.
[ISC-Bugs #23252]
[ISC-Bugs #37221]
- Modified dhclient (-6) to bypass sending a confirm (INIT REBOOT) when it has
only expired address associations. Thanks to Jiri Popelka at Red Hat for
raising the issue and submitting the patch.
[ISC-Bugs #22675]
Changes since 4.3.6 (Bugs):
- Corrected an issue where the server would return a client's previously
released prefix lease even when the client provides a prefix length
hint that does not match the prior lease. Now the server will only
return the previous lease if it exactly matches the hint. If not
it will attempt to allocate a new prefix based on the hint and the
prefix-length-mode. Thanks to Tim DeNike - Lightspeed Communications
for pointing out the error of our ways.
[ISC-bugs #45780]
- Added explicit include of BIND9 isc/util.h to adapt to revisions
in BIND9 (see BIND9 ticket #46311). Prior to this the build was failing
with implicit function declarations errors for POST() and INSIST().
[ISC-bugs #46332]
- Added to code ignore empty IPv4 host name option (code 12). While RFC 2132
states the option cannot be empty, some clients are apparently capable of
sending it. Prior to this the server was attempting to use it and store it
in the lease file causing issues with DDNS and so forth.
[ISC-bugs #43786]
- Corrected dhclient command line parsing for --dad-wait-time that causes
even valid values to fail as invalid on some environments.
[ISC-Bugs #46535]
- Replaced iasubopt::heap_index with separate values for active and inactive
heaps: iasubopt::active_index and iasubopt::inactive_index. This was done
to accommodate a change in behavior in BIND9 isc_heap_delete().
[ISC-bugs #46719]
! Plugged a socket descriptor leak in OMAPI, that can occur when there is
data pending to be written to an OMAPI connection, when the connection
is closed by the reader. Thanks to Pavel Zhukov at RedHat for bringing
this issue to our attention and whose patch helped guide us in the right
direction.
[ISC-Bugs #46767]
- The ability of the server to send back dhcp6.vendor-opts values has been
restored. A change in 4.3.5 (see #29246) which enabled it to send back the
FQDN option unfortunately broke its ability send back dhcp6.vendor-opts.
Thanks to Sumant Gupta (sumantgupta at gmail dot com) of Landis+Gry for
bringing this issue to our attention.
[ISC-Bugs #46427]
Changes since 4.3.6b1
- None
Changes since 4.3.5
- The server now allows the client identifier (option 61) to own leases
in more than one subnet concurrently. Prior to this the server would
incorrectly release an existing lease in one subnet prior to assigning
a lease in another subnet. Note that the prior behavior can be still
be achieved by enabling one-lease-per-client. Thanks to both David Zych at
the University of Illinois and Norm Proffitt of Infoblox for reporting
the issue; and Norm for suggesting a solution.
[ISC-Bugs #41358]
- When replying to a DHCPINFORM, the server will now include options specified
at the pool scope, provided the ciaddr field of the DHCPINFORM is populated.
Prior to this the server only evaluated options down to the subnet scope.
Thanks to Fernando Soto at BlueCat Networks for reporting the issue.
[ISC-Bugs #43219]
[ISC-Bugs #45051]
- When memory allocation fails in a repeated way the process writes
"Run out of memory." on the standard error and exists with status 1.
[ISC-Bugs #32744]
- The new lmdb (Lightning Memory DataBase) bind9 configure option is
now disabled by default to avoid the presence of this library to be
detected which can lead to a link failure.
[ISC-Bugs #45069]
- The linux interface discovery code has been modified to use getifaddrs()
as is done for BSD and OS-X. Prior to this the code would only recognize
the first address on an interface and thereby omit vlans.
Thanks to Jiri Popelka at Redhat, Marius Tomaschewski at SUSE, and Wei
Kong at Novell, who all submitted patches.
[ISC-Bugs #28761]
[ISC-Bugs #31992]
[ISC-Bugs #25428]
[ISC-Bugs #31940]
[ISC-Bugs #32935]
- Fixed a bug in OMAPI that causes omshell to crash when a name-value
pair with a zero length value is shipped in an object. Thanks to
Fernando Soto at BlueCat Networks for reporting the issue and
supplying the patch.
[ISC-Bugs #29108]
- On 64-bit platforms, dhclient now generates the correct value for the
script environment variable, "expiry", the lease expiry value exceeds
0x7FFFFFFF. Prior to this such values would produce negative values
for expiry in the script environment.
[ISC-Bugs #43326]
- Common timer logic was modified to cap the maximum timeout values at
0x7FFFFFFF - 1. Values larger than that were causing fatal timer out of
range errors on 64-bit platforms. Thanks to Jiri Popelka at Red Hat for
reporting the issue.
[ISC-Bugs #28038]
- DHCP6 FQDN option unpacking code now correctly handles values that contain
spaces, special, or non-printable characters. Prior to this the buffer
size needed was underestimated causing a conversion error message to
be logged and DNS updates to be skipped. Thanks to Fernando Soto at
BlueCat Networks for bringing the matter to our attention.
[ISC-Bugs #43592]
- When running in -6 mode, dhclient can enforce the require option statement
and will discard offered leases that do not contain all the required
options specified in the client configuration. If not enabled the client
will still consider such leases. This must be enabled at compile time
(see ENFORCE_DHCPV6_CLIENT_REQUIRE in includes/site.h). Thanks to
Mritunjaykumar Dubey at Nokia for reporting the issue.
[ISC-Bugs #41473]
- Altered DHCPv4 lease time calculation to avoid roll over errors on 64-bit
OS systems when using -1 or large values for default-lease-time. Rollover
values will be replaced with 0x7FFFFFFF - 1. This alleviates unintentionally
short expiration times being handed out when infinite lease times (-1) in
conjunction with failover. Our thanks to Alessandro Gherardi for bringing
the issue to our attention.
[ISC-Bugs #41976]
- Added new compile time option --with-srv-conf-file which specifies a
default location of the server configuration file.
[ISC-Bugs #44765]
- Added --dad-wait-time parameter to dhclient. It specifies the maximum time,
in seconds, that the client process should wait for the duplicate address
detection to complete before initiating DHCP requests. This value is
propagated to the dhclient script and the script is responsible for waiting
the specified amount of time or until DAD has completed. If the script does
not support it, specifying this parameter has no effect. The default value
is 0 which specifies that the script should not wait for DAD. With this
change the following scripts have been modified to support the new parameter:
freebsd, linux, macos, netbsd, openbsd.
[ISC-Bugs #36169]
- The server nows checks both the address and length of a prefix delegation
when attempting to match it to a prefix pool. This ensures the server
responds properly when pool configurations change such that once valid,
"in-pool" delegations are now treated as being invalid. During lease
file loading at startup, the server will discard any PD leases that
are deemed "out-of-pool" either by address or mis-matched prefix length.
Clients seeking to renew or rebind such leases will get a response of
No Binding in the case of the former, and the prefix delegation with
lifetimes set to zero in the case of the latter. Thanks to Mark Nejedlo
at TDS Telecom for reporting this issue.
[ISC-Bugs #35378]
- Modified DDNS support initialization such that DNS related ports will only be
opened by the server (dhcpd) at startup if ddns-update-style is not "none";
by dhclient only if and when the it first attempts an update; and never by
dhcrelay. Prior to this all three always did the initialization at startup
which causes them to always open on and listen for traffic on two random
ports. Thanks to Rodney Beede for reporting this issue.
[ISC-Bugs #45290]
[ISC-Bugs #33377]
- Added error logging to two memory allocation failure checks. Thanks to Bill
Parker (wp02855 at gmail dot com) for reporting the issue.
[ISC-Bugs #41185]
- Corrected a dhclient -6 issue that caused the client to crash with an
"Impossible condition" error after de-preferencing its only IA binding.
The crash occurred when server configuration changes rendered the existing
binding out-of-range and no other leases were available to offer. Thanks
to Pierre Clerissi for bringing this issue to our attention.
[ISC-Bugs #44373]
- By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h, dhclient will
now call the script with reason set to FAIL when run with -1 (one try) and
there are no server responses. This applies to IPv4 mode only. Thanks for a
patch by Martin Pitt which got to us via Andrew Pollock.
[ISC-bugs #18183]
- The server now detects failover peers that are not referenced in at least
one pool when run with the command line option for test mode, -T. Prior to
this the check was performed too far down stream to be detected in test mode.
[ISC-Bugs #29892]
- Linux script updated. The script is now based on Debian version. It uses
ip tool from iproute2 package and ifconfig is no longer used. This also
addresses an issue of calling arping with inappropriate parameter.
[ISC-bugs #19430]
[ISC-bugs #18111]
- Changed severity of the log message indicating UDP checksum errors in
the received packets from 'info' to 'debug' to avoid logging excessive
number of false positives when UDP checksum offloading is enabled.
[ISC-bugs #41757]
- The directory minires has been removed from the source tree. It has
long been obsolete for branches other than v4_1_esv. Additionally,
includes/minires.h was renamed includes/ns_name.h.
[ISC-bugs #45471]
- Replaced ifconfig parameters "add" and "delete" with "alias" and "-alias"
for IPv6 mode in the client scripts, netbsd and openbsd. This was
preventing IPv6 addresses from being added or removed from interfaces.
Thanks to Tim Dean for reporting this issue.
[ISC-bugs #31573]
Changes since 4.3.5b1
- Corrected a bug which could cause the server to sporadically crash while
loading lease files with the lease-id-format is set to "hex". Our thanks
to Jay Ford, University of Iowa for reporting the issue.
[ISC-Bugs #43185]
- Eliminated a noisy, but otherwise harmless debug log statment that may
appear during server startup when building with --enable-binary-leases
and configuring multiple pools in a shared network. Thanks to Fernando
Soto from BlueCat Networks for reporting the issue and supplying a patch.
[ISC-Bugs #43262]
Changes since 4.3.4
- Fixed util/bindvar.sh error handling.
[ISC-Bugs #41973]
- Correct error message in relay to use remote id length instead
of circuit id length.
[ISC-Bugs #42556]
- Add logic to test directory Makefiles to avoid copying Attfile(s)
when building within the source tree. This eliminates a noisy but
otherwise harmless error message when running "make check".
[ISC-Bugs #41883]
- Leases are now scrubbed of certain prior use information when pool
re-balancing reassigns them from one FO peer to the other. This
corrects an issue where leases that were offered but not used
by the client retained the client hostname from the original
client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
for reporting the issue.
[ISC-Bugs #42008]
- In the LDAP code and schema add some missing '6' characters to use
the v6 instead of the v4 versions. Thanks to Denis Taranushin for
reporting this issue and supplying its patch.
[ISC-Bugs #42666]
- Correct how the pick-first-value expression is written to a lease
file. Previously it was written as a concat expression due to
a cut and paste error.
[ISC-Bugs #42253]
- Modify the DDNS code to clean up the PTR record even if there
are issues while cleaning up the A or AAAA records.
[ISC-Bugs #23954]
- Added global configuration parameter, abandon-lease-time, which determines
the amount of time a lease remains abandoned. The default is 84600 seconds.
Additionaly, the server now conducts a ping check (if ping checks are
enabled) prior to offering an abandoned lease to client. Our thanks to
David Zych at University of Illinois for reporting the issue and working
with us to produce a viable solution.
[ISC-Bugs #41815]
- Correct handling of interface names during interface discovery. This
addresses an issue where interface names of 15 characters in length
could lead to crashes or interface recognition errors during startup
of dhcpd, dhclient, and dhcrelay.
[ISC-Bugs #42226]
- Updates to contrib/dhcp-lease-list.pl to make it more friendly.
The updates are: looking for the lease file in more places and skipping
the "processing complete" output when creating machine readable
output. Thanks to Cameron Paine (cbp at null dot net) for the
patch.
[ISC-Bugs #42113]
- When reusing a lease for dhcp-cache-threshold return the hostname
to the original lease. Also if the host pointer, UID or hardware address
change don't allow reuse of the lease.
Thanks to Michael Vincent for reporting this and helping us
verify the problem and fix.
[ISC-Bugs #42849]
- Change dmalloc to use a size_t as the length argument to bring it
in line with the call it will make to malloc().
[ISC-Bugs #40843]
- If the failover socket can't be bound, close it. Otherwise if the
user configures an incorrect address in the failover stanza the
server will continue to open new sockets every 90 seconds until
it runs out.
[ISC-Bugs #42452]
- Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
allow interfaces to be upstream or downstream respectively. Upstream
interfaces will accept and forward only BOOTP replies, while downstream
interfaces will accept and forward only BOOTP requests.
[ISC-Bugs #41547]
- Clean up some memory references in the vendor-class construct.
[ISC-Bugs #42984]
Changes since 4.3.4b1
- None
Changes since 4.3.3
- Corrected a static analyzer warning in common/execute.c
[ISC-Bugs #40374]
- ISC DHCP now follows the common convention to use the base name a
program is invoked with (aka argv[0], vs. a builtin name) for
logs. This should help differentiate syslog entries for DHCPv4 and
DHCPv6 servers. You can define OLD_LOG_NAME in includes/site.h to
keep the previous behavior.
[ISC-Bugs #38692]
- The Linux packet filter code now correctly treats only the least significant
12 bits in an inbound packet's TCI value as the VLAN id (per IEEE 802.1Q).
Prior to this it was using the entire 16 bit value as the VLAN id and
incorrectly discarding packets. Thanks to Jiri Popelka at Red Hat for
reporting this issue and supplying its patch.
[ISC-Bugs #40591]
- Fixed several static analysis issues such as potential null
references, unchecked strdup returns. Thanks to Bill Parker (wp02855 at
gmail dot com) who identified these issues and supplied patches to
address them.
[ISC-Bugs #40754]
[ISC-Bugs #40823]
- Corrected compilation errors that prohibited building the server
and its ATF unit tests when failover is disabled.
[ISC-Bugs #40372]
- Added the lease address to the end of the debug level log message
emitted when an existing lease is renewed within the dhcp-cache-threshold.
Thanks to Nathan Neulinger at Missouri S&T for suggesting the change.
[ISC-Bugs #40598]
- Added dhcpv6 and delayed-ack to settings listed in the "Features:"
section of the configure script output. Additionally, all of the
features reported on will now always show either a "yes" or "no"
value. Prior to this features left to their default setting would
not show a value.
[ISC-Bugs #40381]
- Added a parameter, authoring-byte-order, to the lease file. This value
is automatically added to the top of new lease files by the server and
indicates the internal byte order (big endian or little endian) of the
server. This permits lease files generated on a server with one form of
byte order to be used on a server with the opposite form. Our thanks to
Timothe Litt for calling this to our attention and for the suggestions
he provided.
[ISC-Bugs #38396]
- Fixed a small memory leak in the DHCPv6 version of the client code.
This is unlikely to cause significant issues in actual use.
[ISC-Bugs #40990]
- Corrected a few minor memory leaks in omapi's dereferencing of
host objects. Thanks to Jiri Popelka at Red Hat for reporting
the issue and supplying the patches.
[ISC-Bugs #33990]
[ISC-Bugs #41325]
- Cleaned up some of the Make infrastructure to make --with-libbind
work better. Though it still only works with an absolute path.
[ISC-Bugs #39210]
- Made the embedded bind libraries able to be cross compiled
(please refer to the bind9 documentation to learn how to cross
compile DHCP and its bind library dependency).
[ISC-Bugs #38836]
- Update the client code to better support getting IA_NAs and IA_PDs
in the same packet, see RFC7550 for some discussion.
[ISC-Bugs #40190]
! Update the bounds checking when receiving a packet.
Thanks to Sebastian Poehn from Sophos for the bug report and a suggested
patch.
[ISC-Bugs #41267]
CVE: CVE-2015-8605
- When handling an incorrect command line for dhcpd, dhclient or dhcrelay
print out a specific error message about the first error in addition
to the usage string. This may be disabled by editing includes/site.h.
[ISC-Bugs #40321]
[ISC-Bugs #41454]
- The configure script will now exit with an error message if it cannot find
a GNU-style make tool (needed when building BIND libraries) or pkg-config
(needed to locate ATF used for building unit tests). Prior to this the
script would exit indicating success causing subsequent attempts to build
the software to fail.
[ISC-Bugs #40371]
- Properly terminate strings before passing them to regex and fix
a boundary error when creating certain new data strings.
Thanks to Andrey Jr. Melnikov for the bug report.
[ISC-Bugs #41217]
- Option expressions, such as prepend and append, are now supported when
running dhclient for IPv6. Prior to this such statements in the
client configuration file would be parsed but have no affect. Thanks
to Jiri Popelka at Red Hat for reporting the issue.
[ISC-Bugs #39952]
- A failover primary server will now accept a binding status update from the
secondary which transitions a lease from ACTIVE to ABANDONED. This accounts
for instances in which a client declines a lease and only the secondary
server receives it. Prior to this the primary server would reject such an
update as an "invalid state transition".
[ISC_BUGS #25189]
- Properly allocate memory for a bpf filter.
Thanks to Bill Parker (wp02855 at gmail dot com) who identified this issue.
[ISC-Bugs #41485]
- Updated contrib/dhcp-lease-list.pl to handle garbage in the oui file better
and to print out the hostnames a bit better.
Thanks to Antoine Beaupré from Debian for the suggested patch.
[ISC-Bugs #41288]
- The DHCPv6 server now handles long valid and preferred lease times better.
Values that would cause the internal end time of the lease to wrap are
modified to work as infinite.
[ISC-Bugs #40773]
- Updated support for cross compiling by allowing the library archiver
to be set at configure time via the environment variable 'AR'.
[ISC-Bugs #41536]
- The server will now match DHCPv6 relayed clients to host declarations
which include the "hardware" statement, if the relay connected to the
client supplies the client's hardware address via client-linklayer-address
option as per RFC 6939.
[ISC-Bugs #40334]
- Allow a filename to be specified instead of /dev/random during
configuration. This is passed to the BIND configuration to allow
for cross compilation.
[ISC-Bugs #33835]
- Add more option definitions.
[ISC-Bugs #40562]
- Correct outputting of long lines in the lease file when writing
a lease that includes long strings in an execute statement.
[ISC-Bugs #40994]
- The server will now correctly treat a lease as reserved when the client
requests an infinite lease time (i.e. OxFFFFFFFF) and "infinite-is-reserved"
is enabled. Prior to this the server would halt. In addition, corrections
were made to the server to allow a lease's flags field to be set via omapi.
Prior to this, the server, depending on the host architecture, would
incorrectly parse the new flags value from the omapi message.
[ISC-Bugs #31179]
- ISC DHCP can now be configured and built from a directory other than
the top level source directory. Note that "make distcheck" uses this
feature.
[ISC-Bugs #39262]
- Add support for RFC 3527 to dhcrelay. A new, dhcrelay command line argument,
"-U <interface>" enables the addition of a RFC 3527 compliant link selection
suboption to the agent option added for clients directly connected to the
relay.
[ISC-Bugs #34875]
[ISC-Bugs #41708]
- Add a new global DHCPv6 option, dhcpv6-set-tee-times, which when enabled
instructs the server to calculate T1 and T2 as recommended in RFC 3315,
Section 22.4.
[ISC-Bugs #25687]
- Corrected minor Coverity issues.
[ISC-Bugs #35144]
- Add support for RFC 7341 DHCPv4 over DHCPv6 with a new configuration
option "--enable-dhcpv4o6". Note this feature requires DHCPv6 support
and is not compatible with delayed-ack. Both client and server use 2
processes which communicate over UDP on a pair of sockets. The new
"-4o6 <port>" command line argument enables DHCPv4 over DHCPv6 support
and specifies the consecutive ports to use for inter-process communication.
Please look at doc/DHCPv4-over-DHCPv6 for more details.
[ISC-Bugs #35711]
- Correct interface name formation when using DLPI under Solaris 11. As of
Solaris 11, ethernet device files are located in "/dev/net". The configure
script has been modified to detect this situation and adjust the directory
used accordingly. Thanks to Jarkko Torppa for reporting this issue and
submitting a patch
[ISC-Bugs #37954]
[ISC-Bugs #40752]
- Add a dereference call when handling an error condition while
decoding a packet.
[ISC-Bugs #41774]
- Add a new parameter, lease-id-format, to both dhcpd and dhclient. The
parameter controls the format in which certain values are written to lease
files. Formats supported are octal - quoted string containing octal
escapes, and hex - unquoted, colon separated hex digits. Thanks to
Jay Ford, University of Iowa for bringing the issue to our attention.
[ISC-Bugs #26378]
! Add an option in site.h to limit the number of failover and control
connections the server will accept. By default this is 200.
[ISC-Bugs #41845]
CVE: CVE-2016-2774
* [Sec 3454] Unauthenticated packet can reset authenticated interleave
associations. HStenn.
* [Sec 3453] Interleaved symmetric mode cannot recover from bad state. HStenn.
* [Sec 3415] Permit blocking authenticated symmetric/passive associations.
Implement ippeerlimit. HStenn, JPerlinger.
* [Sec 3414] ntpq: decodearr() can write beyond its 'buf' limits
- initial patch by <stenn@ntp.org>, extended by <perlinger@ntp.org>
* [Sec 3412] ctl_getitem(): Don't compare names past NUL. <perlinger@ntp.org>
* [Sec 3012] Sybil vulnerability: noepeer support. HStenn, JPerlinger.
* [Bug 3457] OpenSSL FIPS mode regression <perlinger@ntp.org>
* [Bug 3455] ntpd doesn't use scope id when binding multicast <perlinger@ntp.org>
- applied patch by Sean Haugh
* [Bug 3452] PARSE driver prints uninitialized memory. <perlinger@ntp.org>
* [Bug 3450] Dubious error messages from plausibility checks in get_systime()
- removed error log caused by rounding/slew, ensured postcondition <perlinger@ntp.org>
* [Bug 3447] AES-128-CMAC (fixes) <perlinger@ntp.org>
- refactoring the MAC code, too
* [Bug 3441] Validate the assumption that AF_UNSPEC is 0. stenn@ntp.org
* [Bug 3439] When running multiple commands / hosts in ntpq... <perlinger@ntp.org>
- applied patch by ggarvey
* [Bug 3438] Negative values and values > 999 days in... <perlinger@ntp.org>
- applied patch by ggarvey (with minor mods)
* [Bug 3437] ntpd tries to open socket with AF_UNSPEC domain
- applied patch (with mods) by Miroslav Lichvar <perlinger@ntp.org>
* [Bug 3435] anchor NTP era alignment <perlinger@ntp.org>
* [Bug 3433] sntp crashes when run with -a. <stenn@ntp.org>
* [Bug 3430] ntpq dumps core (SIGSEGV) for "keytype md2"
- fixed several issues with hash algos in ntpd, sntp, ntpq,
ntpdc and the test suites <perlinger@ntp.org>
* [Bug 3424] Trimble Thunderbolt 1024 week millenium bug <perlinger@ntp.org>
- initial patch by Daniel Pouzzner
* [Bug 3423] QNX adjtime() implementation error checking is
wrong <perlinger@ntp.org>
* [Bug 3417] ntpq ifstats packet counters can be negative
made IFSTATS counter quantities unsigned <perlinger@ntp.org>
* [Bug 3411] problem about SIGN(6) packet handling for ntp-4.2.8p10
- raised receive buffer size to 1200 <perlinger@ntp.org>
* [Bug 3408] refclock_jjy.c: Avoid a wrong report of the coverity static
analysis tool. <abe@ntp.org>
* [Bug 3405] update-leap.in: general cleanup, HTTPS support. Paul McMath.
* [Bug 3404] Fix openSSL DLL usage under Windows <perlinger@ntp.org>
- fix/drop assumptions on OpenSSL libs directory layout
* [Bug 3399] NTP: linker error in 4.2.8p10 during Linux cross-compilation
- initial patch by timeflies@mail2tor.com <perlinger@ntp.org>
* [Bug 3398] tests fail with core dump <perlinger@ntp.org>
- patch contributed by Alexander Bluhm
* [Bug 3397] ctl_putstr() asserts that data fits in its buffer
rework of formatting & data transfer stuff in 'ntp_control.c'
avoids unecessary buffers and size limitations. <perlinger@ntp.org>
* [Bug 3394] Leap second deletion does not work on ntpd clients
- fixed handling of dynamic deletion w/o leap file <perlinger@ntp.org>
* [Bug 3391] ntpd segfaults on startup due to small warmup thread stack size
- increased mimimum stack size to 32kB <perlinger@ntp.org>
* [Bug 3367] Faulty LinuxPPS NMEA clock support in 4.2.8 <perlinger@ntp.org>
- reverted handling of PPS kernel consumer to 4.2.6 behavior
* [Bug 3365] Updates driver40(-ja).html and miscopt.html <abe@ntp.org>
* [Bug 3358] Spurious KoD log messages in .INIT. phase. HStenn.
* [Bug 3016] wrong error position reported for bad ":config pool"
- fixed location counter & ntpq output <perlinger@ntp.org>
* [Bug 2900] libntp build order problem. HStenn.
* [Bug 2878] Tests are cluttering up syslog <perlinger@ntp.org>
* [Bug 2737] Wrong phone number listed for USNO. ntp-bugs@bodosom.net,
perlinger@ntp.org
* [Bug 2557] Fix Thunderbolt init. ntp-bugs@bodosom.net, perlinger@ntp.
* [Bug 948] Trustedkey config directive leaks memory. <perlinger@ntp.org>
* Use strlcpy() to copy strings, not memcpy(). HStenn.
* Typos. HStenn.
* test_ntp_scanner_LDADD needs ntpd/ntp_io.o. HStenn.
* refclock_jjy.c: Add missing "%s" to an msyslog() call. HStenn.
* Build ntpq and libntpq.a with NTP_HARD_*FLAGS. perlinger@ntp.org
* Fix trivial warnings from 'make check'. perlinger@ntp.org
* Fix bug in the override portion of the compiler hardening macro. HStenn.
* record_raw_stats(): Log entire packet. Log writes. HStenn.
* AES-128-CMAC support. BInglis, HStenn, JPerlinger.
* sntp: tweak key file logging. HStenn.
* sntp: pkt_output(): Improve debug output. HStenn.
* update-leap: updates from Paul McMath.
* When using pkg-config, report --modversion. HStenn.
* Clean up libevent configure checks. HStenn.
* sntp: show the IP of who sent us a crypto-NAK. HStenn.
* Allow .../N to specify subnet bits for IPs in ntp.keys. HStenn, JPerlinger.
* authistrustedip() - use it in more places. HStenn, JPerlinger.
* New sysstats: sys_lamport, sys_tsrounding. HStenn.
* Update ntp.keys .../N documentation. HStenn.
* Distribute testconf.yml. HStenn.
* Add DPRINTF(2,...) lines to receive() for packet drops. HStenn.
* Rename the configuration flag fifo variables. HStenn.
* Improve saveconfig output. HStenn.
* Decode restrict flags on receive() debug output. HStenn.
* Decode interface flags on receive() debug output. HStenn.
* Warn the user if deprecated "driftfile name WanderThreshold" is used. HStenn.
* Update the documentation in ntp.conf.def . HStenn.
* restrictions() must return restrict flags and ippeerlimit. HStenn.
* Update ntpq peer documentation to describe the 'p' type. HStenn.
* Rename restrict 'flags' to 'rflags. Use an enum for the values. HStenn.
* Provide dump_restricts() for debugging. HStenn.
* Use consistent 4th arg type for [gs]etsockopt. JPerlinger.
* Some tests might need LIBM. HStenn.
* update-leap: Allow -h/--help early. HStenn.
* dhcp6: fix a null termination overflow on status messages
* options: static routes can be setup in global context again
* routes: dhcpcd added host routes are now reported correctly
Fixes PR port-vax/53039: GCC/VAX hits ICE building libstdc++
GCC wants to change the label and then doesn't recognise the
new insn, it believes it doesn't satisfy the memory_operand
predicate.
It appears the memory_operand predicate doesn't accept volatile
memory accesses during the RTL generation phase.
The predicate is from rs6000 code.
from krister
-mindirect-branch=<choice>
-mfunction-return=<choice>
-mindirect-branch-register
the values for 'choice' are "keep" (default, existing behaviour),
"thunk", "thunk-inline", and "thunk-extern".
as taken from the Ubuntu port of these changes in their
ubuntu:gcc-5_5.5.0-8ubuntu1.diff. i've also included the doc
updates that are missing from ubuntu from gcc itself.
i've tested both i386 and amd64 fairly heavily with these options
enabled in both kernels and userland, atf runs and hundreds of
package builds.
XXX: pullup-8 to gcc/ not gcc.old/
-mindirect-branch=<choice>
-mfunction-return=<choice>
-mindirect-branch-register
the values for 'choice' are "keep" (default, existing behaviour),
"thunk", "thunk-inline", and "thunk-extern".
as taken from the Debian port of these changes in their
debian:gcc-6_6.3.0-18+deb9u1.diff. i've also included the doc
updates that are missing from debian from gcc itself.
i've tested both i386 and amd64 fairly heavily with these options
enabled in both kernels and userland, atf runs and hundreds of
package builds.
indirectness first. In the case of various Qt5 libraries, __bss_start
ends up with a Qt5 version, but it has to be resolved first to match the
actual (implicit) definition. This fixes the root cause of pkg/53089.
* Added support for setproctitle(3)
* Kernel RA is no longer disabled when IPv6 is disabled in dhcpcd
* DHCPv6 PD is no longer stopped if no Routers are found
* If the DHCP leased address is deleted, enter the reboot state
* DHCPv6 unicast is no longer performed when not in master mode
* dhcpcd will now detect netlink/route socket overflows ad re-sync
Summary of changes in tzdata2018d (2018-03-22 07:05:46 -0700):
In 2018, Palestine starts DST on March 24 (today!), not March 31
Casey Station in Antarctica changed from +11 to +08 on 2018-03-11
at 04:00.
Various adjustments to some historical conversions (several for
Uruguay (1920 .. 1990), one fpr Enderbury and Kiritimati (1994/5),
one for Portugal and colonies (1912) and Jamaica and Turks & Caicos
(pre 1913)).
Summary of changes in tzdata2018d (2018-03-22 07:05:46 -0700):
In 2018, Palestine starts DST on March 24 (today!), not March 31
Casey Station in Antarctica changed from +11 to +08 on 2018-03-11
at 04:00.
Various adjustments to some historical conversions (several for
Uruguay (1920 .. 1990), one fpr Enderbury and Kiritimati (1994/5),
one for Portugal and colonies (1912) and Jamaica and Turks & Caicos
(pre 1913)).
- remove old package makefiles
- update makekeys for Xfuncproto.h being a real file now
- clean up deleted package X11SRCDIR.pkg settings
this should be functionally equivalent.
that are needed by the new dtrace. these don't do anything yet,
but dtrace doesn't mind. I'll do a full resync to the latest FreeBSD
libproc / librtld_db later.
- local HOST_WIDE_INT_CONSTANT macro same as new HOST_WIDE_INT_C macro,
so use it instead, and remove the local macro.
- re-port the genrecog.c change which was missed in early GCC-6 port.
this makes sh3 work again.
Dec 11, 2017
Bugfixes
ignore fallthrough compiler warning in flex EOF rule.
Fix warnings emitted by clang for --enable-packed. Alignment is not a problem for x86_64, don't enable packed when the platform requires aligned access.
Fix spelling error in xfr-inspect.
Fix 3392: Fix regression in 4.1.18 for notify lists with ip4 and ip6 targets.
Add test for support of -Wno-address-of-packed-member for --enable-packed.
NSD 4.1.18
Nov 30, 2017
Features
xfr-inspect, it is not installed, it prints xfr files from /tmp made with 'make xfr-inspect' in the source dir.
retry timeout between sending notifies dropped from 15 to 3 sec.
NSD sends 16 notifies simultaneously.
configure --enable-packed reduces memory usage, at expense of unaligned reads. Saves about 17%.
Save memory by selectively allocate precompiled nsec3 hashes, saves about 16% memory.
make ip-transparent option work on OpenBSD.
Save about 2% memory by changing usage count size in name tree.
Fix#2871: Increase number of sockets for xfrd transfers.
Bugfixes
Fix gcc 7.1.1 warnings.
Fix writev compile warning on FreeBSD.
Fix#1446: A corrupted zone file "propagates" to good ones.
nsd-control zonestatus prints wait time between attempts, for zones that are in that waiting time.
Fix collision printout of nsec3 to print name, hash and reverse.
Fix#1567: Change crit to err log level for gettimeofday failure. Add defines for compile without syslog.
Fix crash for DS query when parent and child zones both configured in nsd.conf and parent zone has not loaded properly.
NSD 4.1.17
Jul 21, 2017
Features
zone parser parses type AVC (it has TXT format).
Fix#1272: use writev to put tcp length field with data for outgoing zone transfer requests.
Bugfixes
Fix potential null pointer in nsec3 adjustment tree.
Fix text format of deletes for CDS and CDNSKEY, single 0 to represent empty base64 or hex string.
NSD 4.1.16
Apr 25, 2017
Features
zone parser can parse acronyms for algorithms ED25519 and ED448.
Fix 1243: Option to make NSD emit really minimal responses, minimal-responses: yes in nsd.conf.
Bugfixes
Calculate new udb index after growing the array, fix from Chaofeng Liu.
Fix missing _t to _type conversion for disable-radix-tree option.
Printout serial error with hint it may be too big.
Fix 1228: OpenSSL include is not guarded with HAVE_SSL
Patch for expire state in multi-master when masters includes broken master, from Manabu Sonoda.
minor manpage fix.
NSD 4.1.15
Feb 16, 2017
Bugfixes
Fix nsd-control and ipv6 only.
Squelch zone transfer error address family not supported by protocol at low verbosity levels.
Fix#1195: Fix so that NSD fails on non-compliant values for Serial.
Fix to rename _t typedefs because POSIX reserves them.
Fix that nsec3 hash collisions only reported on verbosity level 3.
- use ${G_OBJS} directly, it avoids issues with .c vs .cc files.
- add a method to not rm -rf .ab for inspection.
- fix and add missing depends for many things.
- use -Wno-error for mips and arm insn-recog.c, due to eg:
insn-recog.c:10304:7: error: this decimal constant is unsigned only in ISO C90 [-Werror]
mips.md:3474:11: error: this decimal constant is unsigned only in ISO C90 [-Werror]
