Posted by doener 12/3/2025
https://kb.isc.org/docs/cve-2025-40779
"CVE-2025-40779: Kea crash upon interaction between specific client options and subnet selection"
https://github.com/isc-projects/kea/commit/0afd42b5dfb2e547b...
unprotected null pointer use, kea is in C++
I was really impressed. I think the folks who put it together did a good job of addressing the major warts of my experience with isc-dhcp-server.
I'm sure it's a tremendous challenge writing software that's supposed to live up to modern expectations while still attempting to deliver on all of the legacy dependents and their unique use cases.
Makes me think of that article on how Cloudflare wrote their own Golang DNS Server and like some 900 whopping people use LOC records but they still support it
DHCP and DNS go hand in hand in a network, I really struggle to understand why they are not more integrated in otherwise great solutions (such as kea)
Works great. Minimal fuss, efficient setup, little maintenance, I don't have to understand the guts. Everything on my local network is addressable.
Ad blocking at the router is also something you don't want live without once you've gone there but pi-hole is a great solution even if you don't want that.
What worries me with dnsmasq is that it is a personal project maintained on a personal git (by a great person!). Sure, one can fork and whatnot but without several people participating it can fade out pretty quickly.
This: https://docs.pi-hole.net/guides/dns/unbound/ was stupidly simple, pi-hole has a gui that I was already used to and it all works great. So I think about and study other things that need fixing/improving in my life instead.
To flip it, why would I use unbound without pi-hole? What's the win I haven't seen (or even looked at or considered?)
In my experience, the fewer moving parts the better.
I run Unbound on my OPNsense router, and it uses the same blocklists as Pi-hole and the stats page (blocked domains, DNS requests, etc) are the same afaict.
I did pi-hole first, then much later decided to use unbound for dns because it looked super easy to add it. It was. Haven't thought about it much since. I hope your experience was as good or better.
An overlay like Tailscale MagicDNS might solve this but is complex.
Assigning the same name to 2 IP's (round robin DNS) will mean having to retry the ssh connection if the IP of the inactive interface is returned.
Failover bonding (mode 1) of the wireless and wired interfaces with MAC address spoofing so that the bonded interface maintains a consistent MAC address is reportedly not always supported by WiFi hardware and standards. Bonding may require manual reconfiguration when the laptop moves from the local network where "shortname" is used to an arbitrary WiFi network like airport or coffee shop.
Are there any solutions that satisfy single IP and reliable WiFi at the same time?
Linux used to be able to move the same IP between 2 interfaces depending on which was active. But it looks like advancements in Linux networking have killed this simple solution.
dnsmasq is awesome if you want a one-stop shop for DHCP and DNS for sure.
I can't comment on the DNS integration, but I might look a bit deeper because it sounds useful.
Not sure this counts as a fork or when it was “reworked” by OpenBSD, though.
I understand Kea has more features so I'm a little curious what I'm missing.
Which one is better to use with OPNsense?
Comments are less positive than here on HN.
How fancy does a network needs to be before this starts making sense? Who are the target audience for this project?
The main need I had was for a bank. Network functionality is obviously highly important there. Windows updates impacted the dhcp service on one server, which wasn’t an obvious thing till leases started running out the following morning. Multiple DC’s, so set up for HA to avoid issues in the future. It’s almost never needed but great to have when total uptime is key to operations.
Private + Shared = RAM used Program
476.0 KiB + 24.5 KiB = 500.5 KiB dnsmasq