RELNOTES 202 KB
Newer Older
1
                Internet Systems Consortium DHCP Distribution
2 3
                           Version 4.4.0a1
                           11 December 2017
Ted Lemon's avatar
Ted Lemon committed
4

5
                             Release Notes
Ted Lemon's avatar
Ted Lemon committed
6

7
                              NEW FEATURES
8

9
The major "theme" for ISC DHCP 4.4.x ....
10

11
    <TBD PRIOR TO RELEASE OF 4.4.0>
12

Evan Hunt's avatar
Evan Hunt committed
13 14 15
For information on how to install, configure and run this software, as
well as how to find documentation and report bugs, please consult the
README file.
16

Evan Hunt's avatar
Evan Hunt committed
17 18
ISC DHCP uses standard GNU configure for installation. Please review the
output of "./configure --help" to see what options are available.
19

Evan Hunt's avatar
Evan Hunt committed
20 21 22
The system has only been tested on Linux, FreeBSD, and Solaris, and may not
work on other platforms. Please report any problems and suggested fixes to
<dhcp-users@isc.org>.
David Hankins's avatar
David Hankins committed
23

24 25 26 27
ISC DHCP is open source software maintained by Internet Systems
Consortium.  This product includes cryptographic software written
by Eric Young (eay@cryptsoft.com).

28 29 30 31 32 33 34 35 36 37 38 39 40
Please note that as of version 4.4.0, ISC DHCP is licensed under the Mozilla
Public License, MPL 2.0. Please see https://www.mozilla.org/en-US/MPL/2.0/
to read the MPL 2.0 license terms.

Older versions already published under the ISC license will remain under the
ISC license.  Those unsure whether or not the license change affects their use
of ISC DHCP, or who wish to discuss how to comply with the license may contact
ISC at info@isc.org or use https://www.isc.org/mission/contact/.

We welcome comments from DHCP users, about this or anything else we do.  Email
Vicky Risk, Product Manager at vicky@isc.org or discuss on
dhcp-users@lists.isc.org.

41
		Changes since 4.3.6 (New Features)
42

Francis Dupont's avatar
Francis Dupont committed
43 44 45
- Added --enable-bind-install to install embedded bind includes and
  libraries. Default is to not install them (it was the previous
  behavior). If you'd like to change the includedir and/or libdir
Francis Dupont's avatar
Francis Dupont committed
46 47 48
  installation directories to something different than for ISC DHCP
  you must pass them using the --with-bind-extra-config configuration
  arguments.
Francis Dupont's avatar
Francis Dupont committed
49 50
  [ISC-Bugs #39318]

Francis Dupont's avatar
Francis Dupont committed
51 52 53 54 55 56
- Added support of dynamic shared libraries with libtool. A new
  --enable-libtool configuration parameter is available but
  should not be used directly: *please* read the build configuration
  section in the README file for the recommended procedure.
  [ISC-Bugs #29402]

57 58 59 60 61 62 63
- IPv6 operation now supports an EUI-64 based address allocation which will
  calculate addresses for clients with EUI-64 DUIDs based on those DUIDs when
  enabled by setting use-eui-64 true.  The parameter may defined down to the
  pool scope.  Note this feature must be compiled in by defining EUI_64 in
  includes/site.h. This flag is undefined by default.
  [ISC-Bugs #43927]

64 65 66 67
- Added new compile time option --with-srv-conf-file which specifies a
  default location of the server configuration file.
  [ISC-Bugs #44765]

68 69 70 71 72 73 74 75 76 77 78
- Added --dad-wait-time parameter to dhclient. It specifies the maximum time,
  in seconds, that the client process should wait for the duplicate address
  detection to complete before initiating DHCP requests. This value is
  propagated to the dhclient script and the script is responsible for waiting
  the specified amount of time or until DAD has completed. If the script does
  not support it, specifying this parameter has no effect. The default value
  is 0 which specifies that the script should not wait for DAD. With this
  change the following scripts have been modified to support the new parameter:
  freebsd, linux, macos, netbsd, openbsd.
  [ISC-Bugs #36169]

79
- Modified DDNS support initialization such that DNS related ports will only be
80 81 82 83
  opened by the server (dhcpd) at startup if ddns-update-style is not "none";
  by dhclient only if and when the it first attempts an update; and never by
  dhcrelay.  Prior to this all three always did the initialization at startup
  which causes them to always open on and listen for traffic on two random
84
  ports. Thanks to Rodney Beede for reporting the issue.
85 86 87
  [ISC-Bugs #45290]
  [ISC-Bugs #33377]

88 89 90 91
- Added error logging to two memory allocation failure checks. Thanks to Bill
  Parker (wp02855 at gmail dot com) for reporting the issue.
  [ISC-Bugs #41185]

92 93 94
- Corrected a dhclient -6 issue that caused the client to crash with an
  "Impossible condition" error after de-preferencing its only IA binding.
  The crash occurred when server configuration changes rendered the existing
95 96
  binding out-of-range and no other leases were available to offer.  Thanks
  to Pierre Clerissi for bringing this issue to our attention.
97 98
  [ISC-Bugs #44373]

99 100 101 102
- By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h, dhclient will
  now call the script with reason set to FAIL when run with -1 (one try) and
  there are no server responses.  This applies to IPv4 mode only. Thanks for a
  patch by Martin Pitt which got to us via Andrew Pollock.
103 104
  [ISC-bugs #18183]

Tomek Mrugalski's avatar
Tomek Mrugalski committed
105
- Linux script updated. The script is now based on Debian version. It uses
106 107
  ip tool from iproute2 package and ifconfig is no longer used. This also
  addresses an issue of calling arping with inappropriate parameter.
Tomek Mrugalski's avatar
Tomek Mrugalski committed
108
  [ISC-bugs #19430]
109
  [ISC-bugs #18111]
Tomek Mrugalski's avatar
Tomek Mrugalski committed
110

111
- The directory minires has been removed from the source tree.  It has
112
  long been obsolete for branches other than v4_1_esv.  Additionally,
113 114 115
  includes/minires.h was renamed includes/ns_name.h.
  [ISC-bugs #45471]

116 117 118 119 120
- The directory includes/isc-dhcp and it's only occupant, dst.h, have
  been removed from the source tree.  They are obsolete for branches
  other than v4_1_esv.
  [ISC-bugs #45541]

121 122 123 124 125
- Replaced ISC licensing with Mozilla Public License, MPL 2.0 licensing
  throughout.  Please see https://www.mozilla.org/en-US/MPL/2.0/ to read
  the MPL 2.0 license terms.
  [ISC-Bugs #45541]

126 127 128 129 130 131
- Load balancing for failover peers can now be disabled by setting
  "load balance max secs" to 0. Doing so for both peers means both
  servers will respond to all DHCPDISCOVERs or DHCPREQUESTs as soon as
  they are received.
  [ISC-Bugs #39669]

132 133
- Added a new dhclient command line parameter, --prefix-len-hint <length>.
  When used in conjunction with -P, it directs dhclient to use the given
134 135
  length as the prefix length hint when requesting prefixes.  Thanks to
  H. Peter Anvin for suggesting this change.
136 137 138 139 140 141 142 143 144 145
 [ISC-Bugs #43792]
 [ISC-Bugs #35112]
 [ISC-Bugs #32228]
 [ISC-Bugs #29470]

- dhclient will now wait for 10 seconds after declining an IPv4 address
  before issuing a discover.  This is in keeping with RFC 2131, section 3.1.5.
  Prior to this dhclient did not wait at all. The amount of time dhclient
  waits can be specified via a new command line parameter:
  --decline-wait-time <seconds>.  A value of zero equates to no wait at all.
146
  Thanks to Pavel Kankovsky for bringing this matter to our attention.
147
  [ISC-Bugs #45457]
148

149 150 151 152
- Corrected dhclient command line parsing for --dad-wait-time that causes
  even valid values to fail as invalid on some environments.
  [ISC-Bugs #46535]

153 154 155 156 157 158
- dhclient will now include the lease address when logging DHCPOFFERs,
  DHCPREQUESTs, DHCPACKs, DHCPRELEASEs, and DHCPDECLINEs.  Additionally,
  DHCPOFFERs will be logged before their corresponding DHCPREQUESTs are
  sent and logged.
  [ISC-Bugs #2729]

159 160 161 162 163 164 165 166
- When given the -T command line argument, in addition to reading the
  current lease file, the server will write the leases to a temporary
  lease file.  This can help detect issues in server configuration that
  only surface when leases are written to the file.  The current lease
  file will not be modified and the temporary lease file is removed upon
  completion of the test.
  [ISC-Bugs #22267]

167 168 169 170 171 172
- dhclient will now generate a DHCPv6 DECLINE message containing all IA_NA
  addresses which for which the client script indicates a DAD failure. After
  receiving the DECLINE reply, dhclient will restart the solicit process.
  Note, the client script must exit with a value of 3 to signify that the
  address failed DAD.  Thanks to Jiri Popelka of Red Hat for submitting the
  patch that was the foundation for this change.
173 174
  [ISC-Bugs #21237]
  [ISC-Bugs #23357]
175
  [ISC-Bugs #36966]
176

177 178 179 180 181 182 183 184 185 186
- Replaced compilation option, enable-secs-byteorder, with a run-time, server
  configuration parameter, check-secs-byte-order.  When enabled, the
  server will check for clients that do the byte ordering on the secs field
  incorrectly.  This field should be in network byte order but some clients
  get it wrong.  When this parameter is enabled the server will examine the
  secs field and if it looks wrong (high byte non zero and low byte zero) swap
  the bytes.  The default is disabled.  This parameter is only useful when
  doing load balancing within failover.
  [ISC-Bugs #45364]

187 188 189 190 191 192 193 194 195 196 197 198 199 200
- If the server detects that a DHCPv6 client (IAID+DUID) has roamed to a new
  network, it will now automatically release pre-existing leases on the old
  network. When this occurs the server will emit a log statement:

      "Client: <id> roamed to new network, releasing lease: <address>"

  The server will carry out all of the same steps that would normally occur
  when a client explicitly releases a lease.  Prior to this the server simply
  dropped the pre-existing leases on the floor without doing the appropriate
  clean-up.  Clients that need leases in multiple networks must supply a
  unique IAID in each IA. Thanks to Fernando Soto from BlueCat Networks for
  reporting the issue.
  [ISC-Bugs #44576]

201 202 203
- The ability of the server to send back dhcp6.vendor-opts values has been
  restored. A change in 4.3.5 (see #29246) which enabled it to send back the
  FQDN option unfortunately broke its ability send back dhcp6.vendor-opts.
204 205
  Thanks to Sumant Gupta (sumantgupta at gmail dot com) of Landis+Gry for
  bringing this issue to our attention.
206 207
  [ISC-Bugs #46427]

208 209 210 211 212 213 214 215
- The default value for server (-6) parameter, prefix-length-mode, has been
  changed from "exact" to "prefer". In "prefer" mode the server will offer
  the first available prefix with the same length as that requested by the
  client. If none are found then it will offer the first available prefix of
  any length.  This is more in line with with RFC 8168 and should improve
  the out-of-the-box user experience.
  [ISC-Bugs #45615]

216 217 218 219 220 221 222 223 224 225 226
- Added support for 'dhcp-cache-threshold' to IPv6 operation: If a client
  renews before 'dhcp-cache-threshold' percent of its lease has elapsed
  (default 25%), the server will reuse the allocated lease (provide a
  lease within the currently allocated lease-time) rather than extend or
  renew the lease.  This allows the server to reply without needlessly
  writing leases to disk.  The preferred and valid lease lifetimes
  sent to the client will be reduced by the age of the lease. The option
  may be specified down to the pool level and is supported for all three
  pool types: NA, TA, and PD.
  [ISC-Bugs #45292]

227 228 229 230 231 232 233
- Added three new server configuration parameters which influence DDNS:
  1. ddns-dual-stack-mixed-mode - alters DNS conflict resolution behavior
  to mitigate issues with non-compliant clients in dual stack environments.

  2. ddns-guard-id-must-match - relaxes the DHCID RR client id matching
  requirement of DNS conflict resolution.

234
  3. ddns-other-guard-is-dynamic - alters dual-stack-mixed-mode behavior to
235 236
  allow unguarded DNS entries to be overwritten in certain cases
  [ISC-Bugs #42620]
237 238
  [ISC-Bugs #42621]
  [ISC-Bugs #44753]
239

240 241 242 243 244 245 246
- A "key-algorithm <algorithm>" statement has been added to omshell to
  allow the specification of the key algorithm to use during transaction
  authentication.  Prior to this it was hard-coded to be hmac-md5. It now
  supports all of the same algorithms as the dhcpd server: hmac-md5 (the
  default), hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and hmac-sha512.
  [ISC-Bugs #46771]

247 248 249 250 251
- Added a server configuration parameter, persist-eui-64-leases, which
  determines whether or not EUI-64 based leases are written to the
  leases file.  Default is true.
  [ISC-Bugs #45046]

252 253 254 255 256 257 258 259
- Changed the default value of the prefix length passed by dhclient into the
  client script for each IPv6 address, from 64 to 128. In addition, dhclient
  now supports a command line argument, --address-prefix-len <len>, which may
  be used to override the default value.  PLEASE NOTE: If your DHCPv6 clients
  require a value other than 128, you MUST specify the value via this new
  command line argument.  Prior to this the only way to alter the value was at
  compile time by changing DHCLIENT_DEFAULT_PREFIX_LEN in include/sites.h.
  [ISC-Bugs #23252]
260
  [ISC-Bugs #37221]
261

262 263 264 265 266
- Modified dhclient (-6) to bypass sending a confirm (INIT REBOOT) when it has
  only expired address assocations.  Thanks to Jiri Popelka at Red Hat for
  raising the issue and submitting the patch.
  [ISC-Bugs #22675]

267 268 269 270 271 272 273 274 275
- Support for delayed-ack is now compiled in by default. Prior to this
  it had to be enabled at compile time via --enable-delayed-acks. The
  default value for delayed-ack, however, has been changed from 28 to 0
  (i.e. disabled).  This was done to minimize the impact on users not
  currently using the feature.  Please note that the delayed-ack feature
  is not currently compatible with support for DHPCv4o6 (compiled out by
  default).  You must compile with one or the other but not both.
  [ISC-Bugs #42446]

276
			Changes since 4.3.6 (Bugs):
277

278 279 280 281 282 283 284 285
- Corrected an issue where the server would return a client's previously
  released prefix lease even when the client provides a prefix length
  hint that does not match the prior lease.  Now the server will only
  return the previous lease if it exactly matches the hint.  If not
  it will attempt to allocate a new prefix based on the hint and the
  prefix-length-mode.  Thanks to Tim DeNike - Lightspeed Communications
  for pointing out the error of our ways.
  [ISC-bugs #45780]
286

287 288 289 290
- Added explicit include of BIND9 isc/util.h to adapt to revisisions
  in BIND9 (see BIND9 ticket #46311).  Prior to this the build was failing
  with implicit function declarations errors for POST() and INSIST().
  [ISC-bugs #46332]
291

292 293 294 295 296
- Added to code ignore empty IPv4 host name option (code 12). While RFC 2132
  states the option cannot be empty, some clients are apparently capable of
  sending it. Prior to this the server was attempting to use it and store it
  in the lease file causing issues with DDNS and so forth.
  [ISC-bugs #43786]
297

298 299 300 301
- Replaced iasubopt::heap_index with separate values for active and inactive
  heaps: iasubopt::active_index and iasubopt::inactive_index.  This was done
  to accomodate a change in behavior in BIND9 isc_heap_delete().
  [ISC-bugs #46719]
302

303 304 305 306 307 308
! Plugged a socket descriptor leak in OMAPI, that can occur when there is
  data pending to be written to an OMAPI connection, when the connection
  is closed by the reader. Thanks to Pavel Zhukov at RedHat for bringing
  this issue to our attention and whose patch helped guide us in the right
  direction.
  [ISC-Bugs #46767]
309

310
			Changes since 4.3.6b1
311

312
- None
313

314
			Changes since 4.3.5
315

316 317 318 319 320 321 322 323
- The server now allows the client identifier (option 61) to own leases
  in more than one subnet concurrently. Prior to this the server would
  incorrectly release an existing lease in one subnet prior to assigning
  a lease in another subnet. Note that the prior behavior can be still
  be achieved by enabling one-lease-per-client. Thanks to both David Zych at
  the University of Illinois and Norm Proffitt of Infoblox for reporting
  the issue; and Norm for suggesting a solution.
  [ISC-Bugs #41358]
324

325 326 327 328 329 330
- When replying to a DHCPINFORM, the server will now include options specified
  at the pool scope, provided the ciaddr field of the DHCPINFORM is populated.
  Prior to this the server only evaluated options down to the subnet scope.
  Thanks to Fernando Soto at BlueCat Networks for reporting the issue.
  [ISC-Bugs #43219]
  [ISC-Bugs #45051]
331

332 333 334
- When memory allocation fails in a repeated way the process writes
  "Run out of memory." on the standard error and exists with status 1.
  [ISC-Bugs #32744]
335

336 337 338 339
- The new lmdb (Lightning Memory DataBase) bind9 configure option is
  now disabled by default to avoid the presence of this library to be
  detected which can lead to a link failure.
  [ISC-Bugs #45069]
340

341 342 343 344 345 346 347 348 349 350
- The linux interface discovery code has been modified to use getifaddrs()
  as is done for BSD and OS-X.  Prior to this the code would only recognize
  the first address on an interface and thereby omit vlans.
  Thanks to Jiri Popelka at Redhat, Marius Tomaschewski at SUSE, and Wei
  Kong at Novell, who all submitted patches.
  [ISC-Bugs #28761]
  [ISC-Bugs #31992]
  [ISC-Bugs #25428]
  [ISC-Bugs #31940]
  [ISC-Bugs #32935]
351

352 353 354 355 356
- Fixed a bug in OMAPI that causes omshell to crash when a name-value
  pair with a zero length value is shipped in an object. Thanks to
  Fernando Soto at BlueCat Networks for reporting the issue and
  supplying the patch.
  [ISC-Bugs #29108]
357

358 359 360 361 362
- On 64-bit platforms, dhclient now generates the correct value for the
  script environment variable, "expiry", the lease expiry value exceeds
  0x7FFFFFFF.  Prior to this such values would produce negative values
  for expiry in the script environment.
  [ISC-Bugs #43326]
363

364 365 366 367 368
- Common timer logic was modified to cap the maximum timeout values at
  0x7FFFFFFF - 1. Values larger than that were causing fatal timer out of
  range errors on 64-bit platforms. Thanks to Jiri Popelka at Red Hat for
  reporting the issue.
  [ISC-Bugs #28038]
369

370 371 372 373 374 375
- DHCP6 FQDN option unpacking code now correctly handles values that contain
  spaces, special, or non-printable characters.  Prior to this the buffer
  size needed was underestimated causing a conversion error message to
  be logged and DNS updates to be skipped. Thanks to Fernando Soto at
  BlueCat Networks for bringing the matter to our attention.
  [ISC-Bugs #43592]
376

377 378 379 380 381 382 383
- When running in -6 mode, dhclient can enforce the require option statement
  and will discard offered leases that do not contain all the required
  options specified in the client configuration.  If not enabled the client
  will still consider such leases.  This must be enabled at compile time
  (see ENFORCE_DHCPV6_CLIENT_REQUIRE in includes/site.h). Thanks to
  Mritunjaykumar Dubey at Nokia for reporting the issue.
  [ISC-Bugs #41473]
384

385 386 387 388 389 390 391
- Altered DHCPv4 lease time calculation to avoid roll over errors on 64-bit
  OS systems when using -1 or large values for default-lease-time.  Rollover
  values will be replaced with 0x7FFFFFFF - 1.  This alleviates unintentionally
  short expiration times being handed out when infinite lease times (-1) in
  conjunction with failover.  Our thanks to Alessandro Gherardi for bringing
  the issue to our attention.
  [ISC-Bugs #41976]
392

393 394 395
- Added new compile time option --with-srv-conf-file which specifies a
  default location of the server configuration file.
  [ISC-Bugs #44765]
396

397 398 399 400 401 402 403 404 405 406
- Added --dad-wait-time parameter to dhclient. It specifies the maximum time,
  in seconds, that the client process should wait for the duplicate address
  detection to complete before initiating DHCP requests. This value is
  propagated to the dhclient script and the script is responsible for waiting
  the specified amount of time or until DAD has completed. If the script does
  not support it, specifying this parameter has no effect. The default value
  is 0 which specifies that the script should not wait for DAD. With this
  change the following scripts have been modified to support the new parameter:
  freebsd, linux, macos, netbsd, openbsd.
  [ISC-Bugs #36169]
407

408 409 410 411 412 413 414 415 416 417 418
- The server nows checks both the address and length of a prefix delegation
  when attempting to match it to a prefix pool.  This ensures the server
  responds properly when pool configurations change such that once valid,
  "in-pool" delegations are now treated as being invalid.  During lease
  file loading at startup, the server will discard any PD leases that
  are deemed "out-of-pool" either by address or mis-matched prefix length.
  Clients seeking to renew or rebind such leases will get a response of
  No Binding in the case of the former, and the prefix delegation with
  lifetimes set to zero in the case of the latter. Thanks to Mark Nejedlo
  at TDS Telecom for reporting this issue.
  [ISC-Bugs #35378]
419

420 421 422 423 424 425 426 427
- Modified DDNS support initialization such that DNS related ports will only be
  opened by the server (dhcpd) at startup if ddns-update-style is not "none";
  by dhclient only if and when the it first attempts an update; and never by
  dhcrelay.  Prior to this all three always did the initialization at startup
  which causes them to always open on and listen for traffic on two random
  ports. Thanks to Rodney Beede for reporting this issue.
  [ISC-Bugs #45290]
  [ISC-Bugs #33377]
428

429 430 431
- Added error logging to two memory allocation failure checks. Thanks to Bill
  Parker (wp02855 at gmail dot com) for reporting the issue.
  [ISC-Bugs #41185]
432

433 434 435 436 437 438
- Corrected a dhclient -6 issue that caused the client to crash with an
  "Impossible condition" error after de-preferencing its only IA binding.
  The crash occurred when server configuration changes rendered the existing
  binding out-of-range and no other leases were available to offer. Thanks
  to Pierre Clerissi for bringing this issue to our attention.
  [ISC-Bugs #44373]
439

440 441 442 443 444
- By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h, dhclient will
  now call the script with reason set to FAIL when run with -1 (one try) and
  there are no server responses.  This applies to IPv4 mode only. Thanks for a
  patch by Martin Pitt which got to us via Andrew Pollock.
  [ISC-bugs #18183]
445

446 447 448 449
- The server now detects failover peers that are not referenced in at least
  one pool when run with the command line option for test mode, -T.  Prior to
  this the check was performed too far down stream to be detected in test mode.
  [ISC-Bugs #29892]
450

451 452 453 454 455
- Linux script updated. The script is now based on Debian version. It uses
  ip tool from iproute2 package and ifconfig is no longer used. This also
  addresses an issue of calling arping with inappropriate parameter.
  [ISC-bugs #19430]
  [ISC-bugs #18111]
456

457 458 459 460
- Changed severity of the log message indicating UDP checksum errors in
  the received packets from 'info' to 'debug' to avoid logging excessive
  number of false positives when UDP checksum offloading is enabled.
  [ISC-bugs #41757]
461

462 463 464 465
- The directory minires has been removed from the source tree.  It has
  long been obsolete for branches other than v4_1_esv.  Additionally,
  includes/minires.h was renamed includes/ns_name.h.
  [ISC-bugs #45471]
466

467 468 469 470 471
- Replaced ifconfig parameters "add" and "delete" with "alias" and "-alias"
  for IPv6 mode in the client scripts, netbsd and openbsd.  This was
  preventing IPv6 addresses from being added or removed from interfaces.
  Thanks to Tim Dean for reporting this issue.
  [ISC-bugs #31573]
472

473
			Changes since 4.3.5b1
474

475 476 477 478
- Corrected a bug which could cause the server to sporadically crash while
  loading lease files with the lease-id-format is set to "hex".  Our thanks
  to Jay Ford, University of Iowa for reporting the issue.
  [ISC-Bugs #43185]
479

480 481 482 483 484
- Eliminated a noisy, but otherwise harmless debug log statment that may
  appear during server startup when building with --enable-binary-leases
  and configuring multiple pools in a shared network.  Thanks to Fernando
  Soto from BlueCat Networks for reporting the issue and supplying a patch.
  [ISC-Bugs #43262]
485

486
			Changes since 4.3.4
487

488 489
- Fixed util/bindvar.sh error handling.
  [ISC-Bugs #41973]
490

491 492 493
- Correct error message in relay to use remote id length instead
  of circuit id length.
  [ISC-Bugs #42556]
494

495 496 497 498
- Add logic to test directory Makefiles to avoid copying Attfile(s)
  when building within the source tree.  This eliminates a noisy but
  otherwise harmless error message when running "make check".
  [ISC-Bugs #41883]
499

500 501 502 503 504 505 506
- Leases are now scrubbed of certain prior use information when pool
  re-balancing reassigns them from one FO peer to the other.  This
  corrects an issue where leases that were offered but not used
  by the client retained the client hostname from the original
  client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
  for reporting the issue.
  [ISC-Bugs #42008]
Francis Dupont's avatar
Francis Dupont committed
507

508 509 510 511
- In the LDAP code and schema add some missing '6' characters to use
  the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
  reporting this issue and supplying its patch.
  [ISC-Bugs #42666]
512

513 514 515 516
- Correct how the pick-first-value expression is written to a lease
  file.  Previously it was written as a concat expression due to
  a cut and paste error.
  [ISC-Bugs #42253]
517

518 519 520
- Modify the DDNS code to clean up the PTR record even if there
  are issues while cleaning up the A or AAAA records.
  [ISC-Bugs #23954]
Shawn Routhier's avatar
Shawn Routhier committed
521

522 523 524 525 526 527 528
- Added global configuration parameter, abandon-lease-time, which determines
  the amount of time a lease remains abandoned.  The default is 84600 seconds.
  Additionaly, the server now conducts a ping check (if ping checks are
  enabled) prior to offering an abandoned lease to client.  Our thanks to
  David Zych at University of Illinois for reporting the issue and working
  with us to produce a viable solution.
  [ISC-Bugs #41815]
529

530 531 532 533 534
- Correct handling of interface names during interface discovery. This
  addresses an issue where interface names of 15 characters in length
  could lead to crashes or interface recognition errors during startup
  of dhcpd, dhclient, and dhcrelay.
  [ISC-Bugs #42226]
535

536 537 538 539 540 541
- Updates to contrib/dhcp-lease-list.pl to make it more friendly.
  The updates are: looking for the lease file in more places and skipping
  the "processing complete" output when creating machine readable
  output.  Thanks to Cameron Paine (cbp at null dot net) for the
  patch.
  [ISC-Bugs #42113]
542

543 544 545 546 547 548
- When reusing a lease for dhcp-cache-threshold return the hostname
  to the original lease.  Also if the host pointer, UID or hardware address
  change don't allow reuse of the lease.
  Thanks to Michael Vincent for reporting this and helping us
  verify the problem and fix.
  [ISC-Bugs #42849]
549

550 551 552
- Change dmalloc to use a size_t as the length argument to bring it
  in line with the call it will make to malloc().
  [ISC-Bugs #40843]
553

554 555 556 557 558
- If the failover socket can't be bound, close it.  Otherwise if the
  user configures an incorrect address in the failover stanza the
  server will continue to open new sockets every 90 seconds until
  it runs out.
  [ISC-Bugs #42452]
559

560 561 562 563 564
- Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
  allow interfaces to be upstream or downstream respectively.  Upstream
  interfaces will accept and forward only BOOTP replies, while downstream
  interfaces will accept and forward only BOOTP requests.
  [ISC-Bugs #41547]
565

566 567
- Clean up some memory references in the vendor-class construct.
  [ISC-Bugs #42984]
568

569
			Changes since 4.3.4b1
570

571
- None
572

573
			Changes since 4.3.3
574

575 576
- Corrected a static analyzer warning in common/execute.c
  [ISC-Bugs #40374]
577

578 579 580 581 582 583
- ISC DHCP now follows the common convention to use the base name a
  program is invoked with (aka argv[0], vs. a builtin name) for
  logs. This should help differentiate syslog entries for DHCPv4 and
  DHCPv6 servers. You can define OLD_LOG_NAME in includes/site.h to
  keep the previous behavior.
  [ISC-Bugs #38692]
584

585 586 587 588 589 590
- The Linux packet filter code now correctly treats only the least significant
  12 bits in an inbound packet's TCI value as the VLAN id (per IEEE 802.1Q).
  Prior to this it was using the entire 16 bit value as the VLAN id and
  incorrectly discarding packets.  Thanks to Jiri Popelka at Red Hat for
  reporting this issue and supplying its patch.
  [ISC-Bugs #40591]
591

592 593 594 595 596 597
- Fixed several static analysis issues such as potential null
  references, unchecked strdup returns.  Thanks to Bill Parker (wp02855 at
  gmail dot com) who identified these issues and supplied patches to
  address them.
  [ISC-Bugs #40754]
  [ISC-Bugs #40823]
598

599 600 601
- Corrected compilation errors that prohibited building the server
  and its ATF unit tests when failover is disabled.
  [ISC-Bugs #40372]
602

603 604 605 606
- Added the lease address to the end of the debug level log message
  emitted when an existing lease is renewed within the dhcp-cache-threshold.
  Thanks to Nathan Neulinger at Missouri S&T for suggesting the change.
  [ISC-Bugs #40598]
607

608 609 610 611 612 613
- Added dhcpv6 and delayed-ack to settings listed in the "Features:"
  section of the configure script output.  Additionally, all of the
  features reported on will now always show either a "yes" or "no"
  value.  Prior to this features left to their default setting would
  not show a value.
  [ISC-Bugs #40381]
614

615 616 617 618 619 620 621 622
- Added a parameter, authoring-byte-order, to the lease file. This value
  is automatically added to the top of new lease files by the server and
  indicates the internal byte order (big endian or little endian) of the
  server.  This permits lease files generated on a server with one form of
  byte order to be used on a server with the opposite form. Our thanks to
  Timothe Litt for calling this to our attention and for the suggestions
  he provided.
  [ISC-Bugs #38396]
623

624 625 626
- Fixed a small memory leak in the DHCPv6 version of the client code.
  This is unlikely to cause significant issues in actual use.
  [ISC-Bugs #40990]
627

628 629 630 631 632
- Corrected a few minor memory leaks in omapi's dereferencing of
  host objects. Thanks to Jiri Popelka at Red Hat for reporting
  the issue and supplying the patches.
  [ISC-Bugs #33990]
  [ISC-Bugs #41325]
633

634 635 636
- Cleaned up some of the Make infrastructure to make --with-libbind
  work better.  Though it still only works with an absolute path.
  [ISC-Bugs #39210]
637

638 639 640 641
- Made the embedded bind libraries able to be cross compiled
  (please refer to the bind9 documentation to learn how to cross
   compile DHCP and its bind library dependency).
  [ISC-Bugs #38836]
642

643 644 645
- Update the client code to better support getting IA_NAs and IA_PDs
  in the same packet, see RFC7550 for some discussion.
  [ISC-Bugs #40190]
646

647 648 649 650 651
! Update the bounds checking when receiving a packet.
  Thanks to Sebastian Poehn from Sophos for the bug report and a suggested
  patch.
  [ISC-Bugs #41267]
  CVE: CVE-2015-8605
652

653 654 655 656 657
- When handling an incorrect command line for dhcpd, dhclient or dhcrelay
  print out a specific error message about the first error in addition
  to the usage string.  This may be disabled by editing includes/site.h.
  [ISC-Bugs #40321]
  [ISC-Bugs #41454]
658

659 660 661 662 663 664
- The configure script will now exit with an error message if it cannot find
  a GNU-style make tool (needed when building BIND libraries) or pkg-config
  (needed to locate ATF used for building unit tests). Prior to this the
  script would exit indicating success causing subsequent attempts to build
  the software to fail.
  [ISC-Bugs #40371]
665

666 667 668 669
- Properly terminate strings before passing them to regex and fix
  a boundary error when creating certain new data strings.
  Thanks to Andrey Jr. Melnikov for the bug report.
  [ISC-Bugs #41217]
670

671 672 673 674 675
- Option expressions, such as prepend and append, are now supported when
  running dhclient for IPv6.  Prior to this such statements in the
  client configuration file would be parsed but have no affect.  Thanks
  to Jiri Popelka at Red Hat for reporting the issue.
  [ISC-Bugs #39952]
676

677 678 679 680 681 682
- A failover primary server will now accept a binding status update from the
  secondary which transitions a lease from ACTIVE to ABANDONED. This accounts
  for instances in which a client declines a lease and only the secondary
  server receives it.  Prior to this the primary server would reject such an
  update as an "invalid state transition".
  [ISC_BUGS #25189]
683

684 685 686
- Properly allocate memory for a bpf filter.
  Thanks to Bill Parker (wp02855 at gmail dot com) who identified this issue.
  [ISC-Bugs #41485]
687

688 689 690 691
- Updated contrib/dhcp-lease-list.pl to handle garbage in the oui file better
  and to print out the hostnames a bit better.
  Thanks to Antoine Beaupré from Debian for the suggested patch.
  [ISC-Bugs #41288]
692

693 694 695 696
- The DHCPv6 server now handles long valid and preferred lease times better.
  Values that would cause the internal end time of the lease to wrap are
  modified to work as infinite.
  [ISC-Bugs #40773]
697

698 699 700
- Updated support for cross compiling by allowing the library archiver
  to be set at configure time via the environment variable 'AR'.
  [ISC-Bugs #41536]
701

702 703 704 705 706
- The server will now match DHCPv6 relayed clients to host declarations
  which include the "hardware" statement, if the relay connected to the
  client supplies the client's hardware address via client-linklayer-address
  option as per RFC 6939.
  [ISC-Bugs #40334]
707

708 709 710 711
- Allow a filename to be specified instead of /dev/random during
  configuration.  This is passed to the BIND configuration to allow
  for cross compilation.
  [ISC-Bugs #33835]
712

713 714
- Add more option definitions.
  [ISC-Bugs #40562]
715

716 717 718
- Correct outputting of long lines in the lease file when writing
  a lease that includes long strings in an execute statement.
  [ISC-Bugs #40994]
719

720 721 722 723 724 725 726
- The server will now correctly treat a lease as reserved when the client
  requests an infinite lease time (i.e. OxFFFFFFFF) and "infinite-is-reserved"
  is enabled.  Prior to this the server would halt.  In addition, corrections
  were made to the server to allow a lease's flags field to be set via omapi.
  Prior to this, the server, depending on the host architecture,  would
  incorrectly parse the new flags value from the omapi message.
  [ISC-Bugs #31179]
727

728 729 730 731
- ISC DHCP can now be configured and built from a directory other than
  the top level source directory. Note that "make distcheck" uses this
  feature.
  [ISC-Bugs #39262]
732

733 734 735 736 737 738
- Add support for RFC 3527 to dhcrelay.  A new, dhcrelay command line argument,
  "-U <interface>" enables the addition of a RFC 3527 compliant link selection
  suboption to the agent option added for clients directly connected to the
  relay.
  [ISC-Bugs #34875]
  [ISC-Bugs #41708]
739

740 741 742 743
- Add a new global DHCPv6 option, dhcpv6-set-tee-times, which when enabled
  instructs the server to calculate T1 and T2 as recommended in RFC 3315,
  Section 22.4.
  [ISC-Bugs #25687]
744

745 746
- Corrected minor Coverity issues.
  [ISC-Bugs #35144]
747

748 749 750 751 752 753 754 755
- Add support for RFC 7341 DHCPv4 over DHCPv6 with a new configuration
  option "--enable-dhcpv4o6". Note this feature requires DHCPv6 support
  and is not compatible with delayed-ack. Both client and server use 2
  processes which communicate over UDP on a pair of sockets. The new
  "-4o6 <port>" command line argument enables DHCPv4 over DHCPv6 support
  and specifies the consecutive ports to use for inter-process communication.
  Please look at doc/DHCPv4-over-DHCPv6 for more details.
  [ISC-Bugs #35711]
756

757 758 759 760
- Correct interface name formation when using DLPI under Solaris 11. As of
  Solaris 11, ethernet device files are located in "/dev/net".  The configure
  script has been modified to detect this situation and adjust the directory
  used accordingly. Thanks to Jarkko Torppa for reporting this issue and
761
  submitting a patch
762 763
  [ISC-Bugs #37954]
  [ISC-Bugs #40752]
764

765 766 767
- Add a dereference call when handling an error condition while
  decoding a packet.
  [ISC-Bugs #41774]
768

769 770 771 772 773 774
- Add a new parameter, lease-id-format, to both dhcpd and dhclient. The
  parameter controls the format in which certain values are written to lease
  files.  Formats supported are octal - quoted string containing octal
  escapes, and hex - unquoted, colon separated hex digits.  Thanks to
  Jay Ford, University of Iowa for bringing the issue to our attention.
  [ISC-Bugs #26378]
775

776 777 778 779
! Add an option in site.h to limit the number of failover and control
  connections the server will accept.  By default this is 200.
  [ISC-Bugs #41845]
  CVE: CVE-2016-2774
780

781
			Changes since 4.3.3b1
782

783
- None
784

785
			Changes since 4.3.2
786

787 788 789 790 791 792 793
- The server now does a better check to see if it can allocate the memory
  for large blocks of v4 leases and should provide a slightly better error
  message.  Note well: the server pre-allocates v4 addresses, if you use
  a large range, such as a /8, the server will attempt to use a large
  amount of memory and may not start if there either isn't enough memory
  or the size exceeds what the code supports.
  [ISC-Bugs #38637]
794

795 796 797 798 799 800 801 802 803 804 805 806 807
- The server will now reject unicast Request, Renew, Decline, and Release
  messages from a client unless the server would have sent that client the
  dhcp6.unicast option.  This behavior is in compliance with paragraph 1 in
  each of the sections 18.2,1, 18.2.3, 18.2.6, and 18.2.7 of RFC 3315. Prior
  to this, the server would simply accept the messages.  Now, in order for
  the server to accept such a message, the server configuration must include
  the dhcp6.unicast option either globally or within the shared network to
  which the requested lease belongs. In other words, the server will map
  the first IA_XX address found within the client message to a shared-network
  and look for the presence of the unicast option there and then globally.
  Thanks to Jiri Popelka at Red Hat for this issue and his patch which
  inspired the fix.
  [ISC-Bugs #21235]
808

809 810 811 812 813
- The ATF (Automated Testing Framework) tools used for optional unit tests
  can now be built from its embedded sources in bind, solving the
  atf-run / atf-report issue with recent (>= 0.20) versions of ATF.
  The new configuration option is "./configure --with-atf=bind".
  [ISC-Bugs #38754, #39300]
814

815 816 817 818 819
- Corrected a compilation error introduced by the fix for ISC-Bugs #22806.
  On older linuxes that do not include the tpacket_auxdata structure don't
  bother allocating the cmsgbuf as it isn't necessary and we don't have
  a proper length for it.
  [ISC-Bugs #39209]
820

821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187
- Remove the dst directory.  This was replaced in 4.2.0 with the dst
  code from the Bind libraries but we continued to include it for
  backwards compatibility.  As we have now released 4.3.x it seems
  reasonable to remove it.
  [ISC-Buts #39019]

- Write out the DUID server id on startup in all cases, previously if it
  was read in from server-duid option in the config or lease files for
  DHCPv4 it would not be written to the new lease file.
  [ISC-Bugs #37791]

- When parsing dates for leases convert dates past 2038 to "never".
  This avoids problems with integer overflows in the date and time
  handling code for people that decide to use very large lease times
  or add a lease entry with a date far in the future.
  [ISC-Bugs #33056]

- Leave the siaddr field clear when sending a NACK as per RFC 2131
  table 3.
  [ISC-Bugs #38769]

- In the client don't send expired addresses to the script as part of
  the binding process.  Thanks to Sven Trenkel at Google for reporting
  the issue and suggesting the patch.
  [ISC-Bugs #38631]

- While parsing IPv6 addresses treat "add" as part of the address instead
  of as a token.
  [ISC-Bugs #39529]

- Add support for accessing the v4 lease queues (active, free etc) in a
  binary fashion instead of needing to walk through a linear list to
  insert, find or remove an entry from the queues.  In addition add a
  compile time option "--enable-binary-leases" to enable the new code
  or to continue using the old code.  The old code is the default.
  Thanks to Fernando Soto from BlueCat Networks for the patch.
  [ISC-Bugs #39078]

- Delayed-ack now works properly with Failover. Prior to this, bind updates
  post startup were being queued but never delivered. Among other things, this
  was causing leases to not transition from expired or released to free.
  [ISC-Bugs #31474]

- Clean up parsing of v6 lease files a bit to avoid infinite loops if the
  lease file is corrupt in certain ways.
  [ISC-Bugs #39760]

- Corrected a crash in dhclient that occurs during lease renewal if the
  client is performing its own DNS updates.  Thanks to Jiri Popelka at Red Hat
  for the bug report.
  [ISC-Bugs #38639]

- Corrected an issue in v6 lease file parsing. Prior to this, when encountering
  a lease with an address for which no configured pool exists, the server was
  declaring the lease file corrupt and incorrectly skipping over the subsequent
  entry in the file.  The server will now emit a log message indicating that
  no pool was found for the address (or prefix) and correctly resume parsing
  with the next entry in the lease file.  Our thanks to Michal Žejdl for
  reporting the issue.
  [ISC-Bugs #39314]

- Be more liberal in finding a subnet group associated with a static
  prefix.  When we added the class matching code for v6 we also added
  a requirement that the static prefix must be within a subnet the
  client was in, in order to find the proper statements.  We now
  look for a subnet based on the prefix, failing that on the static
  address for the client and failing that on the shared network
  itself.
  [ISC-Bugs #38329]

- Add a new action expression "parse_vendor_options", which can be used
  to parse a vendor-encapsualted-option received by the server based on
  the encoding specified by the vendor-option-space statement.
  [ISC-Bugs #36449]

- Enhance the PARANOIA patch to include fchown() the lease file to
  allow it to be manipulated after the server does a chown().
  Thanks to Jiri Popelka at Red Hat for the patch.
  [ISC-Bugs #36978]

- Relax the requirement that prefix pools must be within the subnet.
  This was added in as part of #32453 in order to avoid configuration
  mistakes but is being removed as prefixes aren't required to be
  within the same subnet and many people configure them in that fashion.
  [ISC-Bugs #40077]

- Fixed a server crash that could occur when the server attempts to remove
  the billing class from the last lease billed to a dynamic class after said
  class has been deleted.  Our thanks to Lasse Pesonen for reporting the
  issue.
  [ISC-Bugs #39978]

- LDAP Patches - Numerous small patches submitted by contributors have
  been applied to the contributed code which supplies LDAP support.
  In addition, two larger submissions have also been included.  The
  first adds support for IPv6 configuration and the second provides
  GSSAPI authentication. We would like to thank the following for their
  contributions (alphabetically):
    Alex Novak at SUSE
    Bill Parker (wp02855 at gmail dot com)
    Jiri Popelka at Red Hat
    Marius Tomaschewski at SUSE
    (william at adelaide.edu.au), The University of Adelaide
  [ISC-Bugs #39056]
  [ISC-Bugs #22742]
  [ISC-Bugs #24449]
  [ISC-Bugs #28545]
  [ISC-Bugs #29873]
  [ISC-Bugs #30183]
  [ISC-Bugs #30402]
  [ISC-Bugs #32217]
  [ISC-Bugs #32240]
  [ISC-Bugs #33176]
  [ISC-Bugs #33178]
  [ISC-Bugs #36409]
  [ISC-Bugs #36774]
  [ISC-Bugs #37876]

- Handle an out of memory condition in the client a bit better.
  Thanks to Frédéric Perrin from Brocade for finding the issue
  and suggesting a patch.
  [ISC-Bugs #39279]

			Changes since 4.3.2rc2
- None

			Changes since 4.3.2rc1

- Corrected a compilation error introduced by the fix for ISC-Bugs #37415.
  The error occurs on Linux variants that do not support VLAN tag information
  in packet auxiliary data.  The configure script now only enables inclusion
  of the VLAN tag-based logic if it is supported by the underlying OS.
  [ISC-Bugs #38677]

			Changes since 4.3.2b1

- Specifying the option, --disable-debug, on the configure script command line
  now disables debug features.  Prior to this, specifying --disable-debug
  incorrectly enabled debug features. Thanks to Gustavo Zacarias for reporting
  the issue.
  [ISC-Bugs #37780]

- Unit test execution now uses a path augmented during configuration
  processing of the --with-atf option to locate ATF runtime tools, atf-run
  and atf-report. For most installations of ATF, this should alleviate the
  need to manually include them in the PATH, as was formerly required.
  If the configure script cannot locate the tools it will emit a warning,
  informing the user that the tools must be in the PATH when running unit
  tests.
  Secondly, please note that "make check" will now exit with a failure status
  code (non-zero) if one or more unit tests fail.  This means that invoking
  "make check" from an upper level directory will cause the make process to
  STOP after the first test subdirectory with failed test(s).  To force all
  tests in all subdirectories to run, regardless of individual test outcome,
  use the command "make -k check".
  [ISC-Bugs #38619]

			Changes since 4.3.1

- Corrected parser's right brace matching when a statement contains an error.
  [ISC-Bugs #36021]

- TSIG-authenticated dynamic DNS updates now support the use of these
  additional algorithms: hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,
  and hmac-sha512
  [ISC-Bugs #36947]

- Added check for invalid failover message type. Thanks to Tobias Stoeckmann
  working with the OpenBSD project who spotted the issue and provided the
  patch.
  [ISC-Bugs #36653]

- Corrected rate limiting checks for bad packet logging.  Thanks to Tobias
  Stoeckmann working with the OpenBSD project who spotted the issue and
  provided the patch.
  [ISC-Bugs #36897]

- Log statements depicting what files will be used by the server now occur
  after the configuration file has been processed.
  [ISC-Bugs #36671]

- Addressed Coverity issues reported as of 07-31-2014:
  [ISC-Bugs #36712] Corrects Coverity reported "high" impact issues.
  [ISC-Bugs #36933] Corrects Coverity reported "medium" impact issues
  [ISC-Bugs #37708] Fixes compilation error in dst_api.c seen in older
  compilers that was introduced by #36712

- Server now supports a failover split value of 256.
  [ISC-Bugs] #36664]

- Remove unneeded error #defines.  These defines were included in case
  external programs required the older versions of the macro.  They
  have been #ifdeffed for now and will be removed at a future date.
  See site.h for the #define to include them again, but you should
  switch to using the DHCP_R_* versions instead of the ISC_R_* versions.
  Also ISC_R_MULTIPLE has been removed as it is also defined in bind.
  [ISC-Bugs #37128]

- Added checks in range6 and prefix6 statement parsing to ensure addresses
  are within the declared subnet. Thanks to Jiri Popelka at Red Hat for the
  bug report and patch.
  [ISC-Bugs #32453]
  [ISC-Bugs #17766]
  [ISC-Bugs #18510]
  [ISC-Bugs #23698]
  [ISC-Bugs #28883]

- Addressed checksum issues:
  Added checksum readiness check to Linux packet filtering which eliminates
  invalid packet drops due to checksum errors when checksum offloading is
  in use.  Based on dhcp-4.2.2-xen-checksum.patch made to the Fedora project.
  [ISC-Bugs #22806]
  [ISC-Bugs #15902]
  [ISC-Bugs #17739]
  [ISC-Bugs #18010]
  [ISC-Bugs #22556]
  [ISC-Bugs #29769]
  Inbound packets with UDP checksums of 0xffff now validate correctly rather
  than being dropped.
  [ISC-Bugs #24216]
  [ISC-Bugs #25587]

- Added the echo-client-id configuration parameter to the server configuration.
  The server now supports RFC 6842 compliant behavior by setting a new
  configuration parameter, echo-client-id.  When enabled, the server will
  include the client identifier option (Option code 61) if received, in its
  responses.  The server identifier returned in NAKs (if enabled) will now
  be the globally defined value (if one) if the server cannot attribute the
  inbound request to a known subnet.
  [ISC-Bugs #35958]
  [ISC-Bugs #32545]

- Added support of the configuration parameter, use-host-decl-names, to
  BOOTP request handling.
  [ISC-Bugs #36233]

- Added logic to ignore the signal, SIGPIPE, which ensures write failures
  will be delivered as errors rather than as SIGPIPE signals on all OSs.
  Thanks to Marius Tomaschewski from SUSE who reported the issue and provided
  the patch upon which the fix is based.
  [ISC-Bugs #32222]

- In the failover code, handle the case of communications being interrupted
  when the servers are dealing with POTENTIAL-CONFLICT.  This patch allows
  the primary to accept the secondary moving from POTENTIAL-CONFLICT to
  RESOLUTION-INTERRUPTED as well as handling the bind update process better.
  In addition the code to resend update or update all requests has been
  modified to send requests more often.
  [ISC-Bugs #36810]
  [ISC-Bugs #20352]

- By default, the server will now choose the value to use in the forward DNS
  name from the following in order of preference:

    1. FQDN option if provided by the client
    2. Host name option if provided by the client
    3. Configured option host-name if defined

  As before, this may be overridden by defining ddns-hostname to the desired
  value (or expression).  In addition, the server logic has been extended to
  use the value of the host name declaration if use-host-decl-names is enabled
  and no other value is available.
  [ISC-Bugs #21323]

- DNS updates were being attempted when dhcp-cache-threshold enabled the use of
  the existing lease and the forward DNS name had not changed.  This has been
  corrected.
  [ISC-Bugs #37368]
  [ISC-Bugs #38636]

- Corrected an issue which caused dhclient to incorrectly form the result when
  prepending or appending to the IPv4 domain-search option, received from the
  server, when either of the values being combined contain compressed
  components.
  [ISC-Bugs #20558]

- Added the server-id-check parameter to the server configuration.
  This parameter allows run-time control over whether or not a server,
  participating in failover, verifies the dhcp-server-identifier option in
  DHCP REQUESTs against the server's id before processing the request.
  Formerly, enabling this behavior was done at compilation time through
  the use of the #define, SERVER_ID_CHECK, which has been removed from site.h
  The functionality is now only available through the new runtime parameter.
  [ISC-Bugs #37551]

- During startup, when the server encounters a lease whose binding state is
  FTS_BACKUP but whose pool has no configured failover peer, it will reset