ISC DHCP 4.1-ESV-R13 is now available for download
Shawn Routhier <[email protected]> Tue, 29 Mar 2016 13:51:16 -0700
| Newsgroups | gmane.network.dhcp.isc.announce |
|---|---|
| Message-ID | <[email protected]> |
--===============3410438746472462305== Content-Type: multipart/alternative; boundary="Apple-Mail=_A0FB9273-5F68-426B-B7E6-F7FFD670AB3A" --Apple-Mail=_A0FB9273-5F68-426B-B7E6-F7FFD670AB3A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii ISC DHCP 4.1-ESV-R13 is now available for download. This is the release of ISC DHCP 4.1-ESV-R13, a maintenance release which contains a number of bug fixes and two fixes for previously released security issues. Field testing is an important part of our quality process. Please report bugs to [email protected]. A list of the changes in this release has been appended to the end of this message. For a complete list of changes from any previous release, please consult the RELNOTES file within the source = distribution. They can also be found at: = https://kb.isc.org/article/AA-01367/0/DHCP-4.1-ESV-R13-Release-Notes.html Knowledge base articles about various features can be found starting = from: = https://kb.isc.org/category/201/0/10/Software-Products/DHCP/Features/ Webinars can be found here: http://www.youtube.com/user/ISCdotorg This release, and its OpenPGP-signatures are available now from: https://www.isc.org/downloads/DHCP/ ftp://ftp.isc.org/isc/dhcp/4.1-ESV-R13/dhcp-4.1-ESV-R13.tar.gz = ftp://ftp.isc.org/isc/dhcp/4.1-ESV-R13/dhcp-4.1-ESV-R13.tar.gz.sha512.asc = ftp://ftp.isc.org/isc/dhcp/4.1-ESV-R13/dhcp-4.1-ESV-R13.tar.gz.sha256.asc = ftp://ftp.isc.org/isc/dhcp/4.1-ESV-R13/dhcp-4.1-ESV-R13.tar.gz.sha1.asc ISC's Release Signing Key can be obtained at: http://www.isc.org/about/openpgp/ The following are changes that may be more interesting and require a bit more explanation. We have changed the default set-up for choosing a program name for use in logging. Previously we used a hardcoded name for the client, relay and server. We have changed to using the base name of the = program. This is intended to help differentiate syslog entries when using both v4 & v6 clients or servers. We don't expect anybody to need the old style but if you do it is available via modifying includes/site.h=20 and defining OLD_LOG_NAME. [ISC-Bugs #38692] We have added a new parameter, authoring-byte-order, to the lease file. This value is used to allow a lease file written in one byte order to be read on a machine with a different byte order. If you have a program to process a lease file you may need to update it to handle this string. [ISC-Bugs #38396] The IETF determined that there were problems with the processing required for IA_NAs (RFC3315) and IA_PDs (RFC3633). The issues are described in RFC7550. As part of updating the client code to the new RFC we also re-arranged how it chooses between different servers by changing the weights used when scoring an advertise. The new weighting will prefer more bindings (IAs) over more addresses within a binding. As most users will get a single address in as single binding and only get an advertise from a single server there won't be any difference. If you do need the old weighting for some reason you can edit includes/site.h and define USE_ORIGINAL_CLIENT_LEASE_WEIGHTS. [ISC-Bugs #40190] We have modified the error reporting in the client, relay and server to better indicate which command line option caused an error. As we don't expect this to be an issue we have made it the default. If you you need the old error messages you can edit includes/site.h and undefine PRINT_SPECIFIC_CL_ERRORS. [ISC-Bugs #40321] As mentioned in the recent security announcement we found an issue with our handling of excessive numbers of connections. While we believe the best idea is for people to properly secure their DHCP severs (disable OMAPI if not in use, use firewalls to limit access to OMAPI and failover ports and use process limits to restrict the resources the servers can use) we have added code to limit the number of connections a server will allow. We have chosen 200 as the default number which should be large enough for most configurations. You may adjust this value by editing includes/site.h and changing the value of MAX_FD_VALUE. A value of 0 means unlimited. We will be evaluating the connection code in more detail in the future and may change how this works. [ISC-Bugs #41845] The following is the list of all changes for this release. Changes since 4.1-ESV-R13b1 - None Changes since 4.1-ESV-R12 - Corrected a static analyzer warning in common/execute.c [ISC-Bugs #40374] - ISC DHCP now follows the common convention to use the base name a program is invoked with (aka argv[0], vs. a builtin name) for logs. This should help differentiate syslog entries for DHCPv4 and DHCPv6 servers. You can define OLD_LOG_NAME in includes/site.h to keep the previous behavior. [ISC-Bugs #38692] - The Linux packet filter code now correctly treats only the least = significant 12 bits in an inbound packet's TCI value as the VLAN id (per IEEE = 802.1Q). Prior to this it was using the entire 16 bit value as the VLAN id and incorrectly discarding packets. Thanks to Jiri Popelka at Red Hat for reporting this issue and supplying its patch. [ISC-Bugs #40591] - Fixed several static analysis issues such as potential null references, unchecked strdup returns. Thanks to Bill Parker (wp02855 = at gmail dot com) who identified these issues and supplied patches to address them. [ISC-Bugs #40754] [ISC-Bugs #40823] - Corrected compilation errors that prohibited building the server's=20 ATF unit tests when failover is disabled. [ISC-Bugs #40372] - Added dhcpv6 and delayed-ack to settings listed in the "Features:" section of the configure script output. Additionally, all of the features reported on will now always show either a "yes" or "no" value. Prior to this features left to their default setting would not show a value. [ISC-Bugs #40381] - Added a parameter, authoring-byte-order, to the lease file. This value is automatically added to the top of new lease files by the server and indicates the internal byte order (big endian or little endian) of the server. This permits lease files generated on a server with one form = of byte order to be used on a server with the opposite form. [ISC-Bugs #38396] - Fix a small memory leak in the DHCPv6 version of the client code. This is unlikely to cause significant issues in actual use. [ISC-Bugs #40990] - Corrected a few minor memory leaks in omapi's dereferencing of host objects. Thanks to Jiri Popelka at Red Hat for reporting the issue and supplying the patches. [ISC-Bugs #33990] - Update the client code to better support getting IA_NAs and IA_PDs in the same packet, see RFC7550 for some discussion. [ISC-Bugs #40190] ! Update the bounds checking when receiving a packet. Thanks to Sebastian Poehn from Sophos for the bug report and a = suggested patch. [ISC-Bugs #41267] CVE: CVE-2015-8605 - When handling an incorrect command line for dhcpd, dhclient or = dhcrelay print out a specific error message about the first error in addition to the usage string. This may be disabled by editing includes/site.h. [ISC-Bugs #40321] [ISC-Bugs #41454] - The configure script will now exit with an error message if it cannot = find pkg-config (needed to locate ATF used for building unit tests). Prior = to this the script would exit indicating success causing subsequent = attempts to build the software to fail. [ISC-Bugs #40371] - Properly terminate strings before passing them to regex and fix a boundary error when creating certain new data strings. Thanks to Andrey Jr. Melnikov for the bug report. [ISC-Bugs #41217] - Option expressions, such as prepend and append, are now supported when running dhclient for IPv6. Prior to this such statements in the client configuration file would be parsed but have no affect. Thanks to Jiri Popelka at Red Hat for reporting the issue. [ISC-Bugs #39952] - A failover primary server will now accept a binding status update from = the secondary which transitions a lease from ACTIVE to ABANDONED. This = accounts for instances in which a client declines a lease and only the = secondary server receives it. Prior to this the primary server would reject = such an update as an "invalid state transition". [ISC_BUGS #25189] - Properly allocate memory for a bpf filter. Thanks to Bill Parker (wp02855 at gmail dot com) who identified this = issue. [ISC-Bugs #41485] - The DHCPv6 server now handles long valid and preferred lease times = better. Values that would cause the internal end time of the lease to wrap are modified to work as infinite. [ISC-Bugs #40773] - Correct outputting of long lines in the lease file when writing a lease that includes long strings in an execute statement. [ISC-Bugs #40994] - The server will now correctly treat a lease as reserved when the = client requests an infinite lease time (i.e. OxFFFFFFFF) and = "infinite-is-reserved" is enabled. Prior to this the server would halt. In addition, = corrections were made to the server to allow a lease's flags field to be set via = omapi. Prior to this, the server, depending on the host architecture, would incorrectly parse the new flags value from the omapi message. [ISC-Bugs #31179] - Add a new global DHCPv6 option, dhcpv6-set-tee-times, which when = enabled instructs the server to calculate T1 and T2 as recommended in RFC = 3315, Section 22.4. [ISC-Bugs #25687] - Corrected minor Coverity issues. [ISC-Bugs #35144] - Corrected interface name formation when using DLPI under Solaris 11. = As of Solaris 11, ethernet device files are located in "/dev/net". The = configure script has been modified to detect this situation and adjust the = directory used accordingly. Thanks to Jarkko Torppa for reporting this issue and submitting a patch. [ISC-Bugs #37954] [ISC-Bugs #40752] - Add a dereference call when handling an error condition while decoding a packet and clean up some memory on error conditions. [ISC-Bugs #41774] ! Add an option in site.h to limit the number of failover and control connections the server will accept. By default this is 200. [ISC-Bugs #41845]= --Apple-Mail=_A0FB9273-5F68-426B-B7E6-F7FFD670AB3A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" = class=3D""><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D"">ISC DHCP 4.1-ESV-R13 is now available for = download.</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo; min-height: 13px;" class=3D""><br class=3D""></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D"">This is the release of ISC DHCP 4.1-ESV-R13, a = maintenance</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">release which contains a number of bug = fixes and two fixes</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">for previously released security = issues.</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo; min-height: 13px;" class=3D""><br class=3D""></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D"">Field testing is an important part of our quality = process.</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D"">Please report bugs to <a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>.</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">A list of the changes in this release = has been appended to the end</div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">of this message. For a = complete list of changes from any previous</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo;" class=3D"">release, please = consult the RELNOTES file within the source distribution.</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D"">They can also be found at:</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> <a = href=3D"https://kb.isc.org/article/AA-01367/0/DHCP-4.1-ESV-R13-Release-Not= es.html" = class=3D"">https://kb.isc.org/article/AA-01367/0/DHCP-4.1-ESV-R13-Release-= Notes.html</a></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">Knowledge base articles about various = features can be found starting from:</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> <a = href=3D"https://kb.isc.org/category/201/0/10/Software-Products/DHCP/Featur= es/" = class=3D"">https://kb.isc.org/category/201/0/10/Software-Products/DHCP/Fea= tures/</a></div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo; min-height: 13px;" class=3D""><br class=3D""></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D"">Webinars can be found here:</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> <a = href=3D"http://www.youtube.com/user/ISCdotorg" = class=3D"">http://www.youtube.com/user/ISCdotorg</a></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo; min-height: = 13px;" class=3D""><br class=3D""></div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">This release, and its = OpenPGP-signatures are available now from:</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" = class=3D""><br class=3D""></div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D""> <a = href=3D"https://www.isc.org/downloads/DHCP/" = class=3D"">https://www.isc.org/downloads/DHCP/</a></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo; min-height: = 13px;" class=3D""><br class=3D""></div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> <a = href=3D"ftp://ftp.isc.org/isc/dhcp/4.1-ESV-R13/dhcp-4.1-ESV-R13.tar.gz" = class=3D"">ftp://ftp.isc.org/isc/dhcp/4.1-ESV-R13/dhcp-4.1-ESV-R13.tar.gz<= /a></div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D""> <a = href=3D"ftp://ftp.isc.org/isc/dhcp/4.1-ESV-R13/dhcp-4.1-ESV-R13.tar.gz.sha= 512.asc" = class=3D"">ftp://ftp.isc.org/isc/dhcp/4.1-ESV-R13/dhcp-4.1-ESV-R13.tar.gz.= sha512.asc</a></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> <a = href=3D"ftp://ftp.isc.org/isc/dhcp/4.1-ESV-R13/dhcp-4.1-ESV-R13.tar.gz.sha= 256.asc" = class=3D"">ftp://ftp.isc.org/isc/dhcp/4.1-ESV-R13/dhcp-4.1-ESV-R13.tar.gz.= sha256.asc</a></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> <a = href=3D"ftp://ftp.isc.org/isc/dhcp/4.1-ESV-R13/dhcp-4.1-ESV-R13.tar.gz.sha= 1.asc" = class=3D"">ftp://ftp.isc.org/isc/dhcp/4.1-ESV-R13/dhcp-4.1-ESV-R13.tar.gz.= sha1.asc</a></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">ISC's Release Signing Key can be = obtained at:</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> <a = href=3D"http://www.isc.org/about/openpgp/" = class=3D"">http://www.isc.org/about/openpgp/</a></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo; min-height: = 13px;" class=3D""><br class=3D""></div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">The following are = changes that may be more interesting and require</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">a = bit more explanation.</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">We have changed the default set-up for = choosing a program name for</div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">use in logging. Previously = we used a hardcoded name for the client,</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">relay and server. = We have changed to using the base name of the program.</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D"">This is intended to help differentiate syslog entries when = using both v4</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">& v6 clients or servers. We = don't expect anybody to need the old style</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo;" class=3D"">but if you do it = is available via modifying includes/site.h </div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">and= defining OLD_LOG_NAME. [ISC-Bugs #38692]</div><div style=3D"margin:= 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" = class=3D""><br class=3D""></div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">We have added a new parameter, = authoring-byte-order, to the lease file.</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">This value is used to = allow a lease file written in one byte order</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo;" class=3D"">to be read on a = machine with a different byte order. If you have</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">a = program to process a lease file you may need to update it to</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D"">handle this string. [ISC-Bugs #38396]</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo; min-height: = 13px;" class=3D""><br class=3D""></div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">The IETF determined = that there were problems with the processing</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo;" class=3D"">required for = IA_NAs (RFC3315) and IA_PDs (RFC3633). The issues</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">are= described in RFC7550. As part of updating the client code = to</div><div style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D"">the new RFC we also re-arranged how it chooses between = different</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D"">servers by changing the weights used when scoring an = advertise.</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D"">The new weighting will prefer more bindings (IAs) = over more addresses</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">within a binding. As most users = will get a single address in</div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">as single binding and only get an = advertise from a single server</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">there won't be any = difference. If you do need the old weighting</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">for= some reason you can edit includes/site.h and define</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D"">USE_ORIGINAL_CLIENT_LEASE_WEIGHTS. [ISC-Bugs = #40190]</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo; min-height: 13px;" class=3D""><br class=3D""></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">We = have modified the error reporting in the client, relay and = server</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D"">to better indicate which command line option caused = an error. As</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">we don't expect this to be an issue we = have made it the default.</div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">If you you need the old error = messages you can edit includes/site.h</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">and undefine = PRINT_SPECIFIC_CL_ERRORS. [ISC-Bugs #40321]</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" = class=3D""><br class=3D""></div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">As mentioned in the recent = security announcement we found an issue</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">with our handling of = excessive numbers of connections. While we</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D"">believe the best idea is for people to properly secure their = DHCP</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D"">severs (disable OMAPI if not in use, use firewalls to = limit access</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">to OMAPI and failover ports and use = process limits to restrict the</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">resources the servers = can use) we have added code to limit the number</div><div style=3D"margin:= 0px; font-size: 11px; font-family: Menlo;" class=3D"">of connections a = server will allow. We have chosen 200 as the</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D"">default number which should be large enough for most = configurations.</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">You may adjust this value by editing = includes/site.h and changing</div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">the value of MAX_FD_VALUE. A = value of 0 means unlimited. We will</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo;" class=3D"">be evaluating the = connection code in more detail in the future and</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">may= change how this works. [ISC-Bugs #41845]</div><div style=3D"margin:= 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" = class=3D""><br class=3D""></div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">The following is the list of all = changes for this release.</div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> = Changes since = 4.1-ESV-R13b1</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">- None</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> = Changes since = 4.1-ESV-R12</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">- Corrected a static analyzer warning in = common/execute.c</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> [ISC-Bugs #40374]</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo; min-height: = 13px;" class=3D""><br class=3D""></div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">- ISC DHCP now follows = the common convention to use the base name a</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo;" class=3D""> program is = invoked with (aka argv[0], vs. a builtin name) for</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> logs. This should help differentiate syslog entries = for DHCPv4 and</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> DHCPv6 servers. You can define = OLD_LOG_NAME in includes/site.h to</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> keep the = previous behavior.</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> [ISC-Bugs #38692]</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo; min-height: = 13px;" class=3D""><br class=3D""></div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">- The Linux packet = filter code now correctly treats only the least significant</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> 12 bits in an inbound packet's TCI value as the VLAN = id (per IEEE 802.1Q).</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> Prior to this it was using the = entire 16 bit value as the VLAN id and</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> incorrectly = discarding packets. Thanks to Jiri Popelka at Red Hat = for</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D""> reporting this issue and supplying its = patch.</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D""> [ISC-Bugs #40591]</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" = class=3D""><br class=3D""></div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">- Fixed several static analysis = issues such as potential null</div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D""> references, unchecked = strdup returns. Thanks to Bill Parker (wp02855 at</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> gmail dot com) who identified these issues and = supplied patches to</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> address them.</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> [ISC-Bugs #40754]</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> [ISC-Bugs = #40823]</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo; min-height: 13px;" class=3D""><br class=3D""></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">- = Corrected compilation errors that prohibited building the = server's </div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> ATF unit tests when failover is = disabled.</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D""> [ISC-Bugs #40372]</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" = class=3D""><br class=3D""></div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">- Added dhcpv6 and delayed-ack to = settings listed in the "Features:"</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> section of the = configure script output. Additionally, all of the</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> features reported on will now always show either a = "yes" or "no"</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> value. Prior to this = features left to their default setting would</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo;" class=3D""> not show a = value.</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D""> [ISC-Bugs #40381]</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" = class=3D""><br class=3D""></div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">- Added a parameter, = authoring-byte-order, to the lease file. This value</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> is automatically added to the top of new lease files = by the server and</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> indicates the internal byte order = (big endian or little endian) of the</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> server. = This permits lease files generated on a server with one form = of</div><div style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> byte order to be used on a server with the opposite = form.</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D""> [ISC-Bugs #38396]</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" = class=3D""><br class=3D""></div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">- Fix a small memory leak in the = DHCPv6 version of the client code.</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> This is unlikely = to cause significant issues in actual use.</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo;" class=3D""> [ISC-Bugs = #40990]</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo; min-height: 13px;" class=3D""><br class=3D""></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">- = Corrected a few minor memory leaks in omapi's dereferencing of</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> host objects. Thanks to Jiri Popelka at Red Hat for = reporting</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D""> the issue and supplying the patches.</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> [ISC-Bugs #33990]</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">- Update the client code to better = support getting IA_NAs and IA_PDs</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> in the same = packet, see RFC7550 for some discussion.</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> [ISC-Bugs = #40190]</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo; min-height: 13px;" class=3D""><br class=3D""></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">! = Update the bounds checking when receiving a packet.</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> Thanks to Sebastian Poehn from Sophos for the bug = report and a suggested</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> patch.</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo;" class=3D""> [ISC-Bugs = #41267]</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D""> CVE: CVE-2015-8605</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" = class=3D""><br class=3D""></div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">- When handling an incorrect = command line for dhcpd, dhclient or dhcrelay</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo;" class=3D""> print out a = specific error message about the first error in addition</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> to the usage string. This may be disabled by = editing includes/site.h.</div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D""> [ISC-Bugs #40321]</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> [ISC-Bugs #41454]</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">- The configure script will now exit = with an error message if it cannot find</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> pkg-config = (needed to locate ATF used for building unit tests). Prior to</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> this the script would exit indicating success causing = subsequent attempts</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> to build the software to = fail.</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D""> [ISC-Bugs #40371]</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" = class=3D""><br class=3D""></div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D"">- Properly terminate strings = before passing them to regex and fix</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> a boundary error = when creating certain new data strings.</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> Thanks to Andrey = Jr. Melnikov for the bug report.</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> [ISC-Bugs = #41217]</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo; min-height: 13px;" class=3D""><br class=3D""></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">- = Option expressions, such as prepend and append, are now supported = when</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D""> running dhclient for IPv6. Prior to this = such statements in the</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> client configuration file would = be parsed but have no affect. Thanks</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo;" class=3D""> to Jiri = Popelka at Red Hat for reporting the issue.</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo;" class=3D""> [ISC-Bugs = #39952]</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo; min-height: 13px;" class=3D""><br class=3D""></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">- = A failover primary server will now accept a binding status update from = the</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D""> secondary which transitions a lease from = ACTIVE to ABANDONED. This accounts</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> for instances in = which a client declines a lease and only the secondary</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> server receives it. Prior to this the primary = server would reject such an</div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D""> update as an "invalid state = transition".</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> [ISC_BUGS #25189]</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo; min-height: = 13px;" class=3D""><br class=3D""></div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">- Properly allocate = memory for a bpf filter.</div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D""> Thanks to Bill Parker = (wp02855 at gmail dot com) who identified this issue.</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> [ISC-Bugs #41485]</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">- The DHCPv6 server now handles long = valid and preferred lease times better.</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> Values that = would cause the internal end time of the lease to wrap are</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> modified to work as infinite.</div><div style=3D"margin:= 0px; font-size: 11px; font-family: Menlo;" class=3D""> [ISC-Bugs = #40773]</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo; min-height: 13px;" class=3D""><br class=3D""></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">- = Correct outputting of long lines in the lease file when = writing</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D""> a lease that includes long strings in an = execute statement.</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> [ISC-Bugs #40994]</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo; min-height: = 13px;" class=3D""><br class=3D""></div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">- The server will now = correctly treat a lease as reserved when the client</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> requests an infinite lease time (i.e. OxFFFFFFFF) and = "infinite-is-reserved"</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> is enabled. Prior to this = the server would halt. In addition, corrections</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> were made to the server to allow a lease's flags field = to be set via omapi.</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> Prior to this, the server, = depending on the host architecture, would</div><div style=3D"margin:= 0px; font-size: 11px; font-family: Menlo;" class=3D""> = incorrectly parse the new flags value from the omapi message.</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> [ISC-Bugs #31179]</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo; min-height: 13px;" class=3D""><br = class=3D""></div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D"">- Add a new global DHCPv6 option, = dhcpv6-set-tee-times, which when enabled</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> instructs the = server to calculate T1 and T2 as recommended in RFC 3315,</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> Section 22.4.</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> [ISC-Bugs = #25687]</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo; min-height: 13px;" class=3D""><br class=3D""></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">- = Corrected minor Coverity issues.</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> [ISC-Bugs = #35144]</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo; min-height: 13px;" class=3D""><br class=3D""></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">- = Corrected interface name formation when using DLPI under Solaris 11. As = of</div><div style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> Solaris 11, ethernet device files are located in = "/dev/net". The configure</div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D""> script has been = modified to detect this situation and adjust the directory</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> used accordingly. Thanks to Jarkko Torppa for = reporting this issue and</div><div style=3D"margin: 0px; font-size: = 11px; font-family: Menlo;" class=3D""> submitting a = patch.</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo;" class=3D""> [ISC-Bugs #37954]</div><div style=3D"margin: = 0px; font-size: 11px; font-family: Menlo;" class=3D""> [ISC-Bugs = #40752]</div><div style=3D"margin: 0px; font-size: 11px; font-family: = Menlo; min-height: 13px;" class=3D""><br class=3D""></div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" class=3D"">- = Add a dereference call when handling an error condition while</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> decoding a packet and clean up some memory on error = conditions.</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> [ISC-Bugs #41774]</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo; min-height: = 13px;" class=3D""><br class=3D""></div><div style=3D"margin: 0px; = font-size: 11px; font-family: Menlo;" class=3D"">! Add an option in = site.h to limit the number of failover and control</div><div = style=3D"margin: 0px; font-size: 11px; font-family: Menlo;" = class=3D""> connections the server will accept. By default = this is 200.</div><div style=3D"margin: 0px; font-size: 11px; = font-family: Menlo;" class=3D""> [ISC-Bugs = #41845]</div></body></html>= --Apple-Mail=_A0FB9273-5F68-426B-B7E6-F7FFD670AB3A-- --===============3410438746472462305== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ dhcp-announce mailing list [email protected] https://lists.isc.org/mailman/listinfo/dhcp-announce --===============3410438746472462305==--