| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: dnsmasq | Distribution: openSUSE Leap 15.2 |
| Version: 2.78 | Vendor: openSUSE |
| Release: lp152.7.3.1 | Build date: Tue Jan 19 20:07:02 2021 |
| Group: Productivity/Networking/DNS/Servers | Build host: obs-power8-05 |
| Size: 1402380 | Source RPM: dnsmasq-2.78-lp152.7.3.1.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: http://www.thekelleys.org.uk/dnsmasq/ | |
| Summary: Lightweight, Easy-to-Configure DNS Forwarder and DHCP Server | |
Dnsmasq is a lightweight, easy-to-configure DNS forwarder and DHCP server. It is designed to provide DNS and, optionally, DHCP, to a small network. It can serve the names of local machines that are not in the global DNS. The DHCP server integrates with the DNS server and allows machines with DHCP-allocated addresses to appear in DNS with names configured either in each host or in a central configuration file. Dnsmasq supports static and dynamic DHCP leases and BOOTP for network booting of diskless machines.
GPL-2.0-only OR GPL-3.0-only
* Thu Jan 14 2021 Reinhard Max <max@suse.com>
- bsc#1177077: Fixed DNSpooq vulnerabilities (dnsmasq-dnspooq.patch)
- CVE-2020-25684, CVE-2020-25685, CVE-2020-25686:
Fixed multiple Cache Poisoning attacks.
- CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687:
Fixed multiple potential Heap-based overflows when DNSSEC is
enabled.
* Fri Dec 18 2020 Reinhard Max <max@suse.com>
- Retry query to other servers on receipt of SERVFAIL rcode
(bsc#1176076, dnsmasq-servfail.patch)
* Wed Nov 13 2019 Reinhard Max <max@suse.com>
- bsc#1154849, CVE-2019-14834, dnsmasq-CVE-2019-14834.patch:
memory leak in the create_helper() function in /src/helper.c
- bsc#1156543: include linux/sockios.h to get SIOCGSTAMP
(dnsmasq-siocgstamp.patch).
- bsc#1138743: remove cache size limit (dnsmasq-cache-size.patch).
- bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .
- bsc#1076958, CVE-2017-15107, dnsmasq-CVE-2017-15107.patch:
A vulnerability in DNSSEC implementation of Dnsmasq was found.
Processing of wildcard synthesized NSEC records may result in
improper validation for non-existance in some implementations of
DNSSEC. While synthesis of NSEC records is allowed by RFC4592,
the synthesized owner names should not be used in the NSEC
processing.
- Package contrib/lease-tools/dhcp_release6.
* Fri Oct 19 2018 cgoll@suse.com
- enabled lua scripting interface (FATE#327143).
* Wed Aug 29 2018 dmueller@suse.com
- add missing prereq on the group to be created (bsc#1106446)
* Mon Jul 16 2018 kukuk@suse.de
- Don't require systemd explicit, fix spec file to handle both
cases correct. In containers we don't have systemd.
- Adjust pre/post install for transactional updates.
- Use %license instead of %doc [bsc#1082318]
* Mon Dec 04 2017 idonmez@suse.com
- Update keyring
* Fri Dec 01 2017 cbosdonnat@suse.com
- Get rid of python dependency due to examples. (fate#323526)
* Mon Oct 02 2017 max@suse.com
- Security update to version 2.78:
* bsc#1060354, CVE-2017-14491: 2 byte heap based overflow.
* bsc#1060355, CVE-2017-14492: heap based overflow.
* bsc#1060360, CVE-2017-14493: stack based overflow.
* bsc#1060361, CVE-2017-14494: DHCP - info leak.
* bsc#1060362, CVE-2017-14495: DNS - OOM DoS.
* bsc#1060364, CVE-2017-14496: DNS - DoS Integer underflow.
* Fix DHCP relaying, broken in 2.76 and 2.77.
* For other changes, see
http://www.thekelleys.org.uk/dnsmasq/CHANGELOG
- Obsoleted patches:
* Fix-crash-introduced-in-2675f2061525bc954be14988d643.patch
* Handle-binding-upstream-servers-to-an-interface.patch
* Tue Sep 12 2017 tchvatal@suse.com
- Fix /srv/tftpboot permissions wrt bsc#940608
* Fri Aug 18 2017 dmueller@suse.com
- reload system dbus to pick up policy change on install (bsc#1054429)
* Wed Jan 04 2017 martin.wilck@suse.com
- Handle binding upstream servers to an interface if interface
is destroyed and recreated (boo#1018160)
Added two patches from upstream:
* added Handle-binding-upstream-servers-to-an-interface.patch
* added Fix-crash-introduced-in-2675f2061525bc954be14988d643.patch
* Wed Aug 03 2016 max@suse.com
- Update to 2.76:
* Include 0.0.0.0/8 in DNS rebind checks.
* Enhance --add-subnet to allow arbitrary subnet addresses.
* Respect the --no-resolv flag in inotify code. Fixes bug
which caused dnsmasq to fail to start if a resolv-file
was a dangling symbolic link, even of --no-resolv set.
* Fix crash when an A or AAAA record is defined locally,
in a hosts file, and an upstream server sends a reply
that the same name is empty (CVE-2015-8899, bsc#983273).
* Fix failure to correctly calculate cache-size when reading a
hosts-file fails.
* Fix wrong answer to simple name query when --domain-needed
set, but no upstream servers configured.
* Return REFUSED when running out of forwarding table slots,
not SERVFAIL.
* Add --max-port configuration.
* Add --script-arp and two new functions for the dhcp-script.
* Extend --add-mac to allow a new encoding of the MAC address
as base64, by configurting --add-mac=base64
* Add --add-cpe-id option.
* Don't crash with divide-by-zero if an IPv6 dhcp-range is
declared as a whole /64.
(ie xx::0 to xx::ffff:ffff:ffff:ffff)
* Add support for a TTL parameter in --host-record and --cname.
* Add --dhcp-ttl option.
* Add --tftp-mtu option.
* Check return-code of inet_pton() when parsing dhcp-option.
* Fix wrong value for EDNS UDP packet size when using
- -servers-file to define upstream DNS servers.
* Add dhcp_release6 to contrib/lease-tools.
* Thu Jun 16 2016 max@suse.com
- dnsmasq-groups.patch: Initialize the supplementary groups of the
dnsmasq user (bsc#859298).
* Tue Feb 02 2016 mpluskal@suse.com
- Add gpg signature
* Mon Aug 24 2015 stefan.bruens@rwth-aachen.de
- spec file cleanup, get rid of redifinition warnings
* Tue Aug 11 2015 stefan.bruens@rwth-aachen.de
- Update to 2.75, announce message:
Fix reversion on 2.74 which caused 100% CPU use when a
dhcp-script is configured. Thanks to Adrian Davey for
reporting the bug and testing the fix.
- Update to 2.74, announce message:
Fix reversion in 2.73 where --conf-file would attempt to
read the default file, rather than no file.
Fix inotify code to handle dangling symlinks better and
not SEGV in some circumstances.
DNSSEC fix. In the case of a signed CNAME generated by a
wildcard which pointed to an unsigned domain, the wrong
status would be logged, and some necessary checks omitted.
- Update to 2.73, announce message:
Fix crash at startup when an empty suffix is supplied to
- -conf-dir, also trivial memory leak. Thanks to
Tomas Hozza for spotting this.
Remove floor of 4096 on advertised EDNS0 packet size when
DNSSEC in use, the original rationale for this has long gone.
Thanks to Anders Kaseorg for spotting this.
Use inotify for checking on updates to /etc/resolv.conf and
friends under Linux. This fixes race conditions when the files are
updated rapidly and saves CPU by noy polling. To build
a binary that runs on old Linux kernels without inotify,
use make COPTS=-DNO_INOTIFY
Fix breakage of --domain=<domain>,<subnet>,local - only reverse
queries were intercepted. THis appears to have been broken
since 2.69. Thanks to Josh Stone for finding the bug.
Eliminate IPv6 privacy addresses and deprecated addresses from
the answers given by --interface-name. Note that reverse queries
(ie looking for names, given addresses) are not affected.
Thanks to Michael Gorbach for the suggestion.
Fix crash in DNSSEC code with long RRs. Thanks to Marco Davids
for the bug report.
Add --ignore-address option. Ignore replies to A-record
queries which include the specified address. No error is
generated, dnsmasq simply continues to listen for another
reply. This is useful to defeat blocking strategies which
rely on quickly supplying a forged answer to a DNS
request for certain domains, before the correct answer can
arrive. Thanks to Glen Huang for the patch.
Revisit the part of DNSSEC validation which determines if an
unsigned answer is legit, or is in some part of the DNS
tree which should be signed. Dnsmasq now works from the
DNS root downward looking for the limit of signed
delegations, rather than working bottom up. This is
both more correct, and less likely to trip over broken
nameservers in the unsigned parts of the DNS tree
which don't respond well to DNSSEC queries.
Add --log-queries=extra option, which makes logs easier
to search automatically.
Add --min-cache-ttl option. I've resisted this for a long
time, on the grounds that disbelieving TTLs is never a
good idea, but I've been persuaded that there are
sometimes reasons to do it. (Step forward, GFW).
To avoid misuse, there's a hard limit on the TTL
floor of one hour. Thansk to RinSatsuki for the patch.
Cope with multiple interfaces with the same link-local
address. (IPv6 addresses are scoped, so this is allowed.)
Thanks to Cory Benfield for help with this.
Add --dhcp-hostsdir. This allows addition of new host
configurations to a running dnsmasq instance much more
cheaply than having dnsmasq re-read all its existing
configuration each time.
Don't reply to DHCPv6 SOLICIT messages if we're not
configured to do stateful DHCPv6. Thanks to Win King Wan
for the patch.
Fix broken DNSSEC validation of ECDSA signatures.
Add --dnssec-timestamp option, which provides an automatic
way to detect when the system time becomes valid after
boot on systems without an RTC, whilst allowing DNS
queries before the clock is valid so that NTP can run.
Thanks to Kevin Darbyshire-Bryant for developing this idea.
Add --tftp-no-fail option. Thanks to Stefan Tomanek for
the patch.
Fix crash caused by looking up servers.bind, CHAOS text
record, when more than about five --servers= lines are
in the dnsmasq config. This causes memory corruption
which causes a crash later. Thanks to Matt Coddington for
sterling work chasing this down.
Fix crash on receipt of certain malformed DNS requests.
Thanks to Nick Sampanis for spotting the problem.
Note that this is could allow the dnsmasq process's
memory to be read by an attacker under certain
circumstances, so it has a CVE, CVE-2015-3294
Fix crash in authoritative DNS code, if a .arpa zone
is declared as authoritative, and then a PTR query which
is not to be treated as authoritative arrived. Normally,
directly declaring .arpa zone as authoritative is not
done, so this crash wouldn't be seen. Instead the
relevant .arpa zone should be specified as a subnet
in the auth-zone declaration. Thanks to Johnny S. Lee
for the bugreport and initial patch.
Fix authoritative DNS code to correctly reply to NS
and SOA queries for .arpa zones for which we are
declared authoritative by means of a subnet in auth-zone.
Previously we provided correct answers to PTR queries
in such zones (including NS and SOA) but not direct
NS and SOA queries. Thanks to Johnny S. Lee for
pointing out the problem.
Fix logging of DHCPREPLY which should be suppressed
by quiet-dhcp6. Thanks to J. Pablo Abonia for
spotting the problem.
Try and handle net connections with broken fragmentation
that lose large UDP packets. If a server times out,
reduce the maximum UDP packet size field in the EDNS0
header to 1280 bytes. If it then answers, make that
change permanent.
Check IPv4-mapped IPv6 addresses when --stop-rebind
is active. Thanks to Jordan Milne for spotting this.
Allow DHCPv4 options T1 and T2 to be set using --dhcp-option.
Thanks to Kevin Benton for patches and work on this.
Fix code for DHCPCONFIRM DHCPv6 messages to confirm addresses
in the correct subnet, even of not in dynamic address
allocation range. Thanks to Steve Hirsch for spotting
the problem.
Add AddDhcpLease and DeleteDhcpLease DBus methods. Thanks
to Nicolas Cavallari for the patch.
Allow configuration of router advertisements without the
"on-link" bit set. Thanks to Neil Jerram for the patch.
Extend --bridge-interface to DHCPv6 and router
advertisements. Thanks to Neil Jerram for the patch.
* Wed Jun 17 2015 crrodriguez@opensuse.org
- dnsmasq.service: Order Before=nss-lookup.target and
Wants=nss-lookup.target as this service may provide
name resolution even for the localhost.
* Mon Apr 20 2015 abergmann@suse.com
- Move trust-anchors.conf into /etc/dnsmasq.d to be AppArmor conform.
(bnc#908137)
* Tue Jan 06 2015 jslaby@suse.com
- The change from Wed Dec 24 messed group w/ user IDs. Switch them
back and be more careful w/ what is changed.
* Mon Dec 29 2014 dimstar@opensuse.org
- Fix symlink of rcFOO to /usr/sbin/service, resolving a dangling
symlink lint warning (and remove the same from rpmlintrc).
* Thu Dec 25 2014 nemysis@gmx.ch
- Remove from spec group_and_isc.patch, forgotten in previous commit
* Wed Dec 24 2014 nemysis@gmx.ch
- Update to 2.72, announce message:
Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.
Add support for "ipsets" in *BSD, using pf. Thanks to
Sven Falempim for the patch.
Fix race condition which could lock up dnsmasq when an
interface goes down and up rapidly. Thanks to Conrad
Kostecki for helping to chase this down.
Add DBus methods SetFilterWin2KOption and SetBogusPrivOption
Thanks to the Smoothwall project for the patch.
Fix failure to build against Nettle-3.0. Thanks to Steven
Barth for spotting this and finding the fix.
When assigning existing DHCP leases to intefaces by comparing
networks, handle the case that two or more interfaces have the
same network part, but different prefix lengths (favour the
longer prefix length.) Thanks to Lung-Pin Chang for the
patch.
Add a mode which detects and removes DNS forwarding loops, ie
a query sent to an upstream server returns as a new query to
dnsmasq, and would therefore be forwarded again, resulting in
a query which loops many times before being dropped. Upstream
servers which loop back are disabled and this event is logged.
Thanks to Smoothwall for their sponsorship of this feature.
Extend --conf-dir to allow filtering of files. So
- -conf-dir=/etc/dnsmasq.d,\*.conf
will load all the files in /etc/dnsmasq.d which end in .conf
Fix bug when resulted in NXDOMAIN answers instead of NODATA in
some circumstances.
Fix bug which caused dnsmasq to become unresponsive if it
failed to send packets due to a network interface disappearing.
Thanks to Niels Peen for spotting this.
Fix problem with --local-service option on big-endian platforms
Thanks to Richard Genoud for the patch.
- Add dnsmasq-rpmlintrc, for false positive scripts and symlink
- Add BuildRequires for dos2unix
- Use sed instead of simple patch group_and_isc.patch
* Sun Nov 09 2014 seife+obs@b1-systems.com
- fix logging, PrivateDevices=yes kills it (bnc#902511, bnc#904537)
/etc/dbus-1/system.d/dnsmasq.conf /etc/dnsmasq.conf /etc/dnsmasq.d /etc/dnsmasq.d/trust-anchors.conf /etc/slp.reg.d /etc/slp.reg.d/dnsmasq.reg /etc/sysconfig/SuSEfirewall2.d/services/dnsmasq-dhcp /etc/sysconfig/SuSEfirewall2.d/services/dnsmasq-dns /srv/tftpboot /usr/lib/systemd/system/dnsmasq.service /usr/sbin/dnsmasq /usr/sbin/rcdnsmasq /usr/share/doc/packages/dnsmasq /usr/share/doc/packages/dnsmasq/CHANGELOG /usr/share/doc/packages/dnsmasq/FAQ /usr/share/doc/packages/dnsmasq/contrib /usr/share/doc/packages/dnsmasq/contrib/CPE-WAN /usr/share/doc/packages/dnsmasq/contrib/CPE-WAN/README /usr/share/doc/packages/dnsmasq/contrib/conntrack /usr/share/doc/packages/dnsmasq/contrib/conntrack/README /usr/share/doc/packages/dnsmasq/contrib/dbus-test /usr/share/doc/packages/dnsmasq/contrib/dbus-test/dbus-test.py /usr/share/doc/packages/dnsmasq/contrib/dns-loc /usr/share/doc/packages/dnsmasq/contrib/dns-loc/README /usr/share/doc/packages/dnsmasq/contrib/dns-loc/dnsmasq2-loc-rfc1876.patch /usr/share/doc/packages/dnsmasq/contrib/dnslist /usr/share/doc/packages/dnsmasq/contrib/dnslist/dhcp.css /usr/share/doc/packages/dnsmasq/contrib/dnslist/dnslist.pl /usr/share/doc/packages/dnsmasq/contrib/dnslist/dnslist.tt2 /usr/share/doc/packages/dnsmasq/contrib/dynamic-dnsmasq /usr/share/doc/packages/dnsmasq/contrib/dynamic-dnsmasq/dynamic-dnsmasq.pl /usr/share/doc/packages/dnsmasq/contrib/lease-access /usr/share/doc/packages/dnsmasq/contrib/lease-access/README /usr/share/doc/packages/dnsmasq/contrib/lease-access/lease.access.patch /usr/share/doc/packages/dnsmasq/contrib/lease-tools /usr/share/doc/packages/dnsmasq/contrib/lease-tools/Makefile /usr/share/doc/packages/dnsmasq/contrib/lease-tools/dhcp_lease_time.1 /usr/share/doc/packages/dnsmasq/contrib/lease-tools/dhcp_lease_time.c /usr/share/doc/packages/dnsmasq/contrib/lease-tools/dhcp_release.1 /usr/share/doc/packages/dnsmasq/contrib/lease-tools/dhcp_release.c /usr/share/doc/packages/dnsmasq/contrib/lease-tools/dhcp_release6.1 /usr/share/doc/packages/dnsmasq/contrib/lease-tools/dhcp_release6.c /usr/share/doc/packages/dnsmasq/contrib/mactable /usr/share/doc/packages/dnsmasq/contrib/mactable/macscript /usr/share/doc/packages/dnsmasq/contrib/openvpn /usr/share/doc/packages/dnsmasq/contrib/openvpn/README /usr/share/doc/packages/dnsmasq/contrib/openvpn/dhclient-enter-hooks /usr/share/doc/packages/dnsmasq/contrib/openvpn/dnsmasq.patch /usr/share/doc/packages/dnsmasq/contrib/port-forward /usr/share/doc/packages/dnsmasq/contrib/port-forward/dnsmasq-portforward /usr/share/doc/packages/dnsmasq/contrib/port-forward/portforward /usr/share/doc/packages/dnsmasq/contrib/reverse-dns /usr/share/doc/packages/dnsmasq/contrib/reverse-dns/README /usr/share/doc/packages/dnsmasq/contrib/reverse-dns/reverse_replace.sh /usr/share/doc/packages/dnsmasq/contrib/static-arp /usr/share/doc/packages/dnsmasq/contrib/static-arp/static-arp /usr/share/doc/packages/dnsmasq/contrib/systemd /usr/share/doc/packages/dnsmasq/contrib/systemd/README /usr/share/doc/packages/dnsmasq/contrib/systemd/dbus_activation /usr/share/doc/packages/dnsmasq/contrib/systemd/dnsmasq.service /usr/share/doc/packages/dnsmasq/contrib/try-all-ns /usr/share/doc/packages/dnsmasq/contrib/try-all-ns/README /usr/share/doc/packages/dnsmasq/contrib/try-all-ns/README-2.47 /usr/share/doc/packages/dnsmasq/contrib/try-all-ns/README-2.78 /usr/share/doc/packages/dnsmasq/contrib/try-all-ns/dnsmasq-2.35-try-all-ns.patch /usr/share/doc/packages/dnsmasq/contrib/try-all-ns/dnsmasq-2.47_no_nxdomain_until_end.patch /usr/share/doc/packages/dnsmasq/contrib/try-all-ns/dnsmasq-2.68-try-all-ns /usr/share/doc/packages/dnsmasq/contrib/try-all-ns/dnsmasq-2.78xx-try-all-ns.patch /usr/share/doc/packages/dnsmasq/contrib/webmin /usr/share/doc/packages/dnsmasq/contrib/webmin/README /usr/share/doc/packages/dnsmasq/contrib/webmin/dnsmasq.wbm /usr/share/doc/packages/dnsmasq/contrib/wrt /usr/share/doc/packages/dnsmasq/contrib/wrt/README /usr/share/doc/packages/dnsmasq/contrib/wrt/lease_update.sh /usr/share/doc/packages/dnsmasq/dbus /usr/share/doc/packages/dnsmasq/dbus/DBus-interface /usr/share/doc/packages/dnsmasq/dbus/dnsmasq.conf /usr/share/doc/packages/dnsmasq/dnsmasq.conf.example /usr/share/doc/packages/dnsmasq/doc.html /usr/share/doc/packages/dnsmasq/setup.html /usr/share/licenses/dnsmasq /usr/share/licenses/dnsmasq/COPYING /usr/share/licenses/dnsmasq/COPYING-v3 /usr/share/locale/de/LC_MESSAGES/dnsmasq.mo /usr/share/locale/es/LC_MESSAGES/dnsmasq.mo /usr/share/locale/fi/LC_MESSAGES/dnsmasq.mo /usr/share/locale/fr/LC_MESSAGES/dnsmasq.mo /usr/share/locale/id/LC_MESSAGES/dnsmasq.mo /usr/share/locale/it/LC_MESSAGES/dnsmasq.mo /usr/share/locale/nb/LC_MESSAGES/dnsmasq.mo /usr/share/locale/pl/LC_MESSAGES/dnsmasq.mo /usr/share/locale/pt_BR/LC_MESSAGES/dnsmasq.mo /usr/share/locale/ro/LC_MESSAGES/dnsmasq.mo /usr/share/man/es/man8/dnsmasq.8.gz /usr/share/man/fr/man8/dnsmasq.8.gz /usr/share/man/man8/dnsmasq.8.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Tue Jul 9 12:46:04 2024