* [Cerowrt-devel] Fwd: [Dnsmasq-discuss] Announce: dnsmasq-2.73rc1
[not found] <550B5ED4.7000003@thekelleys.org.uk>
@ 2015-03-20 2:33 ` Dave Taht
2015-03-23 15:13 ` Kevin Darbyshire-Bryant
0 siblings, 1 reply; 2+ messages in thread
From: Dave Taht @ 2015-03-20 2:33 UTC (permalink / raw)
To: cerowrt-devel
dang it, now I guess I have yet another reason to do a new release of
cero. Nicely elegant dnssec timestamp fix, in particular.
I am going to cut another pure openwrt release for ubnt this weekend
and do a test deployment.
---------- Forwarded message ----------
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Thu, Mar 19, 2015 at 4:42 PM
Subject: [Dnsmasq-discuss] Announce: dnsmasq-2.73rc1
To: dnsmasq-discuss@thekelleys.org.uk
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I want to start the release-process towards 2.73. There's a whole heap
of good stuff since 2.72, and good reasons to get it out there before
proceeding further with stuff that's in progress.
Please test if you can, code is available at
http://www.thekelleys.org.uk/dnsmasq/release-candidates/dnsmasq-2.73rc1.tar.gz
Release notes below.
Cheers,
Simon.
version 2.73
Fix crash at startup when an empty suffix is supplied to
--conf-dir, also trivial memory leak. Thanks to
Tomas Hozza for spotting this.
Remove floor of 4096 on advertised EDNS0 packet size when
DNSSEC in use, the original rationale for this has
long gone. Thanks to Anders Kaseorg for spotting this.
Use inotify for checking on updates to /etc/resolv.conf and
friends under Linux. This fixes race conditions when the
files are updated rapidly and saves CPU by not polling. To
build a binary that runs on old Linux kernels without
inotify, use make COPTS=-DNO_INOTIFY
Fix breakage of --domain=<domain>,<subnet>,local - only
reverse queries were intercepted. THis appears to have been
broken since 2.69. Thanks to Josh Stone for finding the bug.
Eliminate IPv6 privacy addresses and deprecated addresses
from the answers given by --interface-name. Note that
reverse queries(ie looking for names, given addresses) are
not affected.
Thanks to Michael Gorbach for the suggestion.
Fix crash in DNSSEC code with long RRs. Thanks to
Marco Davids for the bug report.
Add --ignore-address option. Ignore replies to A-record
queries which include the specified address. No error is
generated, dnsmasq simply continues to listen for another
reply. This is useful to defeat blocking strategies which
rely on quickly supplying a forged answer to a DNS
request for certain domains, before the correct answer can
arrive. Thanks to Glen Huang for the patch.
Revisit the part of DNSSEC validation which determines if
an unsigned answer is legit, or is in some part of the DNS
tree which should be signed. Dnsmasq now works from the
DNS root downward looking for the limit of signed
delegations, rather than working bottom up. This is
both more correct, and less likely to trip over broken
nameservers in the unsigned parts of the DNS tree
which don't respond well to DNSSEC queries.
Add --log-queries=extra option, which makes logs easier
to search automatically.
Add --min-cache-ttl option. I've resisted this for a long
time, on the grounds that disbelieving TTLs is never a
good idea, but I've been persuaded that there are
sometimes reasons to do it. (Step forward, GFW).
To avoid misuse, there's a hard limit on the TTL
floor of one hour. Thansk to RinSatsuki for the patch.
Cope with multiple interfaces with the same link-local
address. (IPv6 addresses are scoped, so this is allowed.)
Thanks to Cory Benfield for help with this.
Add --dhcp-hostsdir. This allows addition of new host
configurations to a running dnsmasq instance much more
cheaply than having dnsmasq re-read all its existing
configuration each time.
Don't reply to DHCPv6 SOLICIT messages if we're not
configured to do stateful DHCPv6. Thanks to Win King Wan
for the patch.
Fix broken DNSSEC validation of ECDSA signatures.
Add --dnssec-timestamp option, which provides an automatic
way to detect when the system time becomes valid after boot
on systems without an RTC, whilst allowing DNS queries
before the clock is valid so that NTP can run. Thanks to
Kevin Darbyshire-Bryant for developing this idea.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlULXtQACgkQKPyGmiibgrcgpACgigRXmppeFY2YNMUceMOSsCsk
boIAoKYi3cLBqIS+RptX63B+EJlaOGJ5
=EA3h
-----END PGP SIGNATURE-----
_______________________________________________
Dnsmasq-discuss mailing list
Dnsmasq-discuss@lists.thekelleys.org.uk
http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
--
Dave Täht
Let's make wifi fast, less jittery and reliable again!
https://plus.google.com/u/0/107942175615993706558/posts/TVX3o84jjmb
^ permalink raw reply [flat|nested] 2+ messages in thread