This is a ground-up rewrite of Perspective Broker, which itself is Twisted's
native RPC/RMI protocol (Remote Procedure Call / Remote Method Invocation).
If you have control of both ends of the wire, and are thus not constrained to
use some other protocol like HTTP/XMLRPC/CORBA/etc, you might consider using
Foolscap.
Fundamentally, Foolscap allows you to make a python object in one process
available to code in other processes, which means you can invoke its methods
remotely. This includes a data serialization layer to convey the object
graphs for the arguments and the eventual response, and an object reference
system to keep track of which objects you are connecting to. It uses a
capability-based security model, such that once you create a non-public
object, it is only accessible to clients to whom you've given the
(unguessable) FURL. You can of course publish world-visible objects that
have well-known FURLs.
* Partially rewritten ntop processing engine to address reliability and
performance
* Several bugs and stability issues fixed
* Added better support for IPFIX and NetFlow v9, as well as ntop PEN
(Private Enterprise Number)
* Added support for Cisco ASA firewalls
* Added ntop engine scriptability via the python programming language
* Added RRDalarm plugin for generating alerts based on thresholds
* Improved google maps integration
* Enhanced sFlow support
Some of the highlights are:
o [NSE] Added more scripts, bringing the total to 131!
o Performed a major OS detection integration run.
o Performed a large version detection integration run.
o [Zenmap] Added the ability to print Nmap output to a printer.
o [Nmap, Ncat, Nping] The default unit for time specifications is now
seconds, not milliseconds, and times may have a decimal point.
o Ports are now considered open during a SYN scan if a SYN packet
(without the ACK flag) is received in response.
o [Ncat] In listen mode, the --exec and --sh-exec options now accept a
single connection and then exit, just like in normal listen mode.
o UDP payloads are now stored in an external data file, nmap-payloads,
instead of being hard-coded in the executable.
o Added a new library, libnetutil, which contains about 2,700 lines of
networking related code which is now shared between Nmap and Nping
o Improved service detection match lines.
o Improved our brute force password guessing list by mixing in some
data sent in by Solar Designer of John the Ripper fame.
o [Zenmap] IP addresses are now sorted by octet rather than their
string representation.
o [Ncat] When receiving a connection/datagram in listen mode, Ncat now
prints the connecting source port along with the IP address.
o Added EPROTO to the list of known error codes in service scan.
o Updated IANA IP address space assignment list for random IP (-iR)
generation.
o Zenmap's "slow comprehensive scan profile" has been modified to use
the best 7-probe host discovery combination we were able to find in
extensive empirical testing
o Zenmap now lets you save scan results in normal Nmap text output
format or (as before) as XML.
o [NSE] Raw packet sending at the IP layer is now supported, in
addition to the existing Ethernet sending functionality.
o Nmap now honors routing table entries that override interface
addresses and netmasks.
o [Ncat] The HTTP proxy server now accepts client connections over
SSL, and added support for HTTP digest authentication of proxies, as
both client and server.
o Improved the MIT Kerberos version detection signatures.
Plus many bugfixes and improvements.
For full changelog, see http://nmap.org/changelog.html
Feature improvements
* Add radmin command "stats detail <file>" to see what
is going on inside of a detail file reader.
* Added documentation for CoA. See raddb/sites-available/coa
* Add sub-option support for Option 82. See dictionary.dhcp
* Add "server" field to default SQL NAS table, and documented it.
Bug fixes
* Reset "received ping" counter for Status-Server checks. In some
corner cases it was not getting reset.
* Handle large VMPS attributes.
* Count accounting responses from a home server in SNMP / statistics
code.
* Set EAP-Session-Resumed = Yes, not "No" when session is resumed.
* radmin packet counter statistics are now unsigned, for numbers
2^31..2^32. After that they roll over to zero.
* Be more careful about expanding data in PAP and MS-CHAP modules.
This prevents login failures when passwords contain '{'.
* Clean up zombie children if there were many "exec" modules being
run for one packet, all with "wait = no".
* re-open log file after HUP.
* Fix "no response to proxied packet" complaint for Coa / Disconnect
packets. It shouldn't ignore replies to packets it sent.
* Calculate IPv6 netmasks correctly.
* Fix SQL module to re-open sockets if they unexpectedly close.
* Track scope for IPv6 addresses. This lets us use link-local
addresses properly.
* Updated Makefiles to no longer use the shell for recursing into
subdirs. "make -j 2" should now work.
* Updated raddb/sql/mysql/ippool.conf to use "= NULL".
* Updated Makefiles so that "make reconfig" no longer uses the shell
for recursing into subdirs, and re-builds all "configure" files.
* Used above method to regenerate all configure scripts.
* Updated SQL module to allow "server" field of "nas" table
to be blank: "". This means the same as it being NULL.
* Fixed regex realm example. Create Realm attribute with value
of realm from User-Name, not from regex.
* If processing a DHCP Discover returns "fail / reject", ignore
the packet rather than sending a NAK.
* Allow '%' to be escaped in sqlcounter module.
* Fix typo internal hash table.
* For PEAP and TTLS, the tunneled reply is added to the reply,
rather than integrated via the operators. This allows multiple
VSAs to be added, where they would previously be discarded.
* Make request number unsigned. This changes nothing other than
the debug output when the server receives more than 2^31 packets.
* Don't block when reading child output in 'exec wait'. This means
that blocked children get killed, instead of blocking the server.
* Enabled building without any proxy functionality
* radclient now prefers IPv4, to match the default server config.
* Print useful error when a realm regex is invalid
* relaxed rules for preprocess module "with_cisco_vsa_hack". The
attributes can now be integer, ipaddr, etc. (i.e. non-string)
* Allow rlm_ldap to build if ldap_set_rebind_proc() has only
2 arguments.
* Update configure script for rlm_python to avoid dynamic linking
problems on some platforms.
* Do suid to "user" when running in debug mode as root
* Make "allow_core_dumps" work in more situations.
* In detail file reader, treat bad records as EOF.
This allows it to continue working when the disk is full.
* Fix Oracle default accounting queries to work when there are no
gigawords attributes. Other databases already had the fix.
* Fix rlm_sql to show when it opens and closes sockets. It already
says when it cannot connect, so it should say when it can connect.
* "chmod -x" for a few C source files.
* Pull update spec files, etc. from RedHat into the redhat/ directory.
* Allow spaces when parsing integer values. This helps people who
put "too much" into an SQL value field.
snmpd:
- Change default AgentX target from 0.0.0.0:705 to localhost:705
- Fix CVE-2008-4309 (GETBULK issue reported by Oscar Mira-Sanchez)
- Fix handling of multiple matching VACM entries
(Use the "best" match, rather than the first one).
Note that this could potentially affect the behaviour of
existing access control configurations.
- Latch large-disk statistics at 2Tb (rather than wrapping)
Linux:
- Fix build on modern distributions (using rpm-4.6)
Windows:
- Fix various builds (recent MSVC, MinGW, IPv6, winExtDLL)
Changes in 2.1.3
================
* FIX: afpd: fix a serious error in networking IO code
* FIX: afpd: Solaris 10 compatibilty fix: don't use SO_SNDTIMEO, use
non-blocking IO and select instead for writing/sending data.
* UPD: Support for BerkeleyDB 5.0.
Changes in 2.1.2
================
* FIX: afpd: fix for possible crash in case more then one server is
configured in afpd.conf.
* FIX: afpd: ExtendedAttributes in FreeBSD
* FIX: afpd: sharing home folders corrupted the per volume umask.
* UPD: afpd: umask for home folders is no longer taken from startup umask.
* UPD: afpd: dont and permissions with parent folder when creating new
directories on "upriv" volumes.
* UPD: afpd: use 'afpserver@fqdn' instead of 'afpserver/fqdn@realm'.
Prevents a crash in older GNU GSSAPI libs on eg. CentOS 5.x.
Changes in 2.1.1
================
* UPD: fallback to a temporary in memory tdb CNID database if the volume
database can't be opened now works with the default backend "dbd" too.
* FIX: afpd: afp_ldap.conf was missing from tarball. This only effected
[Open]Solaris.
* FIX: afpd: Check if options->server is set in set_signature, preventing
SIGSEGV.
* FIX: afpd: server signature wasn't initialized in some cases
* FIX: DESTDIR support: DESTDIR was expanded twice
* FIX: Fix for compilation error if header files of an older Netatalk
version are installed.
Changes in 2.1-release
======================
* NEW: afpd: new volume option "volsizelimit" for limitting reported volume
size. Useful for limitting TM backup size.
* UPD: dbd: -c option for rebuilding volumes which prevents the creation
of .AppleDouble stuff, only removes orphaned files.
Changes in 2.1-beta2
====================
* NEW: afpd: static generated AFP signature stored in afp_signature.conf,
cf man 5 afp_signature.conf
* NEW: afpd: clustering support: new per volume option "cnidserver".
* UPD: afpd: set volume defaults options "upriv" and "usedots" in the
volume config file AppleVolumes.default. This will only affect
new installations, but not upgrades.
* FIX: afpd: prevent security attack guessing valid server accounts. afpd
now returns error -5023 for unknown users, as does AppleFileServer.
Changes in 2.1-beta1
====================
* NEW: afpd: AFP 3.2 support
* NEW: afpd: Extended Attributes support using native attributes or
using files inside .AppleDouble directories.
* NEW: afpd: ACL support with ZFS
* NEW: cnid_metad: options -l and -f to configure logging
* NEW: IPv6 support
* NEW: AppleDouble compatible UNIX files utility suite `ad ...`.
With 2.1 only `ad ls`.
* NEW: CNID database maintanance utility dbd
* NEW: support BerkeleyDB upgrade. Starting with the next release
after 2.1 in case of BerkeleyDB library updates, Netatalk
will be able to upgrade the CNID databases.
* NEW: afpd: store and read CNIDs to/from AppleDouble files by default.
This is used as a cache and as a backup in case the database
is deleted or corrupted. It can be disabled with a new volume
option "nocnidcache".
* NEW: afpd: sending SIGINT to a child afpd process enables debug logging
to /tmp/afpd.PID.XXXXXX.
* NEW: configure args to download and install a "private" Webmin instance
including only basic Webmin modules plus our netatalk.wbm.
* NEW: fallback to a temporary in memory tdb CNID database if the volume
database can't be opened.
* NEW: support for Unicode characters in the range above U+010000 using
internal surrogate pairs
* NEW: apple_dump: utility to dump AppleSingle and AppleDouble files
* NEW: afpldaptest: utility to check afp_ldap.conf.
* UPD: atalkd and papd are now disabled by default. AppleTalk is legacy.
* UPD: slp advertisement is now disabled by default. server option -slp
SRVLOC is legacy.
* UPD: cdb/dbd CNID backend requires BerkeleyDB >= 4.6
* UPD: afpd: default CNID backend is "dbd"
* UPD: afpd: try to install PAM config that pulls in system|common auth
* UPD: afpd: symlink handling: never followed server side, client resolves
them, so it's safe to use them now.
* UPD: afpd: Comment out all extension->type/creator mappings in
AppleVolumes.system. They're unmaintained, possibly wrong and
do not fit for OS X.
* FIX: rewritten logger
* FIX: afpd: UNIX permissions handling
* FIX: cnid_dbd: always use BerkeleyDB transactions
* FIX: initscripts installation now correctly uses autoconf paths,
ie they're installed to --sysconfdir.
* FIX: UTF-8 volume name length
* FIX: atalkd: workaround for broken Linux 2.6 AT kernel module:
Linux 2.6 sends broadcast queries to the first available socket
which is in our case the last configured one. atalkd now tries to
find the right one.
Note: now a misconfigured or plugged router can broadcast a wrong route !
* REM: afpd: removed CNID backends "db3", "hash" and "mtab"
* REM: cnid_maint: use dbd
* REM: cleanappledouble.pl: use dbd
* REM: nu: use `macusers` instead
S3cmd lets you copy files from/to Amazon S3 (Simple Storage Service) using a
simple to use command line client. Supports rsync-like backup, GPG encryption,
and more. Also supports management of Amazon's CloudFront content delivery
network.
* added dnssec support.
* new setting cmd:stifle-rl-history to limit command history size.
* fixed exit code of mget/mput.
* fixed compilation on some systems.
* fixed crash of `cls -s' on MacOS X x64.
* torrent: don't try to connect back to peers which connected to us.
* rancid: remove sequences from IPv6 prefix-lists
* clogin: adjust default ssh password prompt for ExtremeOS 12.3.3.6
* rancid: Accept '>' prompt, rather than just '#'
* avologin: fix ssh command substitution
* fnrancid: filter application signature, System Time & conf_file_ver=
from GetSystem/GetConf
* mrvrancid: filter other oscillating info from show version
* xrrancid: disable timestamps
* hlogin: implement -autoenable for newer hp procurve releases
* cat5rancid: snmp community may have multiple spaces b/t community name
and permissions
* cat5rancid: filter local user password
* f5rancid: filter Failover time stamps
* hlogin: Add support for ssh identity file & passphrase for newer boxes
* rancid: split IOS-XR into its own device type: cisco-xr
* clogin: set term width for catos like for ios.
* rancid: parse admin show diag for XR better with a separate function
* hlogin: hpuifilter got omitted from the ssh spawn; replace it.
* nxrancid: match unknown command errors appropriately & GC some junk
carried-over from IOS-rancid.
* rancid: check for device busy when opening flash fails, which seems to
occur on 6500s when some other command is run.
* *login: support :port method syntax for ssh and adjust to allow spaces
in sshcmd
* jrancid: fix return values of formatting functions
* clogin: set terminal width so that o/p is consistent
* rancid: filter some crud resulting from the change in handling non-empty
comment lines. fail if the configuration buffer fills. filter
dhcp_[^[:space:].].txt from flash directories, so it does not create
constant changes resulting from the ip dhcp database saves. filter ldap host
password on PIX. when compressing consecutive comment lines, only consider
empty lines.
* arancid: handle password filter for HP 1:10Gb Ethernet Blade Switch
5.0.4-Base, running AOS
* *login: add cloginrc timeout directive
* nrancid: fix control number match
* rancid: remove ASA coredump* filter - Cisco Bug CSCsz85597, fixed in
8.2(1.2), 8.3(0.0), 100.3(0.3)M
* f5rancid: adjust fan rpm and config sync time filters for new f5 code
* rancid: ACE/SANOS report invalid input differently. skip leading blank lines
in config.remove ASA keys such as tacacs and radius. match non-space for
usernames in "Written by" line.
* *rancid: quote meta characters
* rancid: Fail on error msg "% Configuration buffer full" seen on 6500. Dont
filter 'show vlan' on Catalyst 3550/4500s
* import Arista script
* jerancid: fix for 'show environment all' for filtering with auto-sync
on BRASes
* francid,flogin: edgeiron can not disable the pager and does not offer
some commands found on the bigirons
* rancid: filter coredumpinfo/coredump.cfg found on ASA - rancid-discuss@
* f5rancid: fileter HA peer status
* WTI scripts from Geert Jan de Groot with a few tweaks
* jerancid: include standby slots in showversion o/p
* lg: add code for LG_SINGLE config knob
* clogin: run_commands() needs do_saveconfig
* f10rancid: change fan status parsing to handle c300
* nxrancid: collect license info; fix 'show env temp' & 'show
env power' parsing; drop unused code.
* change zero-config check to avoid broken awks
Upstream changes:
0.99 July 13 2010
- Add customizable check_for_spawn and min_child_ttl settings in PreFork (Graham Barr)
- Add other_child_died_hook (Daniel Kahn Gillmor)
- Make Multiplex do $mux->add($sock) for UDP sockets (Kristoffer Møllerhøj)
- Change Net::Server::Daemonize to use kill 0 rather than the unportable `ps`
- Fix calling conventions of MultiType
- Avoid select in SSLEAY that was allowing for infinite spin loop
- Fix tie_stdout mode to not warn about unopen handles.
- Added Net::Server::HTTP base class for basic HTTP daemon handling.
- Change examples/httpd to use Net::Server::HTTP
0.98 May 05 2010
- Add SSLeay proto - finally a workable SSL solution.
- Add minimal Net::Server::TiedHandle to allow for STDIN and STDOUT to work with SSLEAY
- Net::Server::TiedHandle also support tied_stdin_callback and tied_stdout_callback
Feb 08 2008
- Allow for port => 0 which lets the OS auto assign a port on some OSes (Blackie Hlasek)
- Add idle_loop_hook to PreForkSimple and PreFork (David Zuhn)
- Add consistent formatting capabilities to the log method (whethere Syslog is used or not) (David Zuhn)
- Warn when default listen value is used - try to make it a sensible default (Mark Martinec)
- Allow for non-zero exit value - particularly when called from fatal (David Schweikert)
--- 9.7.1-P2 released ---
2931. [security] Temporarily and partially disable change 2864
because it would cause inifinite attempts of RRSIG
queries. This is an urgent care fix; we'll
revisit the issue and complete the fix later.
[RT #21710]
--- 9.7.1-P1 released ---
2926. [rollback] Temporarially rollback change 2748. [RT #21594]
2925. [bug] Named failed to accept uncachable negative responses
from insecure zones. [RT# 21555]
Based on PR#43610 by Wen Heping.
While here, convert tclsh related matters to use pkgsrc frameworks.
--- 4.0.11 2010/07/09
CCL fixes: bug 2895 and bug 3539.
GR1-display: add comma in display - was removed by mistake in
version 4.0.0.
Windows installer: bundle MSVCP90.dll - used by icuuc42.dll.
SRU: Merge cookies on HTTP redirects (Giannis Kosmas <kosmas@lib.uoc.gr>).
--- 4.0.10 2010/06/18
ZOOM C: Add ZOOM_resultset_release. ZOOM_resultset_release releases a
result set from a connection. The result set will be on its own
thereafter; no operations on it will perform retrievals from a target.
Only cached copies are returned.
ZOOM C:fix case for HTTP servers responding with Connection:close.
Ensure that if there is a current task it is resumed (like fetching
more records in a result set) . Bug #3484.
PQF parser: use odr_atoi for Odr_int (not atoi)
Minor PQF encoding and decoding changes; reformat. PQF decoding: attribute
values that contain any non-digits are treated as string attributes
(previously decoding only checked for leading character ([0-9]). PQF
encoding: attribute string values are not surrounded by double-quotes.
* fix "P_DETACH" and Pod::Usage issues with perl 5.12
* relax cfgmaker option parsing when figuring whether to test for highspeed
counters or not.
* fix sorting of numbered interface names index maker
* belarusian translation for mrtg 2.16
Changes 2.16.3:
* three new config options to compliment the existing
RRDRowCount option to explicitly set the size of all RRAs
* allow to rename target in the clonedirectory option
* add import to the require File::Copy
* support multiple options in ifdesc and ifref setting for cfgmaker
* teach cfgmaker about nortel switches
* make sure rates over 4G work too
* allow group and user option to be set to roo
Changes from dhcpcd-5.2.4 include:
* Always daemonise in master mode as some interface up/downs can trigger timeout
* Improved NTP handling on Debian based systems
* dhcpcd -n will now re-read the configuration file
This switches to the gnome-2.30 release branch.
pkgsrc note: added "telepathy" option for integration with the
telepathy/farsight framework (defaults to "off" for now)
--- 9.7.1 released ---
--- 9.7.1rc1 released ---
2909. [bug] named-checkconf -p could die if "update-policy local;"
was specified in named.conf. [RT #21416]
2908. [bug] It was possible for re-signing to stop after removing
a DNSKEY. [RT #21384]
2907. [bug] The export version of libdns had undefined references.
[RT #21444]
2906. [bug] Address RFC 5011 implementation issues. [RT #20903]
2905. [port] aix: set use_atomic=yes with native compiler.
[RT #21402]
2904. [bug] When using DLV, sub-zones of the zones in the DLV,
could be incorrectly marked as insecure instead of
secure leading to negative proofs failing. This was
a unintended outcome from change 2890. [RT# 21392]
2903. [bug] managed-keys-directory missing from namedconf.c.
[RT #21370]
--- 9.7.1b1 released ---
2902. [func] Add regression test for change 2897. [RT #21040]
2901. [port] Use AC_C_FLEXIBLE_ARRAY_MEMBER. [RT #21316]
2900. [bug] The placeholder negative caching element was not
properly constructed triggering a INSIST in
dns_ncache_towire(). [RT #21346]
2899. [port] win32: Support linking against OpenSSL 1.0.0.
2898. [bug] nslookup leaked memory when -domain=value was
specified. [RT #21301]
2897. [bug] NSEC3 chains could be left behind when transitioning
to insecure. [RT #21040]
2896. [bug] "rndc sign" failed to properly update the zone
when adding a DNSKEY for publication only. [RT #21045]
2895. [func] genrandom: add support for the generation of multiple
files. [RT #20917]
2894. [contrib] DLZ LDAP support now use '$' not '%'. [RT #21294]
2893. [bug] Improve managed keys support. New named.conf option
managed-keys-directory. [RT #20924]
2892. [bug] Handle REVOKED keys better. [RT #20961]
2891. [maint] Update empty-zones list to match
draft-ietf-dnsop-default-local-zones-13. [RT# 21099]
2890. [bug] Handle the introduction of new trusted-keys and
DS, DLV RRsets better. [RT #21097]
2889. [bug] Elements of the grammar where not properly reported.
[RT #21046]
2888. [bug] Only the first EDNS option was displayed. [RT #21273]
2887. [bug] Report the keytag times in UTC in the .key file,
local time is presented as a comment within the
comment. [RT #21223]
2886. [bug] ctime() is not thread safe. [RT #21223]
2885. [bug] Improve -fno-strict-aliasing support probing in
configure. [RT #21080]
2884. [bug] Insufficient valadation in dns_name_getlabelsequence().
[RT #21283]
2883. [bug] 'dig +short' failed to handle really large datasets.
[RT #21113]
2882. [bug] Remove memory context from list of active contexts
before clearing 'magic'. [RT #21274]
2881. [bug] Reduce the amount of time the rbtdb write lock
is held when closing a version. [RT #21198]
2880. [cleanup] Make the output of dnssec-keygen and dnssec-revoke
consistent. [RT #21078]
2879. [contrib] DLZ bdbhpt driver fails to close correct cursor.
[RT #21106]
2878. [func] Incrementally write the master file after performing
a AXFR. [RT #21010]
2877. [bug] The validator failed to skip obviously mismatching
RRSIGs. [RT #21138]
2876. [bug] Named could return SERVFAIL for negative responses
from unsigned zones. [RT #21131]
2875. [bug] dns_time64_fromtext() could accept non digits.
[RT #21033]
2874. [bug] Cache lack of EDNS support only after the server
successfully responds to the query using plain DNS.
[RT #20930]
2873. [bug] Canceling a dynamic update via the dns/client module
could trigger an assertion failure. [RT #21133]
2872. [bug] Modify dns/client.c:dns_client_createx() to only
require one of IPv4 or IPv6 rather than both.
[RT #21122]
2871. [bug] Type mismatch in mem_api.c between the definition and
the header file, causing build failure with
--enable-exportlib. [RT #21138]
2870. [maint] Add AAAA address for L.ROOT-SERVERS.NET.
2869. [bug] Fix arguments to dns_keytable_findnextkeynode() call.
[RT #20877]
2868. [cleanup] Run "make clean" at the end of configure to ensure
any changes made by configure are integrated.
Use --with-make-clean=no to disable. [RT #20994]
2867. [bug] Don't set GSS_C_SEQUENCE_FLAG as Windows DNS servers
don't like it. [RT #20986]
2866. [bug] Windows does not like the TSIG name being compressed.
[RT #20986]
2865. [bug] memset to zero event.data. [RT #20986]
2864. [bug] Direct SIG/RRSIG queries were not handled correctly.
[RT #21050]
2863. [port] linux: disable IPv6 PMTUD and use network minimum MTU.
[RT #21056]
2862. [bug] nsupdate didn't default to the parent zone when
updating DS records. [RT #20896]
2861. [doc] dnssec-settime man pages didn't correctly document the
inactivation time. [RT #21039]
2860. [bug] named-checkconf's usage was out of date. [RT #21039]
2859. [bug] When cancelling validation it was possible to leak
memory. [RT #20800]
2858. [bug] RTT estimates were not being adjusted on ICMP errors.
[RT #20772]
2857. [bug] named-checkconf did not fail on a bad trusted key.
[RT #20705]
2856. [bug] The size of a memory allocation was not always properly
recorded. [RT #20927]
2853. [bug] add_sigs() could run out of scratch space. [RT #21015]
2852. [bug] Handle broken DNSSEC trust chains better. [RT #15619]
2851. [doc] nslookup.1, removed <informalexample> from the docbook
source as it produced bad nroff. [RT #21007]
2850. [bug] If isc_heap_insert() failed due to memory shortage
the heap would have corrupted entries. [RT #20951]
