| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
plus firefox3 cookie support. This option requires sqlite3,
though the firefox3 option also enables this functionality.
|
|
ORBit2-2.14.16
- bug fixes
+ fix make check on Mac OS/X
+ The ORBNetID option was not consistent in relation to
ORBIIOPIPName. This fix ensures that ORBIIOPIPName always
takes precedence. (Jules Colding)
ORBit2-2.14.15
- bug fixes
+ fix some leaks (Jules Colding)
+ fix for Mike's recent fixes (Mike Gorse)
+ fix potential make loop (Diego Pettenò)
|
|
|
|
2008.10.07 -- Version 2.1_rc13
* Bundled OpenSSL 0.9.8i with Windows installer.
* Management interface can now listen on a unix
domain socket, for example:
management /tmp/openvpn unix
Also added management-client-user and management-client-group
directives to control which processes are allowed to connect
to the socket.
* Copyright change to OpenVPN Technologies, Inc.
2008.09.23 -- Version 2.1_rc12
* Patched Makefile.am so that the new t_cltsrv-down.sh script becomes
part of the tarball (Matthias Andree).
* Fixed --lladdr bug introduced in 2.1-rc9 where input validation code
was incorrectly expecting the lladdr parameter to be an IP address
when it is actually a MAC address (HoverHell).
2008.09.14 -- Version 2.1_rc11
* Fixed a bug that can cause SSL/TLS negotiations in UDP mode
to fail if UDP packets are dropped.
2008.09.10 -- Version 2.1_rc10
* Added "--server-bridge" (without parameters) to enable
DHCP proxy mode: Configure server mode for ethernet
bridging using a DHCP-proxy, where clients talk to the
OpenVPN server-side DHCP server to receive their IP address
allocation and DNS server addresses.
* Added "--route-gateway dhcp", to enable the extraction
of the gateway address from a DHCP negotiation with the
OpenVPN server-side LAN.
* Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns
on Windows. If the bypass IP address is 0.0.0.0 or 255.255.255.255,
ignore it.
* Warn when ethernet bridging that the IP address of the bridge adapter
is probably not the same address that the LAN adapter was set to
previously.
* When running as a server, warn if the LAN network address is
the all-popular 192.168.[0|1].x, since this condition commonly
leads to subnet conflicts down the road.
* Primarily on the client, check for subnet conflicts between
the local LAN and the VPN subnet.
* Added a 'netmask' parameter to get_default_gateway, to return
the netmask of the adapter containing the default gateway.
Only implemented on Windows so far. Other platforms will
return 255.255.255.0. Currently the netmask information is
only used to warn about subnet conflicts.
* Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO
and USE_SSL flags are enabled (Alon Bar-Lev).
* Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new
--script-security rules. Also adds retrying if the addresses are in
use (Matthias Andree).
* Fixed build issue with ./configure --disable-socks --disable-http.
* Fixed separate compile errors in options.c and ntlm.c that occur
on strict C compilers (such as old versions of gcc) that require
that C variable declarations occur at the start of a {} block,
not in the middle.
* Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which
the new implementation of extract_x509_field_ssl depends on.
* LZO compression buffer overflow errors will now invalidate
the packet rather than trigger a fatal assertion.
* Fixed minor compile issue in ntlm.c (mid-block declaration).
* Added --allow-pull-fqdn option which allows client to pull DNS names
from server (rather than only IP address) for --ifconfig, --route, and
--route-gateway. OpenVPN versions 2.1_rc7 and earlier allowed DNS names
for these options to be pulled and translated to IP addresses by default.
Now --allow-pull-fqdn will be explicitly required on the client to enable
DNS-name-to-IP-address translation of pulled options.
* 2.1_rc8 and earlier did implicit shell expansion on script
arguments since all scripts were called by system().
The security hardening changes made to 2.1_rc9 no longer
use system(), but rather use the safer execve or CreateProcess
system calls. The security hardening also introduced a
backward incompatibility with 2.1_rc8 and earlier in that
script parameters were no longer shell-expanded, so
for example:
client-connect "docc CLIENT-CONNECT"
would fail to work because execve would try to execute
a script called "docc CLIENT-CONNECT" instead of "docc"
with "CLIENT-CONNECT" as the first argument.
This patch fixes the issue, bringing the script argument
semantics back to pre 2.1_rc9 behavior in order to preserve
backward compatibility while still using execve or CreateProcess
to execute the script/executable.
* Modified ip_or_dns_addr_safe, which validates pulled DNS names,
to more closely conform to RFC 3696:
(1) DNS name length must not exceed 255 characters
(2) DNS name characters must be limited to alphanumeric,
dash ('-'), and dot ('.')
* Fixed bug in intra-session TLS key rollover that was introduced with
deferred authentication features in 2.1_rc8.
008.07.31 -- Version 2.1_rc9
* Security Fix -- affects non-Windows OpenVPN clients running
OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT
vulnerable nor are any versions of the OpenVPN server vulnerable).
An OpenVPN client connecting to a malicious or compromised
server could potentially receive an "lladdr" or "iproute" configuration
directive from the server which could cause arbitrary code execution on
the client. A successful attack requires that (a) the client has agreed
to allow the server to push configuration directives to it by including
"pull" or the macro "client" in its configuration file, (b) the client
succesfully authenticates the server, (c) the server is malicious or has
been compromised and is under the control of the attacker, and (d) the
client is running a non-Windows OS. Credit: David Wagner.
* Miscellaneous defensive programming changes to multiple
areas of the code. In particular, use of the system() call
for calling executables such as ifconfig, route, and
user-defined scripts has been completely revamped in favor
of execve() on unix and CreateProcess() on Windows.
* In Windows build, package a statically linked openssl.exe to work around
observed instabilities in the dynamic build since the migration to
OpenSSL 0.9.8h.
2008.06.11 -- Version 2.1_rc8
* Added client authentication and packet filtering capability
to management interface. In addition, allow OpenVPN plugins
to take advantage of deferred authentication and packet
filtering capability.
* Added support for client-side connection profiles.
* Fixed unbounded memory growth bug in environmental variable
code that could have caused long-running OpenVPN sessions
with many TLS renegotiations to incrementally
increase memory usage over time.
* Windows release now packages openssl-0.9.8h.
* Build system changes -- allow building on Windows using
autoconf/automake scripts (Alon Bar-Lev).
* Changes to Windows build system to make it easier to do
partial builds, with a reduced set of prerequisites,
where only a subset of OpenVPN installer
components are built. See ./domake-win comments.
* Cleanup IP address for persistence interfaces for tap and also
using ifconfig, gentoo#209055 (Alon Bar-Lev).
* Fall back to old version of extract_x509_field for OpenSSL 0.9.6.
* Clarified tcp-queue-limit man page entry (Matti Linnanvuori).
* Added new OpenVPN icon and installer graphic.
* Minor pkitool changes.
* Added --pkcs11-id-management option, which will cause OpenVPN to
query the management interface via the new NEED-STR asynchronous
notification query to get additional PKCS#11 options (Alon Bar-Lev).
* Added NEED-STR management interface asynchronous query and
"needstr" management interface command to respond to the query
(Alon Bar-Lev).
* Added Dragonfly BSD support (Francis-Gudin).
* Quote device names before passing to up/down script (Josh Cepek).
* Bracketed struct openvpn_pktinfo with #pragma pack(1) to
prevent structure padding from causing an incorrect length
to be returned by sizeof (struct openvpn_pktinfo) on 64-bit
platforms.
* On systems that support res_init, always call it
before calling gethostbyname to ensure that
resolver configuration state is current.
* Added NTLMv2 proxy support (Miroslav Zajic).
* Fixed an issue in extract_x509_field_ssl where the extraction
would fail on the first field of the subject name, such as
the common name in: /CN=foo/emailAddress=
foo@bar.comThis e-mail address is being protected from spambots. You need
JavaScript enabled to view it
* Made "Linux ip addr del failed" error nonfatal.
* Amplified --client-cert-not-required warning.
* Added #pragma pack to proto.h.
|
|
* Don't split large commands into multiple commands; just fail on them.
This prevents cross-site request forgery (CSRF)-like attacks,
when a web browser is used to access an ftp server.
* Enhance -C to support an optional @host ('-C user[@host]'):
checks whether user as connecting from host would be granted
access by ftpusers(5).
* Support IPv6 in the host directive of ftpusers(5).
* Implement -n to disable hostname lookups.
* Disable SOCKS support; I don't have the ability to test it,
and the autoconf checks were very out of date.
* Add configure --with-pam to enable PAM authentication support.
Defaults to checking for PAM.
* Add configure --with-skey to enable S/Key authentication support.
Incompatible with --with-pam, defaults to no.
* Fix pathnames in the installed manual pages to contain
the appropriate $(prefix) substitution.
* Use fcntl(3) locking instead of flock(3) or lockf(3).
* Various other portability improvements.
|
|
|
|
stricter filtering to defeat some additional DNS attacks and support for
source address randomisation and optional capitalisation support. The
former can be configured when multiple public IPs are present, the
latter is considered experimental as a small number of servers doesn't
support it.
|
|
|
|
|
|
|
|
|
|
Change FTP backend to use passive mode by default and fallback to active
mode on syntax errors as discussed with and suggested by Luke Mewburn.
Retire 'p' now and introduce 'a' flag to get the old default behavior.
|
|
possible to trigger due to early EOF or timeouts.
|
|
Add a stab at Solaris-i386 support (should fetch and install, but
PLIST.solaris-i386 is untested).
|
|
Fix line buffering to not drop content after the line we are interested
in. This magically worked for a local tnftpd that was only sending a
normal one line return message due to the challenge response protocol
always having the desired size. With the patch fetch_read will process
the remaining part of the buffer and fetch_getln will remember how much
of the data it was actually interested in, so it will now process the
complete output again.
|
|
|
|
This release fixes the metacafe.com support and mitigates the UTF-8
filename problem in the majority of cases.
|
|
|
|
- only include openssl if the openssl option is present
- include arpa/inet.h to get ntohl and friends on older platforms like
Interix
- use new netdb.h compat code from libnbcompat
- include inttypes.h only when present
- don't name local variables err, Interix has a symbol like that in
default namespace
- allow fetch_read to do short read and do more intelligent buffering
for header processing; effectively don't do a system call for each
byte read
|
|
|
|
Fix for http://bugs.proftpd.org/show_bug.cgi?id=3115
|
|
|
|
|
|
|
|
DESTDIR support
|
|
|
|
support.
|
|
reported in PR 39667.
|
|
|
|
|
|
|
|
|
|
|
|
source.
|
|
Version 1.2.2.
-msdl
- 8th release
- http redirect support
- added MPlayer/xine-lib copyright infos in each file
Version 1.2.1.
-msdl
- 7th release
- fixed fatal bug on mmst
- some change on wmserver/real
|
|
|
|
|
|
Ekiga (formely known as GnomeMeeting) is an open source VoIP and video
conferencing application for GNOME. Ekiga uses both the H.323 and SIP
protocols. It supports many audio and video codecs, and is interoperable
with other SIP compliant software and also with Microsoft NetMeeting.
|
|
|
|
v2.0.5
- Apply fix for O_NONBLOCK vs. XFS DMAPI filesystem. Thanks to Sudha Srinivasan
<sudhas@sgi.com>.
- Fix build warnings exposed by my upgrade to Fedora Core 5 / GCC4.1.1.
- Be more honest in FEAT response if PORT or PASV are disabled! Reported by
Charles Honton <chas@honton.org>. Allows MS Explorer to get the transfer mode
correct.
- pam_pwdb.so -> pam_unix.so in example PAM file. Thanks to
Rhodes, Colin <colin.rhodes@airways.co.nz>.
- Add FAQ issue regarding "chroot fails with SSL" - in fact, sshd is being hit
here instead ;-)
- Minor man page doc tweaks.
- Tiny bit of paranoia in privops.c.
- Revert change to reject anonymous logins before asking for password. This
fixes complaints about IE not showing the FTP login dialog.
- Change SSL certificate load to cater for chaining too.
- Added delay_failed_login and delay_successful_login to help limit resources
taken by brute force attacks.
- Kick session after a few login fails. Allows IP blocking solutions to be more
immediately effective.
- Replace setenv() with more portable putenv(). First part of Solaris fix.
- Replace tm_gmtoff usage with timezone and daylight. Second part of Solaris
fix.
- Set PAM items TTY and RUSER if possible.
- OpenBSD build warning fixes.
- So, timezone and daylight are not available on BSD, so redo the whole TZ
thing again. Should use only very portable constructs now.
v2.0.6
- Fix delay_failed_login typo. Oops.
- Patch the getcwd and readlink sysutil helpers to reflect that they wouldn't
like a 0-sized buf. No caller is affected. Thanks Ilja van Sprundel
<ilja@suresec.org>.
- Allow a (fake) reauth as the same user as the logged in user. Should resolve
.NET related report from Sabo Jim <Jim.Sabo@thomson.net>.
- Tweak from Lucian Adrian Grijincu <lucian.grijincu@gmail.com> to take
unnecessary port calculations out of a loop.
- Fix byte I/O accounting in the error path of do_file_send_rwloop, thanks to
<echen@siac.com>.
- Don't log FireFox's attempts to RETR directories! Reported by
Nixdorf, Tim <tnixdorf@dnps.com>.
- Fix STOU sending the same 150 status line twice - oops! Reported by
<yamazaki@iij.ad.jp>.
- Fix xferlog format for virtual (guest) users, reported by Andy Fletcher
<andy@withnail.org>.
- Fix bug with empty user list file and userlist_deny=NO. Reported by
Marcin Zawadzki/GlobalVanet.com <marcin.zawadzki@globalvanet.com>.
- Pretend we have proper UTF8 support and respond positively to OPTS UTF8 ON.
Thanks Stanislav Maslovski <stanislav.maslovski@gmail.com>.
- Add control over the file permissions used in the chown()ing of anonymous
uploads: chown_upload_mode (default 0600 as before). Suggestion from
An Pham <apham@medforcetech.com>.
- Do a retry getting the active ftp socket in vsf_privop_get_ftp_port_sock();
should help buggy Solaris systems. Reported by Michael Masterson
<mjmasterson@xo.com>.
- Add debug_ssl option to dump out some SSL connection details.
- Use code 522, not 521, to indicate that the server requires an encrypted
data connection. Still does not seem to coax lftp to retry :(
- Recognize OPTS pre-login.
- A whole ton of SSL improvements, including ability to force requirement of
a client cert; data and control channel client cert cross checking. Ability
to require fully valid / authentic client certs. No cert-based auth yet.
- Change my e-mail to my GMail account.
v2.0.7
- Fix finding libcap for the link on Slackware systems, thanks to Roman
Kravchenko <roman@atech.lv>.
- Fix build on Solaris 2.8 due to non-standard C, thanks to IIDA Yosiaki
<y-iida@secom.co.jp>.
- Fix man page typo, thanks Matt Selsky <selsky@columbia.edu>.
- Bring the PASV listen() into the bind() retry loop to resolve a race under
extreme load. Thanks to Curtis Taylor <cjt@us.ibm.com>.
- Enhance logging for debug_ssl.
- Shutdown the SSL data connections properly. This prevents clients such as
recent FileZilla from complaining. Reported by various people.
- Add option to enforce proper SSL shutdown on uploads. Left it off after much
agonizing because clients are so broken in this area.
- Add option to delete failed uploads.
|
|
|
|
|
|
1.2.9 binding to an adapter did not work, 'SIGPIPE' was not handled correctly
1.2.8 fixed a segfault introduced in version 1.2.7
1.2.7 http statuscodes are now correctly interpreted (if selected)
1.2.6 Can now split measured latency in time to connect and time to exchange a request with the HTTP server
|
|
REPLACE_PYTHON.
|
|
|
|
NetBSD/current.
|
|
|
|
wireless network models, and bug fixes.
Changes since 2.31:
Wireless shadowing bug fix; originally reported by Marcello Caleffi;
suggestion from Nicola Baldo applied
AODV bug fix from Marco Fiore
Add dynamic libraries patch from SIGNET group, University of Padova
Add 80211Ext models from Mercedes-Benz/Karlsruhe team
Add Ilango Purushothaman's 802.11 infrastructure mode support.
Add ns-2 TCP Linux patch and calendar scheduler improvements.
Enable Tk for ns-2.
Several changes to SCTP module, contributed by Nasif Ekiz and Protocol
Engineering Lab at the University of Delaware
|
|
|
|
Changes since 3.0.3:
BUG FIXES:
- Fixed a bug in the hard-linking code where it would sometimes try to
allocate 0 bytes of memory (which fails on some OSes, such as AIX).
- Fixed the hard-linking of files from a device that has a device number
of 0 (which seems to be a common device number on NetBSD).
- Fixed the handling of a --partial-dir that cannot be created. This
particularly impacts the --delay-updates option (since the files cannot
be delayed without a partial-dir), and was potentially destructive if
the --remove-source-files was also specified.
- Fixed a couple issues in the --fake-super handling of xattrs when the
destination files have root-level attributes (e.g. selinux values) that
a non-root copy can't affect.
- Improved the keep-alive check in the generator to fire consistently in
incremental-recursion mode when --timeout is enabled.
- The --iconv option now converts the content of a symlink too, instead
of leaving it in the wrong character-set (requires 3.0.4 on both sides
of the transfer).
- When using --iconv, if a filename fails to convert on the receiving side,
this no longer makes deletions in the root-dir of the transfer fail
silently (the user now gets a warning about deletions being disabled
due to IO error as long as --ignore-errors was not specified).
- When using --iconv, if a server-side receiver can't convert a filename,
the error message sent back to the client no longer mangles the name
with the wrong charset conversion.
- Fixed a potential alignment issue in the IRIX ACL code when allocating
the initial "struct acl" object. Also, cast mallocs to avoid warnings.
- Changed some errors that were going to stdout to go to stderr.
- Made human_num() and human_dnum() able to output a negative number
(rather than outputting a cryptic string of punctuation).
ENHANCEMENTS:
- Rsync will avoid sending an -e option to the server if an older protocol
is requested (and thus the option would not be useful). This lets the
user specify the --protocol=29 option to access an overly-restrictive
server that is rejecting the protocol-30 use of -e to the server.
- Improved the message output for an RERR_PARTIAL exit.
DEVELOPER RELATED:
- The Makefile will not halt for just a timestamp change on the Makefile
or the configure files, only for actual changes in content.
- Changed some commands in the testsuite's xattrs.test that called "rsync"
instead of "$RSYNC".
- Enhanced the release scripts to be able to handle a branch release and
to do even more consistency checks on the files.
|
