File pihole-ftl.changes of Package pihole-ftl

Overview Repositories Revisions Requests Users Attributes Meta

File pihole-ftl.changes of Package pihole-ftl (Revision 0cba9ac861f98e21bce07a4f2612bd16)

Currently displaying revision 0cba9ac861f98e21bce07a4f2612bd16 , Show latest

--------------------------------------------------------------------
Wed Apr 14 11:04:39 UTC 2021 - pihole-suse-packages@smar.fi

- Update to version v5.7
  + Fix incorrect "FATAL" error message during garbage collection
  + Fix incorrect "FATAL" error message during garbage collection
  + Move fd into frec_src, fixes 15b60ddf935a531269bb8c68198de012a4967156
  + Fix to 75e2f0aec33e58ef5b8d4d107d821c215a52827c
  + Optimise sort_rrset for the case where the RR type no canonicalisation.
  + Fix for 12af2b171de0d678d98583e2190789e544440e02
  + Don't display unrelated CNAME queries when filtering for specific domain
  + dnsmasq-v2.83 forwards multiple queries to the same destination only once and stores the other queries as duplicates. They do receive the answer later on, however, this is usually not logged (when log-queries=extra is enabled, there will be a warning about the duplicate). This commit handles such duplicates and introduces a new reply type 14 = "already forwarded"
  + When seeing duplicated queries, the original query may have been blocked during CNAME inspection. In this case, we need to change the status from "OK (already forwarded)" to the correspondig blocked status. The "already forwarded" information is lost but that seems okay.
  + Check source query for its status when checking if we need to update the duplicated ones
  + Tidy initialisation in hash_questions.c
  + Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH.
  + Bump copyright notices for 2021. Happy New Year!
  + Fix possible free-memory ref in e75069f79aa6b8a61034a9a4db9b6265b8be8ae4
  + Fixes incorrect "Found unknown status 14 in long term database" warning in the logs. We change the code to use a enum-based struct so we cannot forget to update this in the future when adding further query status types.
  + Add per-client rate-limiting. The default limit is 1000 queries in 60 seconds.
  + Add output of how much memory in /dev/shm is used by FTL itself
  + Try to create shared memory objects before reading the settings
  + Do not try to delete existing shmem objects on start - that may cause running FTL instances to crash when it tries to access them. Instead, new instances should properly fail to start.
  + Tests: Running a second instance is detected and prevented, FTL continues to work as expected afterwards
  + Do not explicitly request a lease time in our DHCPREQUEST as this may lead to incorrect responses. Also, when sending a request to lo, we should send it to the interface address instead of the broadcast (lo doesn't support broadcast destinations).
  + Fix queries sent upstream being counted incorrectly when modified later on (blocked externally, blocked during CNAME inspection). This also applies to queries loaded from the database.
  + Increment forward counters when immporting QUERY_RETRIED or QUERY_RETRIED_DNSSEC fromthe database
  + Retain EDNS0 bits from incoming queries when blocking requests

--------------------------------------------------------------------
Tue Jan 19 14:43:45 UTC 2021 - pihole-suse-packages@smar.fi

- Update to version v5.5
  + Detect and handle interface changes of clients with the same IP
  + Update SQLite3 to 3.34.0 and expose sqlite3 shell as 'pihole-FTL sqlite3' (drop-in replacement is available as well)
  + mend
  + Added missing NS query type to getQueryTypes()
  + Log date/time of FTL in header just as SQLite3 does as well
  + Test for embedded SQLite3 shell available and functional
  + Modified test for NS type
  + Fix for errno not being set by posix_fallocate() in contrast to fallocte() who did set it.
  + Add new query types SVCB and HTTPS
  + Tests: Add SVCB and HTTPS as expected query types
  + Implement support for displaying exact type instead of the catch-them-all category OTHER. The OTHER category is still used when it comes to computing statistics to ensure your chart's legend does not explode.
  + We cannot really decide whether local configuration lines are meant for blocking or something else. Just record such queries as replied to from cache because this is what they are. This code made sense at the time where wildcards were implemented as dnsmasq config lines, however, we've advanced to our own regex engine since then and all config lines should have also been auto-migrated.
  + Clarify comment
  + Only return regex index when allowed by privacy settings. This may leak information, otherwise.
  + Check for validity if iface pointe before dereferencing it.
  + Don't show retried queries when filtering for blocked queries.
  + Optimize datastructures using bitfields and item re-arrangement (to minimize padding). This reduces the size of query, client, and regex records by 8 bytes per item. Note that this optimization was done on x86_64 and may not apply for other architectures (32bit architectures already used less padding).
  + Statically assert struct sizes are what we expect. This prevents us from increasing the memory needs unintentionally (e.g. due to sub-optimal padding)
  + Store blocked property in query flags.
  + Use blocked property in API code. Make query->upstreamID = -1 the new default to differentiate easily what was forwarded (ID will be >= 0) and what not (ID == -1). Store the upstream server also for other query types that were forwarded (like queries blocked during CNAME inspection).
  + Add MAXDBDAYS=-1 to disable auto-cleaning and ensure overflow cannot happen (we just enforce the maximum in this case)
  + pxe: support pxe clients with custom vendor-class
  + Use the values of --min-port and --max-port in TCP connections.
  + Fix remote buffer overflow CERT VU#434904
  + Check destination of DNS UDP query replies.
  + Use SHA-256 to provide security against DNS cache poisoning.
  + Optimse RR digest calculation in DNSSEC.
  + Fix DNS reply when asking for DNSSEC and a validated CNAME is already cached.
  + Add missing check for NULL return from allocate_rfd().
  + Handle multiple identical near simultaneous DNS queries better.
  + Handle caching with EDNS options better.
  + Support hash function from nettle (only)
  + Small cleanups in frec_src datastucture handling.
  + Adapt for change in struct forward to forward->frec_src
  + Update dnsmasq version string
  + Fix warning message logic.
  + Update to new struct frec fields in conntrack code.

--------------------------------------------------------------------
Tue Jan 12 05:14:26 UTC 2021 - pihole-suse-packages@smar.fi

- Update to version v5.3.4
  + Show BOOTP server and file strings used by TFTP
  + Update dnsmasq version to 2.82
  + Use fork-private regex substructure because each regex has an opaque structure (once compiled) and cannot be kept globally available through shared memory (at least not with any realistic effort)
  + We have to explicitly set conflinebuffersize to zero when freeing the buffer itself to avoid getline() crashing in some special edge-cases
  + Rename memory.c -> syscalls.c
  + Factor out syscalls for calloc, free, realloc and strdup into dedicated syscalls/{}.c files
  + Add interrupt-safe fprintf() and printf() routines
  + Add interrupt-safe vfprintf() and vprintf() routines
  + Make calloc(), realloc() and strdup() interrupt-safe
  + Add interrupt-safe write() routine
  + Add interrupt-safe accept() routine
  + Avoid redundant error reporting
  + Improve printf(), fprintf(), vprintf(), and vfprintf() error reporting
  + Add interrupt-safe recv() routine
  + Add interrupt-safe recvfrom() routine
  + Add interrupt-safe pthread_mutex_lock() routine
  + Add interrupt-safe select() routine
  + Add interrupt-safe fopen() routine
  + Add interrupt-safe sendto() routine
  + Backup and restore errno in real-time signal handler.
  + Add interrupt-safe vsnprintf() routine
  + Add interrupt-safe snprintf() routine
  + Add interrupt-safe vsprintf() routine
  + Add interrupt-safe sprintf() routine
  + Show complete list of args when complaining about unsupported argument
  + Adjust test for unknown argument to support the new format
  + Expose lua-interpreter as virtual pihole-lua binary
  + Add drop-in support for lua binary
  + Add drop-in replacement support for luac as well
  + Fix freeing regex pointers to set the global not the local object to NULL after free().
  + Add interrupt-safe asprintf() and vasprintf() routines
  + Add more debugging output for domain reloading (on receipt of SIGHUP)
  + Add REFRESH_HOSTNAMES=UNKNWON to support only refreshing recently active clients with unknown hostnames
  + Force refreshing of hostnames (according to REFRESH_HOSTNAMES config) on receipt of SIGRT4
  + Give explicit reason for skipping in debug message
  + Fall back to using ftruncate() when fallocate() return with "Operation not supported". This may happen if the kernel is older than 2.6.23 or glibc older than 2.10. ftruncate() has its own disadvantages, however, it is POSIX compliant (POSIX.1-2001) so should be supported even by ancient kernels.
  + Add new DEBUG_EXTRA flag used for special (temporary) debugging
  + Update src/resolve.c
  + num_regex is not in counters any more
  + Enable extra logging only when DEBUG_EXTRA is set
  + docs: fix simple typo, timestemp -> timestamp
  + Add interrupt-safe fallocate() routine, due to the special nature of the fallocate() macro, we hav to use a modified name fTLallocate() to implement this function
  + Prevent possible deadlock if log is not writable (e.g., permission denied)
  + Don't fail when trying to free(NULL)
  + Fix Unix socket error handling
  + Do not print user change information if there is no user change
  + Reply with configured BLOCKINGMODE to blocked CNAME requests
  + Revert "Improve compatibility with old (ancient) kernels"
  + Analyze original question and use it to decide whether we mock an A or AAAA reply when blocking
  + Don't iterate over all clients every minute trying to find new ones but only do this when the RESOLVE_NEW_HOSTNAMES event is set
  + Add DEBUG_EXTRA flag (#994)
  + Escape spaces by ~
  + Do not sync after executing regular expression on a domain
- Use proper version handling in spec

--------------------------------------------------------------------
Sat Dec  5 07:02:17 UTC 2020 - pihole-suse-packages@smar.fi

- Refreshed patch shared_libraries.patch
    - gmp needs to be statically linked for Tumbleweed
- Update to version v5.3.2
  + Add additional_info column to test database (query table)
  + All queries: Hide UNKNOWN queries when not requesting both query status types
  + Add ability to connect to shared memory of the running FTL process
  + Bundle lua library "inspect"
  + Automatically load bundled libraries and make them available globally.
  + Test: Automatically loaded libraries
  + Add pihole.query([idx])
  + Test: pihole.query(0) returns details of the first query
  + Include FTL's prototypes in LUA
  + Remove shm data sourcing. We will query such data through the API with Pi-hole v6.0
  + Add support for ECS subnet parsing in FTL.
  + Log previously seen client when interpreting EDNS0 client subnet information
  + Evaluate possible EDNS data before analyzing a new query
  + Analyse ECS information only if EDNS0_ECS is enabled (enabled by default)
  + Add support for EDNS(0) CPE-ID (Common Platform Enumeration Identifier)
  + Protect against possible buffer overflow due to a malicious/malformed EDNS(0) payload
  + Add support for EDNS(0) MAC in BYTE format (dnsmasq option add-mac)
  + Add support for EDNS(0) MAC in TEXT format (dnsmasq option add-mac=text)
  + Add partial support for EDNS(0) MAC in BASE64 format (dnsmasq option add-mac=base64)
  + Correct name is EDNS(0) not EDNS0.
  + EDNS(0) debug message fine-tuning
  + Use preprocessor constants for OPTCODES to improve readability of the code
  + Add partial support for EDNS(0) COOKIES
  + Tests: EDNS(0) analysis
  + Make EDNS MAC available for FTL_new_query()
  + Tests: Simplify EDNS(0) tests
  + Use %z to print size_t for both 32 and 64 bit compatibility
  + The version of dig in the CI containers is too old for the option +cookie. Simulate the same with +ednsopt
  + Improve regex engine. This adds new features such as in-code comments, approximate matching (fuzzy matching)
  + Add regex-test mode
  + Allow test-regex mode to be started without log ans shared memory (alleviates write permission issues when running pihole-FTL as a different user)
  + Reduce overall costs by not always calling the approximate matching algorithm.
  + Add 26 regex tests (following https://discourse.pi-hole.net/t/regex-engine-improvements/34751)
  + Make regex-text output more user-friendly
  + Tests: Bats ignored empty lines
  + Mark all the new cli_{}() functions as ((const)) to make them subject to common subexpression elimination.
  + Use info box for step reporting
  + Adjust empty lines
  + Tests: Add tests for useful error hints for incorrect regex.
  + Mark get_regex_from_rowid as pure.
  + Modify regex-test mode for better batch-processing capabilities
  + Add quiet regex test mode for inclusion in pihole -q
  + Make quiet mode really quiet. However, speak up when there are regex errors
  + Tests: Test quiet regex-test mode
  + Simplify memory structure of regular expressions inside FTL. This allows for future regex extensions.
  + Add ;querytype=AAAA option
  + Case-insensitive query type checking in regex extra instructions
  + Add ;invert option
  + Make querytype string available everywhere in FTL.
  + Add ;querytype=!A option for INVERTED query type filtering.
  + Add tests for ";querytype=A", ";querytype=!A" and ";invert". Add explicit support for query type NS.
  + Terminate running FTL instance (if any) before starting tests.
  + Log invalid querytype as warning to the Pi-hole diagnosis system
  + Only print time/ID string when not in direct user interaction (CLI mode)
  + Fix API computation error introduced in e0609f14eee7903bca93020371576dad0ca93338
  + Blocking PTR requests may have been done unintentionally, print a warning about this
  + Warn if specified more than one querytype option (the last one wins)
  + Add tests for new ;querytype sanity check warnings.
  + Undo PTR blocking warning
  + Try to obtain MAC address from dnsmasq's cache (also ask the kernel) instead of only relying on the database content (may not be fully up-to-date)
  + Tests: Need to test also for the interface being specified in the log
  + Remove left-over debugging output
  + Tests: Tweak test to recognize new debug output format
  + Implement super-client infrastructure
  + Try to obtain MAC address from dnsmasq's cache (also ask the kernel) instead of only relying on the database content (may not be fully up-to-date)
  + Read superclients from new FTL database table
  + Import super-clients during start (before all other clients are added)
  + Implement client-based Query Log filtering for super-clients and ensure we always count both the normal and the super-client when there is a new query / garbage collection
  + Rename table from "superclients" to "superclient".
  + Tests: Database has been updated to version 9
  + Change concept of super-clients from MAC-based to index-based. We append a new column to the network table which can be used to assign super-clients to multiple devices. This can both cover automatic grouping (whenever MAC addresses are available) and also situations where this is not possible (when MAC addresses are not available, e.g., due to network layer separation). Real-time signal 3 causes FTL to re-import super-clients from the database without affecting anything else.
  + Move signal handling into a thread to avoid possible lock race-collisions
  + Tests: Test for correct import and assignment of super-client
  + Ensure we cannot end up in a self-locking state when opening the database.
  + Explicitly case time_t to (long long) before printing to address the musl-decision to make time_t 64 bit on 32 bit machines
  + Show also possible IPv6 nameservers. They are stored in an auxiliary (external) structure so they were not included in the debug outputs (even when they were used)
  + Use EDNS(0) MAC address for the network table (if available)
  + Do not try to locate a previously used mock device when EDNS(0) MAC data is available.
  + Add more debugging output to network table processing
  + Ensure mock-devices which are not assigned to any addresses any more (they have been converted to "real" devices), are removed at this point
  + Do not re-open gravity database when not forking for TCP workers (debug mode) and simplify network table routines (remove code duplication and prevent possible dead-locks when trying to resolve host names)
  + A small fix ensuring that we can determing the interface a query came in for all clients (also localhost)
  + Unify network table debug messages
  + Parse the kernel's Internet protocol address management to get information about local interfaces.
  + Delete addresses from network_addresses table which have not be seen for 7 days
  + Only try to resolve host names of upstream servers which were recently active. The current limit for "recently active" is hard-coded to two hours.
  + Fix error displaying if the upstream server replied with REFUSED or SERVFAIL
  + Extend domain filtering to also check the CNAME domain for domain-filtering (if this is indicated by the query status)
  + Improve API filtering for domains
  + Try to obtain host names from another address of the same device when there is none for the exact address (may happen, e.g., for IPv6 addresses)
  + Use already existing (but by default disabled) cleaning. The interval is customizable and defaults to MAXDBDAYS.
  + Fix syntax error
  + Remove duplicate function getDatabaseHostname()
  + Add explicit event queue to avoid possible race collisions when many signals arrive at the same time (or very very close to each other)
  + Fix subdirectory include paths. This is only to be explicit, the relative search finds them otherwise as well
  + Signals are not handled asynchroneously. Add additional delays in the tests to avoid them failing due to aksing too early for a result.
  + Add new dhcp-discover command
  + Implement multi-threaded scanning (constant scanning time regardless of the number of interfaces)
  + Increase timout to 10 seconds and ensure logging cannot be interrupted (for readability)
  + Be a bit more specific about binding errors
  + Also send DHCPREQUEST on unconfigured interfaces
  + Use unsigned 32bit variable for the XID everywhere
  + Implement DHCP options 44 and 252 (non-standard WPAD extension). Improve human-readable time formatter.
  + Do not print WPAD path if it is a control squence.
  + Fix GCC9 regression for printing the same buffer into itself in sprintf()
  + Request a lease with validity of 1 second in the DHCPDISCOVER packet
  + Do not try to free NULL pointer in resolveAndAddHostname
  + Show debug messages only in debug mode
  + Do not block shared memory when inactive clients are skipped.
  + Upload FTL log to tricorder.pi-hole.net instead of printing directly into the container output
  + Add more debug logging to getDatabaseHostname()
  + Do not skip recently inactive clients in ARP/neighbor table processing as they may still need properties to be updated (like host names, etc.)
  + Add real-time signal 4 to re-resolve all host names (clients + upstream servers)
  + Add real-time signal 5 to request ARP/neighbor parsing
  + Reset actions after the threads picked up the new real-time signals
  + Handling of clients not in ARP has been moved into add_FTL_clients_to_network_table()
  + Add more verbose version output (./pihole-FTL -vv)
  +  Do not block shared memory when inactive upstreams are skipped. This was missed in #889
  + Rename resolveForwardDestinations() to resolveUpstreams() and make private functions static.
  + Every time FTL allocates more memory, we explicitly log how much (out of how much) space is used in /dev/shm
  + Explicitly warn users if space tends to be running out in /dev/shm
  + Handle SIGBUS, SIGILL and SIGFPE events in our crash reporter. Give human-readable explanations of why this happened where possible.
  + Only use stsvfs data is the function returned no error.
  + Explicitly cast the block counts to unsigned long long to avoid overflowing with drives larger than 4 GB on 32bit systems
  + Reopening the FTL database may lead to rare race-collisions in SQLite3. We avoid them by keeping the database connection open all the time.
  + Open database for history-reading
  + Improve checking boundaries of the shm_per_client_regex shmem object
  + Make realloc_shm message more informative
  + Add more comments to the code
  + Ensure to remap the per-client-regex struct when it is changed in a fork.
  + Use posix_fallocate() instead of ftruncate() when resizing and/or creating shared memory objects. This ensures we reserve the requested memory exclusively for ourselves.
  + Exit immediately if fatal memory errors happen
  + Add new status RETRIED (12) to be used for queries which were retried. If a query was retried five times before it suceeded, queries 1-4 will be marked as RETRIED and only query 5 will stay in status FORWARDED.
  + Use new armv4, armv5, armv6hf, armv7hf containers to build the corresponding binaries
  + Also handle retry events when the retry happened in the small timeframe of when we already have the upstream response but DNSSEC validation is still ongoing
  + Retried DNSSEC queries are ignored, we have to flag themselves. Retried normal queries take over, we have to flat the original query.
  + Move call to resolveNetworkTableNames() from resolver into database thread
  + Make timer output at termination of FTL human readable (days/hours/minutes/seconds).
  + Mark database as being available when creating a new database to avoid FTL skipping adding the tables thinking the database connection isn't ready.
  + Ignore ECS loopback addresses to avoid rewriting the client IP to a (useless because distant) localhost
  + Improve query interface origin determination
  + Add tests for ECS loopback ignoring
  + Upload binaries into writable html-subdirectory and download+verify uploaded binaries in an additional CI step.
  + Add new DEBUG_HELPER option. It logs any helper activity (and possible errors) to pihole-FTL.log
  + CMake install: update setcap to add the CAP_SYS_NICE capability
  + Log information about the user FTL is running as and if we're dropping to another user (such as nobody/nogroup)
  + Include upstream details in all-queries API response
  + Make FTL upstream destination port-aware
  + Rename super-clients ---> alias-clients
  + Catch fatal dnsmasq errors caused by incorrect config lines and print it in pihole-FTL.log
  + Store fatal dnsmasq message in message table so it can be used by the Pi-hole dashboard diagnosis system.
  + Add attribute gnu_printf to the new function FTL_log_dnsmasq_fatal()
  + Define default script path in /opt/pihole/libs and always build READLINE support if static libraries are available on the system
  + Download and install LUA script during test runs
  + Only print history debug messages when in debug mode
  + Update LUA 5.4.0 -> 5.4.1
  + Print hint that readline isn't available only in debug output. Otherwise, this output might leak into script executions when readline support is not compiled into the binary (missing libraries at build time).
  + Add API callback to remove DHCP leases without the need for a restart of the DNS/DHCP server
  + Add API debug messages
  + Skip clients with no active counts at all (may be old IPv6 addresses)
  + Keep upper case characters in host names because they may make them more readable (like FritzBox, WDMyCloud, or VacuumRobot)
  + Clarify that disabling the database only disables storing queries in the database. We still use the database for storing messages (such as regex syntax warnings) and alias-clients.
  + Silence warning about copying a NULL pointer for DHCP clients without a hostname
  + Print hint when database query importing is enabled but exporting is disabled - this may not what the user want.
  + Analyze all DHCP options dnsmasq is aware of
  + Convert numbers from net to host order before displaying them
  + Implement special handling for "pihole-FTL -- --help dhcp" and "pihole-FTL -- --help dhcp6"
  + Remove buster-specific binary test output
  + Downgrade expected glibc version and expect that stretch does not build a v5TE binary explicitly (instead, it does v4T)
  + Use new stretch-based ftl-build:v1.8 containers
  + Fix compatibility with GCC 10.
  + Add -fno-common to HARDENING_FLAGS.
  + Do not warn about query status 12 and 13 on import (retried queries)
  + Catch all real-time signals, decide later which one we handle and which one we ignore.
  + Check for memory allocation erros in parse_FTLconf()
  + Respect settings RESOLVE_IPV4 and RESOLVE_IPv6 also when trying to resolve host names from the database (network table)
  + Do not try to resolve IPs for records without hostnames in the network_addresses table.
  + Add new REFRESH_HOSTNAMES option
  + Use case-insensitive comparison of MAC address to ensure capitilization does not play a role.
  + Tweak code to restore compatibility with Gentoo gcc 10.2.0-r3
  + Always try to resolve hostnames when seeing a client/upstream serer for the first time. Also when it wasn't recently active (may happen on re-import from database history).
  + Add more debugging output and ensure refreshing rules are really only used when refreshing

--------------------------------------------------------------------
Tue Sep 15 07:40:28 UTC 2020 - pihole-suse-packages@smar.fi

- Update to version v5.2
  + Move counters definition from memory.c to shmem.c magically clears a lot of (wrong) VSCode errors. Doing this on request of a user as it is harmless.
  + Import unknown clients from ARP table
  + Explicitly set prepared statements to NULL when they are finalized.
  + Explicitly log if we had to make assumptions because the gravity database was not available.
  + Add DELAY_STARTUP setting to delay startup of the embedded dnsmasq.
  + Remove option FORCE_LOCAL_RESOLVER as we do not need it.
  + Add more comments, only print debugging output when DEBUG_DATABASE is enabled.
  + Simplify SQLite 3 database extension
  + Convert recently found (at most 1 hour old) mock-devices into "real" when we gather ARP/neigh information about them.
  + Fix nameserver list in auth mode.
  + Allow overriding of ubus service name.
  + CircleCI has an unforseeable number of devices in its ARP cache. Do not check for a strict number of clients during the tests. No changes to the source code.
  + Ensure blocking also works when the long-term database is not used. This was broken before as we returned too early (the SQLite3 engine was not yet fully initialized) when the long-term database was disabled.
  + Fix possible memory leak in config.c
  + Some general tweaks
  + Explicitly log failures in creating the new sqlite3 function.
  + Ensure we don't loose memory after ARP cache parsing.
  + Also return NO MATCH when invoking subnet_match() with non-TEXT arguments.
  + Add a comment that gethostbyaddr() may leak memory (only once, not seen leakage of more than 110 bytes)
  + Check arguments are of type SQLITE3_TEXT
  + Initialize resolver subroutines if trying to resolve for the first time
  + Only check/set client status when size of the array is not exceeded. Skip otherwise.
  + Do not import unknown clients from the ARP cache into FTL's memory. It is not our job to care about them if they are not doing any DNS queries.
  + Ensure ARP strings are NULL-terminated
  + Exiting instead of aborting may be benefitial in FTL forks.
  + Print arguments passed to embedded dnsmasq when at least one DEBUG flag is set.
  + Re-open gravity database (and re-prepare database statements) before accessing the database in case FTL forked.
  + Memorize PID of this thread to avoid re-opening the gravity database connection multiple times for the same fork
  + Implement process-private prepared gravity database client statements. This fixes an incompatibility across forks when serving TCP traffic using dedicated workers.
  + Silently increase size of vector if trying to read out-of-bounds
  + Explicitly include type definition of int16_t in config.h as needed by the musl-compiler
  + Remove append and delete instructions as we will always identify clients exactly by their IDs
  + Musl's realloc() does not zero any memory. Do this manually.
  + Free allocated memory after ordinary termination of TCP workers (TCP connection closed)
  + Fix rare problem allocating frec for DNSSEC.
  + Tweak to DNSSEC logging.
  + Restored astrisk match for auditlog
  + Correct, indent and simplify wildcard-compatible auditlog SQL logic.
  + Modify FTL's internal resolver to work in two phases: First, try to obtain a host name by using the internal resolver (i.e., FTL). In a second step, when FTL didn't know the answer, ask the resolvers as configured by resolv.conf. We've seen that the latter is necessary to get proper name resolution in docker environments.
  + Convert port from host to network byte order
  + src/dnsmasq/dnsmasq.c: Labeled a lonely #endif
  + Update dnsmasq version to pi-hole-v2.81
  + Don't try setsockopt of non-existing NETLINK_NO_ENOBUFS option (fixes qemu issue).
  + Revert "Don't try setsockopt of non-existing NETLINK_NO_ENOBUFS option (fixes qemu issue)."
  + Convert failure of setsockopt(..., SOL_NETLINK, NETLINK_NO_ENOBUFS, ...) into warning.
  + Make regex matching case-insensitive by default and remove config option to control this.
  + Automatically block _esni.* subdomains of blocked domains. This can be disabled by setting BLOCK_ESNI=false in pihole-FTL.conf
  + Simplify blocking metadata forcing code.
  + Add full drop-in replacement mode pihole-FTL can use to mimic the dnsmasq binary.
  + Add a shortcut for dnsmasq syntax test
  + Do not decide whether we are blocking or not based on the gravity count (pre-v5.0 measure) but use the dedicated blockingstatus variable.
  + Use /run instead of /var/run for FTL runtime files
  + Deleted Swag store affiliate link
  + Invoking free_sqlite3_stmt_vec() on a NULL pointer should be a harmless no-op.
  + Check for validity of prepared statements before trying to use their get property.
  + Create "message" table and log regex errors in there.
  + Fix bit-order in subnet mask generation.
  + Bump build container version.
  + Use BLOBs as datatype for the custom columns to keep this feature as generic as possible. We can always append more columns to the end of the table whenever needed.
  + Store message type as string instead of enum values.
  + Ensure message table is also flushed on receipt of real-time signals.
  + Always chose most suitable (= maximum) subnet for clients. This allows to configure specific settings for a whole range of devices but still exclude others. Complain softly (no error) if multiple configured subnets match with the same number of relevant bits.
  + Ensure to finalize statement before closing the database connection.
  + Explicitly include limits.h in src/files.c to improve ppc64le support on Alpine. This fixes #751
  + Store subnet warnings in the message table.
  + Add User-Agent to macvendor.py
  + Process cached SRV records
  + Simple optimizations
  + Skip CircleCI Upload step on foreign PRs.
  + Add addr2line output into our self-generated backtraces.
  + Only compile print_addr2line() when we can actually generate backtraces.
  + Add comment
  + Remove unneeded inet_ntop
  + Fix indentation
  + Fix indentation
  + Reload the privacy level when reloading the lists
  + Bump to v1.2 build images.
  + Add NAMES_FROM_NETDB option.
  + Store client group information in shared memory.
  + Add checks for the compiled binary for all supported CI platforms.
  + Don't need to call inet_ntop here
  + Also check result of "file pihole-FTL" to do some further checks on the generated binary. This now includes a check for the minimum supported Linux version.
  + Add cmake build
  + Implement install step to be the same as the Makefile build
  + Default install prefix to /usr
  + Put runtime output, i.e. pihole-FTL, in the root of the build dir
  + Move sqlite3-ext to the database target
  + Fix build of sqlite3. Move sqlite3 defines to the top level so they are on all.
  + Add "not stripped" to arm-qemu test
  + Reduce README.md
  + Fix static build
  + Really, really fix static build
  + Add boolean to be able to store if we decided which groups to be used (an empty string can actually mean no groups as a special case)
  + Fix broken RESOLVE_IPV{4,6} setting.
  + Fix possible memory issue by obtaining pointer only when it is guaranteed that the pointer will not change.
  + Remove Makefile
  + Add license headers to CMake files
  + Use cmake on CI to generate FTL binaries.
  + Lower needed cmake version to 2.8.12
  + Add CI build script.
  + Add a build script for users. FTL can be build by simply running "./build.sh"
  + Use cmake ENV{} to actually aquire the env variables
  + Clarify comment
  + Also check REVOLCE_IPV{4,6} setting when trying to derive a host name from the FTL database.
  + Improve build.sh script. Add "install" and "clean" targets. Also ensure successive builds are possible to speed up the entire process.
  + Allow no/false and yes/true for all config options.
  + Re-aquire client and upstream pointers after a name resolution. As we're leaving the locked area for the resolve, we cannot control if the shared memory object changed meanwhile. If it did, then the pointers will point into nowhere, leading to a SEGV_MAPERR.
  + Set nice value of pihole-FTL (configurable) to increase DNS server performance.
  + Add CAP_SYS_NICE for the tests
  + Ignore missing CAP_SYS_NICE in the CI tests as we are not allowed to change the nicencess.
  + Add warning for invalid hostnames to FTL message table.
  + Only open FTL database for storing a message when there is not already an open connection.
  + Clarify warning that the check found AT LEAST one invalid character.
  + Ensure host name errors do not accumulate.
  + Close database on any erros to ensure nothing stays locked.
  + Do not listen to real-time signals in helper processes
  + Ignore real-time signals outside of the main process (such as in TCP forks)
  + Fix #805. This fixes a buffer overflow when handling TCP requests. Details are on the dnsmasq mailing list.
  + Ensure main process is terminated orderly when a fork fails miserably.
  + Send real-time signal 2 from forks to main process to signal it should terminate with EXIT_FAILURE.
  + Improve logging for forks and thread by including further details to the log ID
  + Include thread names in crash reports to ease debugging.
  + Print at least addresses when the addrline conversion wasn't successful.
  + Bind to socket in thread instead of main process to ensure forks do not inherit sockets they shouldn't.
  + Show fork created/terminated if any debug mode is enabled. Log reason for TCP worker termination (either client disconnected or connection timeout).
  + Remove portfile not used by the current web interface any longer.
  + Add support for additional query types: "A", "AAAA", "ANY", "SRV", "SOA", "PTR", "TXT", "NAPTR", "MX", "DS", "RRSIG", "DNSKEY" and "OTHER" (summing up all other possible DNS types)
  + Tests: Test for new query types
  + Don't use fshort-enums as it may make objects files incompatible.
  + Always re-open gravity database handle when forking
  + Children inherit file descriptors from their parents. As we don't need the API sockets in the forks, we clean them up after forking
  + Thorough clean-up following 8270648da1eae77db381b848a47d79b85c206e29.
  + Be explicit about if we count or query the number of domains. This simplifes the logic and makes it more readable.
  + Do not assume a query to google.com returns only one fixed AAAA record.
  + Remove privacy level 4. Systems currently running level 4 will automatically pick up the highest available level (which is now 3). Also tidy up enums into a dedicated file.
  + Add additional_info column to queries table. We fill it with the domain that caused blocking the entire CNAME chain.
  + Log CNAME blocking to pihole.log
  + Include new column in database schema test
  + Load domain causing the blocking in a CNAME inspection from the database during import. This ensures restarting FTL does not mean we lost this information.
  + Store + import ID of regex used for blocking in additional_info field
  + Fix an edge-case where CNAME blocking can be foiled when parts of the CNAME chain are already in the cache
  + Fix incorrect attribution of the blocked status to the wrong domain. This also simplifies the terminology in the CNAME inspection routine.
  + Revert "Remove portfile not used by the current web interface any longer."
  + Tweak revert commit. We should add the port after configuring it and independtly from opening IPv4 and/or IPv6 sockets. Also, we cannot delete the port in close_telnet_port() as this function is called by TCP workers since v5.1 so we'd loose the port file when the first TCP query comes in.
  + Test: Check port file exists and contains the expected number (4711)
  + Skip second termiantion if there is already a termination event in progress. This has been observed with clients clsoing their connection exactly at the same time when dnsmasq wants to close the connection itself due to a timeout (it thinks this client is stale).
  + Include the information for which client we have forked. Examplary message: "TCP worker forked for client 192.168.0.42 on interface enp0s25 (192.168.0.12)"
  + Double time until TCP worker timeout from 150 seconds to 300 seconds. RFC 1035 says: "If the server needs to close a dormant connection to reclaim resources, it should wait until the connection has been idle for a period on the order of two minutes." We are unlikely to run into a limit here as the total number of allowed TCP workers is fixed as well.
  + Increase limit for concurrently active TCP workers from 20 to 60. We've seen reports where 20 wasn't sufficient in user networks. Given that TCP workers do not really consume all that much more memory, this limit may even be increased further in case we recognize that 60 still isn't sufficient.
  + Use atomic_flag_test_and_set to ensure that FTL_TCP_worker_terminating() cannot run two times even when called exactly at the same time.
  + Wrap gravity reopening in locking to avoid a race collision with API requests (performed from independent threads).
  + Do not loop over known domains in addition to looping over all FTL-DNS-cache entries.
  + Factor out FTL sources into a separate object. This slightly enhances compilation speed.
  + Allow IPv6 addresses ofthe form [::ffff:1.2.3.4] in --dhcp-option.
  + Workaround for reported recvmsg() ignoring MSG_PEEK.
  + Log listening on new interfaces
  + Explicitly mark address port not used
  + Compare address and interface index for allowed interface
  + Cleanup interfaces no longer available
  + Handle listening on duplicate addresses
  + Remove duplicate address family from listener
  + Suppress logging of listen addresses during startup.
  + Apply floor of 60s to TTL of DNSKEY and DS records in cache.
  + Change default lease time for DHCPv6 to one day.
  + Do not try to bind a value when we should actually read one. This glitch was harmless, however, it prevented regex ID from being loaded from the database.
  + Create and use a temporary copy of the domain string during the analysis

-------------------------------------------------------------------
Sun Jan 19 09:12:25 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Remove comments from pihole-FTL.conf

-------------------------------------------------------------------
Sat Jan 18 09:42:22 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Apply ignore-shmem.c-strncpy-error.patch only for Tumbleweed

-------------------------------------------------------------------
Sat Jan 18 09:09:37 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Added patch fix-build-after-y2038-changes-in-glib.patch
  * Modified from upstream to adjust to filename changes.
- Added patch ignore-shmem.c-strncpy-error.patch
  * The code adds null byte, so that is not a problem
- Added patch fix-build-with-libnettle-3.5.patch
  * Modified from upstream to adjust to filename changes.

-------------------------------------------------------------------
Sat Jan 18 08:26:08 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Comment cleanup
- Ignore version.h caused macro-in-comment
- Change to arch specific package

-------------------------------------------------------------------
Mon Jan 13 11:40:12 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Changed pid path to point to real pid in service file

-------------------------------------------------------------------
Mon Jan 13 09:12:52 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Added noreplace to config clauses

-------------------------------------------------------------------
Mon Jan 13 08:06:43 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- AdminLTE reads pihole-FTL.conf using PHP’s ini syntax

-------------------------------------------------------------------
Fri Jan 10 11:58:06 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Added SUSE.readme for real

-------------------------------------------------------------------
Fri Jan 10 09:01:53 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Added creation of /run/pihole via tmpfiles

-------------------------------------------------------------------
Fri Jan 10 08:51:03 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Added undocumented file paths to supplied pihole-FTL.conf

-------------------------------------------------------------------
Wed Jan  8 14:50:49 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Added commented /etc/permissions.d/pihole-ftl to instruct
  user about easy way of setting the permissions.

-------------------------------------------------------------------
Wed Jan  8 13:30:11 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Added default pihole-FTL.conf

-------------------------------------------------------------------
Wed Jan  8 12:03:01 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Patch Makefile to ignore the errors
- Patch Makefile to contain dynamic libs

-------------------------------------------------------------------
Wed Jan  8 11:56:47 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Generate version.h on the fly

-------------------------------------------------------------------
Wed Jan  8 09:31:34 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Correct libnettle dependency

-------------------------------------------------------------------
Wed Jan  8 09:31:20 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Removed comments

-------------------------------------------------------------------
Wed Jan  8 09:07:26 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Added systemd service file

-------------------------------------------------------------------
Wed Jan  8 08:43:00 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- First version to build

-------------------------------------------------------------------
Wed Jan  8 07:36:17 UTC 2020 - Samu Voutilainen <smar@smar.fi>

- Initial version

Places

File pihole-ftl.changes of Package pihole-ftl (Revision 0cba9ac861f98e21bce07a4f2612bd16)

Places