c90cde3178- Disable --nftset for SLE-15-SP3 and older. - bsc#1235517: Reintroduce nogroup for SLE-15-SP3 and older.
Reinhard Max
2025-01-14 11:39:29 +00:00
0cc8ed3dc1- update to 2.90: * CVE-2023-50387, CVE-2023-50868, bsc#1219823, bsc#1219826: Denial Of Service while trying to validate specially crafted DNSSEC responses * Fix reversion in --rev-server introduced in 2.88 which caused breakage if the prefix length is not exactly divisible by 8 (IPv4) or 4 (IPv6). * Fix possible SEGV when there server(s) for a particular domain are configured, but no server which is not qualified for a particular domain. * Set the default maximum DNS UDP packet sice to 1232. Obsoletes: dnsmasq-CVE-2023-28450.patch * Add --no-dhcpv4-interface and --no-dhcpv6-interface for better control over which inetrfaces are providing DHCP service. * Fix issue with stale caching * Add configurable caching for arbitrary RR-types. * Add --filter-rr option, to filter arbitrary RR-types.
Reinhard Max
2024-02-14 18:04:45 +00:00
ee7ad3ae48Accepting request 1126658 from network
Ana Guerrero
2023-11-16 19:27:12 +00:00
22e8185410Accepting request 1117613 from home:kukuk:branches:network
Reinhard Max
2023-11-15 14:20:46 +00:00
a543d4ad0bAccepting request 1087210 from network
Dominique Leuenberger
2023-05-16 12:15:54 +00:00
4d358c4945Accepting request 1087003 from home:gmbr3:Active
Reinhard Max
2023-05-15 11:30:28 +00:00
cb7f45821cAccepting request 1082695 from network
Dominique Leuenberger
2023-04-26 15:24:15 +00:00
5812a696e5- bsc#1209358, CVE-2023-28450, dnsmasq-CVE-2023-28450.patch: default maximum EDNS.0 UDP packet size should be 1232
Reinhard Max
2023-04-25 08:33:07 +00:00
ee1ce84cabAccepting request 1066370 from network
Dominique Leuenberger
2023-02-17 15:43:57 +00:00
34ee2bc9adit down. (boo#1207174)
Reinhard Max
2023-02-17 11:54:59 +00:00
ae43cc1797Accepting request 1063496 from network
Dominique Leuenberger
2023-02-07 17:48:19 +00:00
632e70dcdeAccepting request 1063373 from home:polslinux:branches:network
Reinhard Max
2023-02-06 17:47:21 +00:00
92c6477b69Accepting request 1045478 from network
Dominique Leuenberger
2022-12-28 09:54:27 +00:00
ee2f248c1aAccepting request 1044373 from home:dirkmueller:Factory
Reinhard Max
2022-12-27 10:20:23 +00:00
70d707bb81Accepting request 1034136 from network
Dominique Leuenberger
2022-11-08 09:53:18 +00:00
33d1dd7eacAccepting request 1031298 from home:dirkmueller:Factory
Reinhard Max
2022-11-07 10:18:14 +00:00
a38c20861bAccepting request 1004570 from network
Dominique Leuenberger
2022-09-20 17:23:03 +00:00
c177936b94- bsc#1192529, dnsmasq-resolv-conf.patch: Fix a segfault when re-reading an empty resolv.conf - Remove "nogroup" membership from the dnsmasq user.
Reinhard Max
2021-11-18 14:11:14 +00:00
d5b765a964Accepting request 928184 from home:gmbr3:Active
Reinhard Max
2021-11-18 13:53:24 +00:00
25af15f8e3Accepting request 921143 from network
Dominique Leuenberger
2021-09-26 19:48:37 +00:00
bcf4390ff2- SLE bugs that got fixed upstream between 2.79 and 2.86, but for which we need to keep references when syncing Factory to SLE: * bsc#1176076: dnsmasq-servfail.patch * bsc#1156543: dnsmasq-siocgstamp.patch * bsc#1138743: dnsmasq-cache-size.patch * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch
Reinhard Max
2021-09-23 08:59:05 +00:00
049fbc620b- Update to 2.86: * Handle DHCPREBIND requests in the DHCPv6 server code. * Fix bug which caused dnsmasq to lose track of processes forked to handle TCP DNS connections under heavy load. * Major rewrite of the DNS server and domain handling code. This should be largely transparent, but it drastically improves performance and reduces memory foot-print when configuring large numbers of domains. * Revise resource handling for number of concurrent DNS queries. * Improve efficiency of DNSSEC. * Connection track mark based DNS query filtering. * Allow smaller than 64 prefix lengths in synth-domain, with caveats. --synth-domain=1234:4567::/56,example.com is now valid. * Make domains generated by --synth-domain appear in replies when in authoritative mode. * Ensure CAP_NET_ADMIN capability is available when conntrack is configured. * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are given a directory as argument, define the order in which files within that directory are read (alphabetical order of filename). - Added hardening to systemd service(s) (bsc#1181400).
Reinhard Max
2021-09-17 11:27:06 +00:00
dc54688f33Accepting request 918936 from home:jsegitz:branches:systemdhardening:network
Reinhard Max
2021-09-17 09:40:15 +00:00
36392b1f56Accepting request 904175 from network
Dominique Leuenberger
2021-07-07 16:29:47 +00:00
253903d350Accepting request 899810 from home:gmbr3:Active
Reinhard Max
2021-07-05 13:31:21 +00:00
05adc3fbcfAccepting request 896893 from home:gmbr3:Active
Reinhard Max
2021-06-07 10:59:49 +00:00
42d55dff3cAccepting request 888631 from network
Dominique Leuenberger
2021-04-28 23:36:38 +00:00
755bed9cef- Update to 2.85: * Fix problem with DNS retries in 2.83/2.84. * Tweak sort order of tags in get-version. * Avoid treating a --dhcp-host which has an IPv6 address as eligible for use with DHCPv4 on the grounds that it has no address, and vice-versa. * Add --dynamic-host option: A and AAAA records which take their network part from the network of a local interface. Useful for routers with dynamically prefixes. * Teach --bogus-nxdomain and --ignore-address to take an IPv4 subnet. * CVE-2021-3448, bsc#1183709: Use random source ports where possible if source addresses/interfaces in use. * Change the method of allocation of random source ports for DNS. * Scale the size of the DNS random-port pool based on the value of the --dns-forward-max configuration. * Tweak TFTP code to check sender of all received packets, as specified in RFC 1350 para 4.
Reinhard Max
2021-04-19 21:50:31 +00:00
822e2ef139Fix URLs.
Reinhard Max
2021-04-19 20:45:47 +00:00
6b64faead0Accepting request 870366 from home:dirkmueller:branches:network
Reinhard Max
2021-02-09 07:35:03 +00:00
119b64113aAccepting request 867893 from network
Dominique Leuenberger
2021-02-04 19:23:46 +00:00
e7d4817578Accepting request 864301 from network
Dominique Leuenberger
2021-01-20 17:23:34 +00:00
f38fa3d41b- Update to 2.83: * bsc#1177077: Fixed DNSpooq vulnerabilities * Use the values of --min-port and --max-port in outgoing TCP connections to upstream DNS servers. * Fix a remote buffer overflow problem in the DNSSEC code. Any dnsmasq with DNSSEC compiled in and enabled is vulnerable to this, referenced by CVE-2020-25681, CVE-2020-25682, CVE-2020-25683 CVE-2020-25687. * Be sure to only accept UDP DNS query replies at the address from which the query was originated. This keeps as much entropy in the {query-ID, random-port} tuple as possible, to help defeat cache poisoning attacks. Refer: CVE-2020-25684. * Use the SHA-256 hash function to verify that DNS answers received are for the questions originally asked. This replaces the slightly insecure SHA-1 (when compiled with DNSSEC) or the very insecure CRC32 (otherwise). Refer: CVE-2020-25685 * Handle multiple identical near simultaneous DNS queries better. Previously, such queries would all be forwarded independently. This is, in theory, inefficent but in practise not a problem, _except_ that is means that an answer for any of the forwarded queries will be accepted and cached. An attacker can send a query multiple times, and for each repeat, another {port, ID} becomes capable of accepting the answer he is sending in the blind, to random IDs and ports. The chance of a succesful attack is therefore multiplied by the number of repeats of the query. The new behaviour detects repeated queries and merely stores the clients sending repeats so that when the first query completes, the answer can be sent to all the clients who asked. Refer: CVE-2020-25686.
Reinhard Max
2021-01-19 12:32:14 +00:00
de12c31418Accepting request 823748 from network
Dominique Leuenberger
2020-08-03 12:13:03 +00:00
be2d2498afAccepting request 823079 from home:mrey:branches:network
Reinhard Max
2020-07-31 14:11:53 +00:00
f2c36e7dadAccepting request 807964 from network
Dominique Leuenberger
2020-06-04 15:49:02 +00:00
067293717fAccepting request 800348 from home:polslinux:branches:networkDirk Mueller2020-05-21 11:02:08 +00:00
558e4ff507Accepting request 752812 from network
Dominique Leuenberger
2019-12-07 14:11:48 +00:00
717dcedc03Accepting request 752568 from home:dimstar:Factory
Tomáš Chvátal
2019-12-02 07:41:02 +00:00
bd280d0c79Accepting request 748378 from network
Dominique Leuenberger
2019-11-20 12:42:47 +00:00
7a3d7e2c7bAccepting request 547138 from home:cbosdonnat:branches:network
Ismail Dönmez
2017-12-01 15:00:21 +00:00
9141fa3579Accepting request 525886 from network
Dominique Leuenberger
2017-10-05 09:53:17 +00:00
09eac739de- Security update to version 2.78: * bsc#1060354, CVE-2017-14491: 2 byte heap based overflow. * bsc#1060355, CVE-2017-14492: heap based overflow. * bsc#1060360, CVE-2017-14493: stack based overflow. * bsc#1060361, CVE-2017-14494: DHCP - info leak. * bsc#1060362, CVE-2017-14495: DNS - OOM DoS. * bsc#1060364, CVE-2017-14496: DNS - DoS Integer underflow. * Fix DHCP relaying, broken in 2.76 and 2.77. * For other changes, see http://www.thekelleys.org.uk/dnsmasq/CHANGELOG - Obsoleted patches: * Fix-crash-introduced-in-2675f2061525bc954be14988d643.patch * Handle-binding-upstream-servers-to-an-interface.patch
Reinhard Max
2017-10-02 14:34:17 +00:00
1c4b4aee27Accepting request 523600 from home:scarabeus_iv:branches:network
Ismail Dönmez
2017-09-13 14:15:31 +00:00
d7b45ae928- reload system dbus to pick up policy change on install (bsc#1054429)Dirk Mueller2017-08-18 11:16:45 +00:00
a9a380275eAccepting request 449478 from network
Dominique Leuenberger
2017-01-11 11:01:12 +00:00
13ce29f32bAccepting request 449467 from home:mwilck:branches:network
Ismail Dönmez
2017-01-10 08:52:59 +00:00
b07b199c9fAccepting request 416775 from network
Dominique Leuenberger
2016-08-06 18:35:45 +00:00
428579c9fb- Update to 2.76: * Include 0.0.0.0/8 in DNS rebind checks. * Enhance --add-subnet to allow arbitrary subnet addresses. * Respect the --no-resolv flag in inotify code. Fixes bug which caused dnsmasq to fail to start if a resolv-file was a dangling symbolic link, even of --no-resolv set. * Fix crash when an A or AAAA record is defined locally, in a hosts file, and an upstream server sends a reply that the same name is empty (CVE-2015-8899, bsc#983273). * Fix failure to correctly calculate cache-size when reading a hosts-file fails. * Fix wrong answer to simple name query when --domain-needed set, but no upstream servers configured. * Return REFUSED when running out of forwarding table slots, not SERVFAIL. * Add --max-port configuration. * Add --script-arp and two new functions for the dhcp-script. * Extend --add-mac to allow a new encoding of the MAC address as base64, by configurting --add-mac=base64 * Add --add-cpe-id option. * Don't crash with divide-by-zero if an IPv6 dhcp-range is declared as a whole /64. (ie xx::0 to xx::ffff:ffff:ffff:ffff) * Add support for a TTL parameter in --host-record and --cname. * Add --dhcp-ttl option. * Add --tftp-mtu option. * Check return-code of inet_pton() when parsing dhcp-option. * Fix wrong value for EDNS UDP packet size when using --servers-file to define upstream DNS servers. * Add dhcp_release6 to contrib/lease-tools.
Reinhard Max
2016-08-03 14:02:20 +00:00
066af89b75Accepting request 404054 from network
Dominique Leuenberger
2016-06-29 13:04:14 +00:00
Ana Guerrero
Reinhard Max
Marcus Meissner
Dominique Leuenberger
Dirk Mueller
Tomáš Chvátal
Stephan Kulow
James McDonough
Ismail Dönmez