This release features a fix for the ed25519 signer. This signer hashed the
message before signing, resulting in unverifiable signatures. Also on the
Elliptic Curve front, support was added for ED448 (DNSSEC algorithm 16)
by using libdecaf.
Bug fixes
- Do not hash the message in the ed25519 signer
- Make URI integers 16 bits, fixes#5443
- configure.ac: Corrects syntax error in test statement on existance
of libcrypto_ecdsa
- configure.ac: Fix quoting issue fixes#5401
- configure.ac: Check in the detected OpenSSL/libcrypto for ECDSA
- configure.ac: Check if we can link against libatomic if needed
- Fix typo in ldapbackend.cc from issue #5091
- Sort NSEC record case insensitive
- Make sure NSEC ordernames are always lower case
- API: correctly take TTL from first record even if we are at
the last comment
- Fix AtomicCounter unit tests on 32-bit
- Fix negative port detection for IPv6 addresses on 32-bit
- Remove support for 'right' timezones, as this code turned out to be broken
- Lowercase the TSIG algorithm name in hash computation
- Handle exceptions raised by closesocket()
- Don't leak on signing errors during outgoing AXFR; signpipe stumbles over
interrupted rrsets; fix memory leak in gmysql backend
- TinyCDB backend: Don't leak a CDB object in case of bogus data
Improvements
- ODBC backend: Allow query logging
- Add ED25519 (algo 15) and ED448 (algo 16) support with libdecaf signer
- YaHTTP: Sync with upstream changes
- Send a notification to all slave servers after every dnsupdate
- Add option to set a global lua-axfr-script value
- dnsreplay: Add --source-ip and --source-port options
- calidns: Use the correct socket family (IPv4 / IPv6)
- Add an option to allow AXFR of zones with a different (higher/lower) serial
- API: Make trailing dot handling consistent with pdnsutil
- SuffixMatchNode: Fix insertion issue for an existing node
- Do not resolve the NS-records for NOTIFY targets if the "only-notify"
whitelist is empty, as a target will never match an empty whitelist.
- Improve the AXFR DNSSEC freshness check; Ignore NSEC3PARAM metadata in
an unsigned zone
- Create additional reuseport sockets before dropping privileges; remove
transaction in pgpsql backend
- Wrap long command lines for readability
- Document where we set procname=${name} for rc.d
- Detach long-running processes from controlling terminal
- Configurable path to tcpserver
- Configurable user and group names:
DJBDNS_AXFR_USER?= axfrdns
DJBDNS_CACHE_USER?= dnscache
DJBDNS_RBL_USER?= rbldns
DJBDNS_TINY_USER?= tinydns
DJBDNS_DJBDNS_GROUP?= djbdns
Bump version.
Ignore auth-nocache for auth-user-pass if auth-token is pushed
crypto: Enable SHA256 fingerprint checking in --verify-hash
copyright: Update GPLv2 license texts
auth-token with auth-nocache fix broke --disable-crypto builds
OpenSSL: don't use direct access to the internal of X509
OpenSSL: don't use direct access to the internal of EVP_PKEY
OpenSSL: don't use direct access to the internal of RSA
OpenSSL: don't use direct access to the internal of DSA
OpenSSL: force meth->name as non-const when we free() it
OpenSSL: don't use direct access to the internal of EVP_MD_CTX
OpenSSL: don't use direct access to the internal of EVP_CIPHER_CTX
OpenSSL: don't use direct access to the internal of HMAC_CTX
Fix NCP behaviour on TLS reconnect.
Remove erroneous limitation on max number of args for --plugin
Fix edge case with clients failing to set up cipher on empty PUSH_REPLY.
Fix potential 1-byte overread in TCP option parsing.
Fix remotely-triggerable ASSERT() on malformed IPv6 packet.
refactor my_strupr
Fix 2 memory leaks in proxy authentication routine
Fix memory leak in add_option() for option 'connection'
Ensure option array p[] is always NULL-terminated
Fix a null-pointer dereference in establish_http_proxy_passthru()
Prevent two kinds of stack buffer OOB reads and a crash for invalid input data
Fix an unaligned access on OpenBSD/sparc64
Missing include for socket-flags TCP_NODELAY on OpenBSD
Make openvpn-plugin.h self-contained again.
Pass correct buffer size to GetModuleFileNameW()
Log the negotiated (NCP) cipher
Avoid a 1 byte overcopy in x509_get_subject (ssl_verify_openssl.c)
Skip tls-crypt unit tests if required crypto mode not supported
openssl: fix overflow check for long --tls-cipher option
Add a DSA test key/cert pair to sample-keys
Fix mbedtls fingerprint calculation
mbedtls: fix --x509-track post-authentication remote DoS (CVE-2017-7522)
mbedtls: require C-string compatible types for --x509-username-field
Fix remote-triggerable memory leaks (CVE-2017-7521)
Restrict --x509-alt-username extension types
Fix potential double-free in --x509-alt-username (CVE-2017-7521)
Fix gateway detection with OpenBSD routing domains
Bugfixes:
spawnProcess no longer opens an unwanted console on Windows
The transition to the hyperlink package adds IPv6 support to twisted.python.url.URL. This is now deprecated and new code should use hyperlink directly
twisted.logger now buffers only 200 events by default (reduced from 65536) while waiting for observers to be configured.
The transition of twisted.python.url to using the hyperlink package enables a URL.click() with no arguments (or 0-length string argument) to resolve dot segments in the path.
twisted.protocols.finger now works on Python 3.
TLS-related tests now pass when run with OpenSSL 1.1.0. This makes tests pass again on macOS and Windows, as cryptography 1.8 and later include OpenSSL 1.1.0.
UNIX socket endpoints now process all messages from recvmsg's ancillary data via twisted.internet.unix.Server.doRead/twisted.internet.unix.Client.doRead, while discarding and logging ones that don't contain file descriptors.
twisted.internet.endpoints.HostnameEndpoint and twisted.web.client.Agent work again with reactors that do not provide IReactorPluggableNameResolver. This undoes the changes that broke downstream users such as treq.testing. Note that passing reactors that do not provide IReactorPluggableNameResolver to either is deprecated.
A Python 3 Perspective Broker server which receives a remote call with keyword arguments from a Python 2 client will now decode any keys which are binary to strings instead of crashing. This fixes interoperability between Python 2 Buildbot clients and Python 3 Buildbot servers.
twisted.internet._threadedselect now works on both Python 2 and 3.
twisted.internet.interfaces.IResolverSimple implementers will now always be passed bytes, properly IDNA encoded if required, on Python 2. On Python 3, they will now be passed correctly IDNA-encoded Unicode forms of the domain, taking advantage of the idna library from PyPI if possible. This is to avoid Python's standard library (which has an out of date idna module) from mis- encoding domain names when non-ASCII Unicode is passed to it.
Changes:
28 April 2017: mitmproxy 2.0.2
* Fix mitmweb's Content-Security-Policy to work with Chrome 58+
* HTTP/2: actually use header normalization from hyper-h2
Changes:
version 2017.06.18
Core
* [downloader/common] Use utils.shell_quote for debug command line
* [utils] Use compat_shlex_quote in shell_quote
* [postprocessor/execafterdownload] Encode command line (#13407)
* [compat] Fix compat_shlex_quote on Windows (#5889, #10254)
* [postprocessor/metadatafromtitle] Fix missing optional meta fields processing
in --metadata-from-title (#13408)
* [extractor/common] Fix json dumping with --geo-bypass
+ [extractor/common] Improve jwplayer subtitles extraction
+ [extractor/common] Improve jwplayer formats extraction (#13379)
Extractors
* [polskieradio] Fix extraction (#13392)
+ [xfileshare] Add support for fastvideo.me (#13385)
* [bilibili] Fix extraction of videos with double quotes in titles (#13387)
* [4tube] Fix extraction (#13381, #13382)
+ [disney] Add support for disneychannel.de (#13383)
* [npo] Improve URL regular expression (#13376)
+ [corus] Add support for showcase.ca
+ [corus] Add support for history.ca (#13359)
version 2017.06.12
Core
* [utils] Handle compat_HTMLParseError in extract_attributes (#13349)
+ [compat] Introduce compat_HTMLParseError
* [utils] Improve unified_timestamp
* [extractor/generic] Ensure format id is unicode string
* [extractor/common] Return unicode string from _match_id
+ [YoutubeDL] Sanitize more fields (#13313)
Extractors
+ [xfileshare] Add support for rapidvideo.tv (#13348)
* [xfileshare] Modernize and pass Referer
+ [rutv] Add support for testplayer.vgtrk.com (#13347)
+ [newgrounds] Extract more metadata (#13232)
+ [newgrounds:playlist] Add support for playlists (#10611)
* [newgrounds] Improve formats and uploader extraction (#13346)
* [msn] Fix formats extraction
* [turbo] Ensure format id is string
* [sexu] Ensure height is int
* [jove] Ensure comment count is int
* [golem] Ensure format id is string
* [gfycat] Ensure filesize is int
* [foxgay] Ensure height is int
* [flickr] Ensure format id is string
* [sohu] Fix numeric fields
* [safari] Improve authentication detection (#13319)
* [liveleak] Ensure height is int (#13313)
* [streamango] Make title optional (#13292)
* [rtlnl] Improve URL regular expression (#13295)
* [tvplayer] Fix extraction (#13291)
Pkgsrc changes:
* Adapt PLIST
* Adapt Makefile to new python scripts
Upstream changes:
3.4.19 ExaBGP 'LINX 97/43' release
======
* Add: IPv6 nlri-mpls to list of enabled protocol (was missing)
requested by: adrian62
* Fix: encoding of Flow Label requiring more than 2 bytes
reported by: BLAKEMMM
* Fix: decoding of capability (was potentially over reading)
* Fix: trace when trying to access PID file and this is not allowed
reported by: George Shuklin
* Fix: Remove a peer's RIB cache when it is deleted from the config file
patch by: Brian Johnson
* Fix: do not crash the reactor when an invalid IP is passed via the API
reported by: Yevgeniy Ovsyannikov
* Fix: bad defintion of Flow for ICMPType, ICMPCode and Fragment
reported by: Christoph Loibl
* Feature: allow add-path for mpls-vpn
reported by: adrian62
* Change: Backported setup.py from master
* Feature: added SRPMS for exabgp
patch by: Leonardo Amaral
3.4.18 ExaBGP 'No BETT' release
======
* Backport: backhole community (RFC 7999)
original patch by: Job Snijders
* Fix: Configuration parser does not accept configs without neighbors.
patch by doddt
* Fix: 'connect' keyword is now also allowed in neighbor scope
patch by: Stacey Sheldon (Corsa)
* Fix: removing protocol auto-cleanup (it should never be called
and seems to cause a CG issue)
reported by: Colin Petrie
* Change: default to a 0 offset for ipv6 flowspec source/destination match
patch by: Brian Johnson
* Fix: Better PID file handling
reported by: Ben Agricola
* Fix: Update RIB cache families on configuration reload
patch by: Brian Johnson
* Fix: Backport fix on SIGUSR2 (restarting process not needing to be)
patch by: Shawn Zhou
* Change: group-updates now generates one UPDATE per address family
(and not one per NLRI for non IPv4)
patch by: Brian Johnson
3.4.17 ExaBGP 'No EPF' release
======
* Fix: does not accept IPv6 as router-id
reported by: yuriya
* Fix: JSON output for flow routes with rd
reported by droon5
* Fix: Fix Path-Information
* Fix: Bad encoding of capability when multiple families are used for add-path
reported: by Alexander Bespalov
* Fix: support non ASN4 use of AS_TRANS (AS23456)
reported by: Todd Crane
* Fix: do not exit when we can not accept incoming connection
reported by: Pavel Batkov
* Fix: quote where not escaped in JSON reason field
reported by: Rob Barnes
* Fix: decoding of IPv6 flow routes
reported by: stoffi92
* Fix: decoding of Graceful Restart Capability
patch by: florinz
* Fix: ASN4 encoding
patch by: Shu Sugimoto and Eiichiro Watanabe
* Change: Run without even peers configured
patch by: Jordan Gedney
* Fix: JSON encoding of updates without NLRIs
patch by: Dhammika Pathirana
* Fix: Possible race conditions in api handling
patch by: Brian Johnson
* Feature: Add 'show neighbor status' api
patch by: Brian Johnson
* Fix: flush route api
patch by: Brian Johnson
* Fix: Allow asn4 peer to speak with asn2 only peer
patch by: Brian Johnson
* Fix: only one MP NLRI is allow per UPDATE
reported by: subsecond
* Change: configuration output does not includes ':' anymore
patch by: doddt
* Change: syslog format changed to be in line with other application
patch by: Brian Johnson
3.4.16 ExaBGP 'Free YouTube' release
======
A bug fix only release
* Feature: allow users to decide if processes must be run before
or after we drop privileges
requested by: Ben Agricola
* Fix: correctly look in /etc/exabgp for programs to run when
the path is relative
reported by: Vincent Bernat
* Fix: missing handler for NOTIFICATION
patch by: minglvyy
3.4.15 ExaBGP 'skip' release
======
Do not look for 3.4.14 - it was never released. An issue with pypi
forced us to skip this version.
* Fix: the ttl-security parameter didn't really work. Fixed for
outgoing connections now.
patch by: Borja Marcos
* Fix: configuration leak between processes for neighbor-changes
and send-packets.
reported by: spakka
* Feature: add per neighbor connection port.
requested by: dbarrosop
* Fix: ASN4 boundary off by one
* Fix: Bad peer IP when using show routes.
patch by (backported): Wayne Tucker
* Fix: Missing next-hop in the text api.
reported by: Lisa Roach
* Fix: broken route-refresh command.
reported by: Bryan Schwerer
* Fix: wrongly announcing connection issue with peer on the API.
reported by: Bryan Schwerer
3.4.13 ExaBGP 'Madrid' release
======
* Fix: add semicolon in syslog entry so it can be parsed by tools
* Fix: duplication of message following helper process death
reported by: spakka
* Fix: death of helper program would lead to BGP session drop
reported by: spakka
* Fix: mistakenly made a function private breaking some ASN4 code path
reported by: Victor Sudakov
* Feature: manual eor
patch by: Charles Ng
3.4.12 ExaBGP 'John Glenn' release
======
* Fix: issue with unknown capabilities
reported by: Sandy Breeze
* Fix: notification messages were not passed to the API
reported by: Florian Obser
* Fix: transitivity on extended community
patch by: Thomas Morin
* Fix: bad reporting of VPLS information in JSON
* Fix: wrong SAFI on MPLS routes
reported by: Hideaki HAYASHI
* Fix: bad route comparaison
reported by: Alvaro Pereira
* Fix: decoding of Update
* Fix: Flow redirect to nexhop encoding
reported by: Mickael Marchand (Thank you to Peng Xiao and Nicolas
Fevrier for their help)
* Fix/Improve: JSON for flow spec
* Fix/Improve: redirect-to-nexthop
reported by: Mickael Marchand
c-ares version 1.13.0 - June 20 2017
Changes:
cmake build system support added
Add virtual function set for socket IO: ares_set_socket_functions
Bug fixes:
CVE-2017-1000381: c-ares NAPTR parser out of bounds access
macos: do not set HAVE_CLOCK_GETTIME_MONOTONIC
test: check ares_create_query with too-long name
dist: add ares_library_initialized.* to the tarball
fix build on OpenBSD
dist: ship msvc_ver.inc too
test: Add gTest/gMock files to SOURCES
test: add fuzz entrypoint for ares_create_query()
configure: clock_gettime workaround
docs: convert INSTALL to MarkDown & tweak
ares_process: fix return type of socket_create function (win32 warning)
docs: fixed references to ares_set_local_ip4 and ares_set_local_ip6
Windows DNS server sorting
Use ares_socklen_t instead of socket_t
ares_create_query: use ares_free not naked free
msvc_ver.inc support most recent Visual Studio 2017
acountry: Convert char from ISO-8859-1 to UTF-8
ares_expand_name: limit number of indirections
configure: do not check for ar if specified manually
Added support for Windows DNS Suffix Search List
ares.h: support compiling with QNX
This is a regularly scheduled stable release.
Resolved issues:
#3433: Correctly clear warning "path is a subdirectory of other folder" in folder dialog
#3524: Conflict copies' filename now includes the ID of the last device to change the file
#3993: Folders offered by other devices can now be ignored
#4164: Changed device name takes effect with restart; device name is not sent to unknown devices
#4183: Correctly show CPU usage when started with -no-restart option
Bug Fixes
The following vulnerabilities have been fixed:
* [1]wnpa-sec-2017-22
Bazaar dissector infinite loop ([2]Bug 13599) [3]CVE-2017-9352
* [4]wnpa-sec-2017-23
DOF dissector read overflow ([5]Bug 13608) [6]CVE-2017-9348
* [7]wnpa-sec-2017-24
DHCP dissector read overflow ([8]Bug 13609, [9]Bug 13628)
[10]CVE-2017-9351
* [11]wnpa-sec-2017-25
SoulSeek dissector infinite loop ([12]Bug 13631) [13]CVE-2017-9346
* [14]wnpa-sec-2017-26
DNS dissector infinite loop ([15]Bug 13633) [16]CVE-2017-9345
* [17]wnpa-sec-2017-27
DICOM dissector infinite loop ([18]Bug 13685) [19]CVE-2017-9349
* [20]wnpa-sec-2017-28
openSAFETY dissector memory exhaustion ([21]Bug 13649)
[22]CVE-2017-9350
* [23]wnpa-sec-2017-29
BT L2CAP dissector divide by zero ([24]Bug 13701) [25]CVE-2017-9344
* [26]wnpa-sec-2017-30
MSNIP dissector crash ([27]Bug 13725) [28]CVE-2017-9343
* [29]wnpa-sec-2017-31
ROS dissector crash ([30]Bug 13637) [31]CVE-2017-9347
* [32]wnpa-sec-2017-32
RGMP dissector crash ([33]Bug 13646) [34]CVE-2017-9354
* [35]wnpa-sec-2017-33
IPv6 dissector crash ([36]Bug 13675) [37]CVE-2017-9353
The following bugs have been fixed:
* DICOM dissection error. ([38]Bug 13164)
* Qt: drag & drop of one column header in PacketList moves other
columns. ([39]Bug 13183)
* Can not export captured DICOM objects in version 2.2.5. ([40]Bug
13570)
* False complain about bad checksum of ICMP extension header.
([41]Bug 13586)
* LibFuzzer: ISUP dissector bug (isup.number_different_meaning).
([42]Bug 13588)
* Dissector Bug, protocol BT ATT. ([43]Bug 13590)
* Wireshark dispalys
RRCConnectionReestablishmentRejectRRCConnectionReestablishmentRejec
t in Info column. ([44]Bug 13595)
* [oss-fuzz] UBSAN: shift exponent 105 is too large for 32-bit type
int in packet-ositp.c:551:79. ([45]Bug 13606)
* [oss-fuzz] UBSAN: shift exponent -77 is negative in
packet-netflow.c:7717:23. ([46]Bug 13607)
* [oss-fuzz] UBSAN: shift exponent 1959 is too large for 32-bit type
int in packet-sigcomp.c:2128:28. ([47]Bug 13610)
* [oss-fuzz] UBSAN: shift exponent 63 is too large for 32-bit type
guint32 (aka unsigned int) in packet-rtcp.c:917:24. ([48]Bug 13611)
* [oss-fuzz] UBSAN: shift exponent 70 is too large for 64-bit type
guint64 (aka unsigned long) in dwarf.c:42:43. ([49]Bug 13616)
* [oss-fuzz] UBSAN: shift exponent 32 is too large for 32-bit type
int in packet-xot.c:260:23. ([50]Bug 13618)
* [oss-fuzz] UBSAN: shift exponent -5 is negative in
packet-sigcomp.c:1722:36. ([51]Bug 13619)
* [oss-fuzz] UBSAN: index 2049 out of bounds for type char [2049] in
packet-quakeworld.c:134:5. ([52]Bug 13624)
* [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type
int in packet-netsync.c:467:25. ([53]Bug 13639)
* [oss-fuzz] UBSAN: shift exponent 32 is too large for 32-bit type
int in packet-sigcomp.c:3857:24. ([54]Bug 13641)
* [oss-fuzz] ASAN: stack-use-after-return
epan/dissectors/packet-ieee80211.c:14341:23 in add_tagged_field.
([55]Bug 13662)
* Welcome screen invalid capture filter wihtout WinPcap installed
causes runtime error. ([56]Bug 13672)
* SMB protocol parser does not parse SMB_COM_TRANSACTION2_SECONDARY
(0x33) command correctly. ([57]Bug 13690)
* SIP packets with SDP marked as malformed. ([58]Bug 13698)
* [oss-fuzz] UBSAN: index 8 out of bounds for type gboolean const[8]
in packet-ieee80211-radiotap.c:1836:12. ([59]Bug 13713)
* Crash on "Show packet bytes..." context menu item click. ([60]Bug
13723)
* DNP3 dissector does not properly decode packed variations with
prefixed qualifiers. ([61]Bug 13733)
Updated Protocol Support
Bazaar, BT ATT, BT L2CAP, DHCP, DICOM, DNP3, DNS, DOF, DWARF, ICMP,
IEEE 802.11, IPv6, ISUP, LTE RRC, MSNIP, Netflow, Netsync, openSAFETY,
OSITP, QUAKEWORLD, Radiotap, RGMP, ROS, RTCP, SIGCOMP, SMB, SoulSeek,
and XOT
This is a HUGE bump, so look at the changelog on the Snort website !
For example, Snort does not natively handle MySQL anymore.
As for the pkgsrc changes :
- updated deps (net/daq) ;
- updated config files ;
- updated MASTER_SITE ;
- some substitution to handle pkgsrc paths ;
- updated compile options.
Enhancements
- Add the 2017 DNSSEC root key
- Add support for RPZ wildcarded target names.
- Speed up RPZ zone loading and add a zoneSizeHint parameter to
rpzFile and rpzMaster for faster reloads
- Make the RPZ summary consistent and log additions/removals at debug
level, not info
- Update Ed25519 algorithm number and mnemonic and hook up to the
Recursor
- Add use-incoming-edns-subnet option to process and pass along ECS
and fix some ECS bugs in the process
- Refuse to start with chroot set in a systemd env
- Handle exceptions raised by closesocket() to prevent process
termination
- Document missing top-pub-queries and top-pub-servfail-queries
commands for rec_control
- IPv6 address for g.root-servers.net added
- Log outgoing queries / incoming responses via protobuf
Bug fixes
- Correctly lowercase the TSIG algorithm name in hash computation
- Clear the RPZ NS IP table when clearing the policy, this prevents
false positives
- Fix cache-only queries against a forward-zone
- Only delegate if NSes are below apex in auth-zones
- Remove hardcoding of port 53 for TCP/IP forwarded zones in recursor
- Make sure labelsToAdd is not empty in getZoneCuts()
- Wait until after daemonizing to start the outgoing protobuf thread,
prevents hangs when the protobuf server is not available
- Ensure (re)priming the root never fails
- Don't age the root, fixes a regression from 3.x
- Fix exception when sending a protobuf message for an empty question
- LuaWrapper: Allow embedded NULs in strings received from Lua
- Fix coredumps on illumos/SmartOS
- StateHolder: Allocate (and copy if needed) before taking the lock
- SuffixMatchNode: Fix insertion issue for an existing node
- Fix negative port detection for IPv6 addresses on 32-bit systems
--- 9.9.10-P1 released ---
4632. [security] The BIND installer on Windows used an unquoted
service path, which can enable privilege escalation.
(CVE-2017-3141) [RT #45229]
4631. [security] Some RPZ configurations could go into an infinite
query loop when encountering responses with TTL=0.
(CVE-2017-3140) [RT #45181]
--- 9.10.5-P1 released ---
4632. [security] The BIND installer on Windows used an unquoted
service path, which can enable privilege escalation.
(CVE-2017-3141) [RT #45229]
4631. [security] Some RPZ configurations could go into an infinite
query loop when encountering responses with TTL=0.
(CVE-2017-3140) [RT #45181]
V0.92
added a few arguments to calls added by fmazu. Allows it to compile.
V0.91
only made the tag point to the proper commit. --REW
script now handles that situation (aborted release script) better.
V0.90
only fixed the release script. Should now contain fmaxullo's
patch. --rew
fmazullo (1):
Add AS number to json output
V0.89
only made the tag point to the proper commit. --REW
V0.88
Antonio Querubin (3):
Merge remote-tracking branch 'origin/master' into newdns
Need to error check getnameinfo().
Merge remote-tracking branch 'origin/master' into newdns
David Hill (1):
include <sys/select.h> for fd_set
Jakub Wilk (1):
Fix typos
Joe Bruggeman (2):
Replace all tabs tabs in net.c with spaces
cleanup the if blocks in net.c to improve readability
Jürgen Weigert (1):
Mention + and - keys in the man page
Kacper Michajłow (2):
Relax mtr-packet search rules.
Add missing errno.h include.
Matt Kimball (20):
Added mtr-packet subprocess
test: Fix mtr-packet tests for Python 3
cmdline: multiple host names dropped all but one host (issue #168)
mtr-packet: IPv6 support
mtr-packet: UDP probe support
mtr-packet: packet customization options (size, fill, mark, tos)
mtr-packet: TCP and SCTP probes
mtr-packet: MPLS decoding and local UDP port usage
mtr-packet: allow local address binding
Merge branch mtr-packet into 'master'
mtr-packet: drop capabilities + using BSD's linked lists for probes
build: moved front-end source into ui subdir
build: use AC_CHECK_LIB for ncurses, rather than pkg-tool
mtr-packet: Fall back to IPv4 only support if IPv6 sockets fail to open
build: if linking with ncurses fails, try curses (for NetBSD)
build: Fix Solaris build issues
build: fix compiler warnings when for OpenBSD, NetBSD and Solaris
mtr-packet: Report probe status on host unreachable (Cygwin)
cleanup: Fix #ifdef structure which confuses 'ident'
cleanup: reindented C source with GNU indent
Narthorn (2):
Initialize dns process before opening display
Add displaymode 2 back in
R.E. Wolff (19):
Merge branch 'newdns' of https://github.com/traviscross/mtr into newdns
Merge branch 'newdns'
fixed double printout of start time, issue 131
Updated NEWS as in v0.87.1
format sent and rcvd fields correctly for big numbers #66
increased default unknownhosts #92#132#130 (I give in).
Merge branch 'master' of github.com:traviscross/mtr
fixed no-gtk build bug introduced with e2d898cc
more cleanup
Partial reverse of 6bb5b6b3b.
re-initialize ipinfo_no and -max. Fixes#161.
Merge branch 'master' of github.com:traviscross/mtr
fixed dynamic DNS on/off switch. Fixed#160
header alignment issue found&fixed by meingtsla. Fixes#164
Merge branch 'master' of github.com:traviscross/mtr
asn fix from meingtsla, fixes#163. Pong!
put ifdefs around IPV6 only part. Fixes#184
More whitespace mangling for consistency in net.c
The release script bumped the version number
Roger Wolff (22):
New DNS works for IPV4....
moved towards IPV6 compatibilty...
removed the include mess...
merged antonios's bufsize fixes
Merge branch 'master' of github.com:traviscross/mtr into newdns
AQ: Added include for redhat, and fixed salen for BSD
removed last debug output from dns.c
One more patch to fix a getnameinfo corruption problem. -- AQ
Rogier Wolff (5):
removed AC check for features newdns doesn't use
Fixed pull #133 another way....
fixed#27 and #35 where the fix was tested a long time ago.
fixed#141 compile without SCTP if not available
fixed typo.
Sami Kerola (122):
warnings: remove unnecessary file
usage: add short and long options and descriptions to usage()
warnings: stop variable shadowing
dns: remove unnecessary dns_events() function
posix: replace bzero() and index() with modern equivelants
warnings: stop reassigning a value before the old one has been used
warnings: remove code that cannot be reached
warnings: fix printf data types
cleanup: remove unnecessary null check
build-sys; do not use subdirectory object
man: use url macro to urls and fix reference manual notations
build-sys: default to ,/configure --enable-silent-rules
warnings: do not take abs() when data type is unsigned
warnings: mark unused function input variables
warnings: fix couple unsigned vs signed variable comparisions
warnings: multiply timeval seconds only when the value is small
warnings: fix some missed unsigned vs signed variable comparisions
comment: add value range note to initialization
cast: do not downgrade to float when double should be used
warnings: remove dead code
build-sys: fix make distcheck
build-sys: remove old dist Makefile kludge
build-sys: use build version script from gnulib
build-sys: improve configure.am
build-sys: require automake 1.11.6 or newer
warnings: fix unused variable when ./configure --without-gtk is used
readability: always use EXIT_* definitions from stdlib.h
cleanup: remove unnecessary function
warnigns: add void to functions that do not take any arguments
build-sys: fix --without-ipinfo regressions
build-sys: fix ./configure --disable-ipv6
warnings: fix --disable-ipv6 --without-ipinfo compilation warnings
build-sys: check pkg-config availability
build-sys: use pkg-config to find gtk+-2.0
build-sys: use pkg-config to find ncurses
build-sys: get rid of double negative ipinfo autotools settings
cleanup: remove NO_SPLIT preprocessor check
build-sys: simplify finding resolver library
build-sys: remove unused autoconf check values
cleanup: remove obsolete herror() function
usage: reflect ./configure choices in available command line options
cleanup: remove preprocessor missing functions go-arounds
usage: be careful when parsing numeric user input
usage: use error(3) error-reporting function
cleanup: move max port number to be a define in net.h
build-sys: use system getopt_long() when it is available
build-sys: tell function locality explicitly
portability: fix float max check from values.h
portability: MacOS does not have error() function
portability: fix MacOS libresolv usage
data types: set static strings to be read-only
cleanup: remove redundant redeclaration
data types: move variable declaration from header to .c file
data types: check with smatch everything is in resonable scope
warnings: fix use of uninitialized warning
data types: get rid of all globals that are easy to remove
usability: fix --mark documentation
docs: make manual page versioning automatic
data types: move global data to control structures
data types: make control structure smaller
data types: move rest of the global variables to control structures
crash fix: make --xml not to dump core
warnings: correct function pointer prototype argument
warnings: do not use zero as NULL
warnings: avoid vla when malloc() is more appropriate
usability: print usage() if unknown options are used
cleanup: use definition for a magic value appearing twice in code
cleanup: remove commented out includes in dns.c
cleanup: avoid duplicating stdint.h
cleanup: use ICMP definitions from linux/icmp.h when possible
cleanup: move generic utility functions to a separate file
reliability: ensure string copy results to a null determined string
reliability: further removal of unsave string operation
reliability: always check malloc() return value
reliability: always check strdup() return value
reliability: check writing to stdout and stderr was successful
usability: use ISO-8601 timestamp
posix: do not use time(2) input argument
usability: add bash-completion file
bug fix: long option --gracetime is correct, --graceperiod is not
performance: use fewer printw() calls to center text
cleanup: merge two trim functions to one
crash fix: add ctl structure to gtk Pause_clicked() handler
crash fix: never return const string as address
crash fix: ctl->iiwidth_len was not initialized correctly
cleanup: make unused and const attributes to look the same
performance: make get_iiwidth() to be const function
cleanup: remove more/bottom labels header separation from mpls
cleanup: set variable only if it is used
cleanup: correct display_offset variable usage
cleanup: remove message duplicate
performance: set few variables read-only
docs: add Sami Kerola to authors
performance: make reset in net.c more effective
portability: fix bsd build
warnings: ensure printf will not overflow
misc: improve random initialization
net: fix net_reopen() initialization
warnings: fix warnings when everything possible is turned on
curses: simplify format_number()
curses: use switch case in mtr_curses_keyaction()
cleanup: remove dead code
style: convert c++ comment style to c style
display: avoid unnecessary switch case clauses
curses: convert magic numbers to an enum list
data types: move variables from a file to a function scope
cleanup: move file scope variables to the beginning of file
data types: move names list away from global scope
cleanup: move definitions and struct declarations to mtr.h
cleanup: clarify preprocessor nesting
build-sys: use proper check to find if time_t is defined
build-sys: enable all system extensions
regression: fix --displaymode=2 argument
user interface: do not allow out of range --ipinfo arguments
cleanup: use single logic to handle conditional options
docs: add very basic --sctp documentation to manual page
docs: improve mtr-packet(8) manual page
build-sys: update .gitignore file
smatch: extern keyword is needed only in header
smatch: fix couple warnings
build-sys: update .gitignore file
docs: FSF moved back in 2005
Vlad Glagolev (1):
respect theme foreground color
aquerubin (5):
Correct psize for IPv6.
Merge updates from branch 'master' into newdns
Merge branch 'master' into newdns
Merge branch 'newdns' of https://github.com/aquerubin/mtr into newdns
Fix standard deviation calculation.
Changes in version 0.3.0.8 - 2017-06-08
Tor 0.3.0.8 fixes a pair of bugs that would allow an attacker to
remotely crash a hidden service with an assertion failure. Anyone
running a hidden service should upgrade to this version, or to some
other version with fixes for TROVE-2017-004 and TROVE-2017-005.
Tor 0.3.0.8 also includes fixes for several key management bugs
that sometimes made relays unreliable, as well as several other
bugfixes described below.
o Major bugfixes (hidden service, relay, security, backport
from 0.3.1.3-alpha):
- Fix a remotely triggerable assertion failure when a hidden service
handles a malformed BEGIN cell. Fixes bug 22493, tracked as
TROVE-2017-004 and as CVE-2017-0375; bugfix on 0.3.0.1-alpha.
- Fix a remotely triggerable assertion failure caused by receiving a
BEGIN_DIR cell on a hidden service rendezvous circuit. Fixes bug
22494, tracked as TROVE-2017-005 and CVE-2017-0376; bugfix
on 0.2.2.1-alpha.
o Major bugfixes (relay, link handshake, backport from 0.3.1.3-alpha):
- When performing the v3 link handshake on a TLS connection, report
that we have the x509 certificate that we actually used on that
connection, even if we have changed certificates since that
connection was first opened. Previously, we would claim to have
used our most recent x509 link certificate, which would sometimes
make the link handshake fail. Fixes one case of bug 22460; bugfix
on 0.2.3.6-alpha.
o Major bugfixes (relays, key management, backport from 0.3.1.3-alpha):
- Regenerate link and authentication certificates whenever the key
that signs them changes; also, regenerate link certificates
whenever the signed key changes. Previously, these processes were
only weakly coupled, and we relays could (for minutes to hours)
wind up with an inconsistent set of keys and certificates, which
other relays would not accept. Fixes two cases of bug 22460;
bugfix on 0.3.0.1-alpha.
- When sending an Ed25519 signing->link certificate in a CERTS cell,
send the certificate that matches the x509 certificate that we
used on the TLS connection. Previously, there was a race condition
if the TLS context rotated after we began the TLS handshake but
before we sent the CERTS cell. Fixes a case of bug 22460; bugfix
on 0.3.0.1-alpha.
o Major bugfixes (hidden service v3, backport from 0.3.1.1-alpha):
- Stop rejecting v3 hidden service descriptors because their size
did not match an old padding rule. Fixes bug 22447; bugfix on
tor-0.3.0.1-alpha.
o Minor features (fallback directory list, backport from 0.3.1.3-alpha):
- Replace the 177 fallbacks originally introduced in Tor 0.2.9.8 in
December 2016 (of which ~126 were still functional) with a list of
151 fallbacks (32 new, 119 unchanged, 58 removed) generated in May
2017. Resolves ticket 21564.
o Minor bugfixes (configuration, backport from 0.3.1.1-alpha):
- Do not crash when starting with LearnCircuitBuildTimeout 0. Fixes
bug 22252; bugfix on 0.2.9.3-alpha.
o Minor bugfixes (correctness, backport from 0.3.1.3-alpha):
- Avoid undefined behavior when parsing IPv6 entries from the geoip6
file. Fixes bug 22490; bugfix on 0.2.4.6-alpha.
o Minor bugfixes (link handshake, backport from 0.3.1.3-alpha):
- Lower the lifetime of the RSA->Ed25519 cross-certificate to six
months, and regenerate it when it is within one month of expiring.
Previously, we had generated this certificate at startup with a
ten-year lifetime, but that could lead to weird behavior when Tor
was started with a grossly inaccurate clock. Mitigates bug 22466;
mitigation on 0.3.0.1-alpha.
o Minor bugfixes (memory leak, directory authority, backport from
0.3.1.2-alpha):
- When directory authorities reject a router descriptor due to
keypinning, free the router descriptor rather than leaking the
memory. Fixes bug 22370; bugfix on 0.2.7.2-alpha.
o [Windows] Updated the bundled Npcap from 0.78 to 0.91, with several bugfixes
for WiFi connectivity problems and stability issues. [Daniel Miller, Yang Luo]
o Integrated all of your service/version detection fingerprints submitted from
September to March (855 of them). The signature count went up 2.9% to 11,418.
We now detect 1193 protocols from apachemq, bro, and clickhouse to jmon,
slmp, and zookeeper. Highlights: http://seclists.org/nmap-dev/2017/q2/140
o [NSE] Added 14 NSE scripts from 12 authors, bringing the total up to 566!
They are all listed at https://nmap.org/nsedoc/, and the summaries are below:
o [Ncat] A series of changes and fixes based on feedback from the Red Hat community:
o [NSE][GH-266][GH-704][GH-238][GH-883] NSE libraries smb and msrpc now use
fully qualified paths. SMB scripts now work against all modern versions
of Microsoft Windows. [Paulino Calderon]
o [NSE] smb library's share_get_list now properly uses anonymous connections
first before falling back authenticating as a known user.
o New service probes and matches for Apache HBase and Hadoop MapReduce.
[Paulino Calderon]
o Extended Memcached service probe and added match for Apache ZooKeeper.
[Paulino Calderon]
o [NSE] New script argument "vulns.short" will reduce vulns library script
output to a single line containing the target name or IP, the vulnerability
state, and the CVE ID or title of the vulnerability. [Daniel Miller]
o [NSE][GH-862] SNMP scripts will now take a community string provided like
`--script-args creds.snmp=private`, which previously did not work because it
was interpreted as a username. [Daniel Miller]
o [NSE] Resolved several issues in the default HTTP redirect rules:
- [GH-826] A redirect is now cancelled if the original URL contains
embedded credentials
- [GH-829] A redirect test is now more careful in determining whether
a redirect destination is related to the original host
- [GH-830] A redirect is now more strict in avoiding possible redirect
loops
[nnposter]
o [NSE][GH-766] The HTTP Host header will now include the port unless it is
the default one for a given scheme. [nnposter]
o [NSE] The HTTP response object has a new member, fragment, which contains
a partially received body (if any) when the overall request fails to
complete. [nnposter]
o [NSE][GH-866] NSE now allows cookies to have arbitrary attributes, which
are silently ignored (in accordance with RFC 6265). Unrecognized attributes
were previously causing HTTP requests with such cookies to fail. [nnposter]
o [NSE][GH-844] NSE now correctly parses a Set-Cookie header that has unquoted
whitespace in the cookie value (which is allowed per RFC 6265). [nnposter]
o [NSE][GH-731] NSE is now able to process HTTP responses with a Set-Cookie
header that has an extraneous trailing semicolon. [nnposter]
o [NSE][GH-708] TLS SNI now works correctly for NSE HTTP requests initiated
with option any_af. As an added benefit, option any_af is now available for
all connections via comm.lua, not just HTTP requests. [nnposter]
o [NSE][GH-781] There is a new common function, url.get_default_port(),
to obtain the default port number for a given scheme. [nnposter]
o [NSE][GH-833] Function url.parse() now returns the port part as a number,
not a string. [nnposter]
o No longer allow ICMP Time Exceeded messages to mark a host as down during
host discovery. Running traceroute at the same time as Nmap was causing
interference. [David Fifield]
o [NSE][GH-807] Fixed a JSON library issue that was causing long integers
to be expressed in the scientific/exponent notation. [nnposter]
o [NSE] Fixed several potential hangs in NSE scripts that used
receive_buf(pattern), which will not return if the service continues to send
data that does not match pattern. A new function in match.lua, pattern_limit,
is introduced to limit the number of bytes consumed while searching for the
pattern. [Daniel Miller, Jacek Wielemborek]
o [Nsock] Handle any and all socket connect errors the same: raise as an Nsock
error instead of fatal. This prevents Nmap and Ncat from quitting with
"Strange error from connect:" [Daniel Miller]
o [NSE] Added several commands to redis-info to extract listening addresses,
connected clients, active channels, and cluster nodes. [Vasiliy Kulikov]
o [NSE][GH-679][GH-681] Refreshed script http-robtex-reverse-ip, reflecting
changes at the source site (www.robtex.com). [aDoN]
o [NSE][GH-620][GH-715] Added 8 new http-enum fingerprints for Hadoop
infrastructure components. [Thomas Debize, Varunram Ganesh]
o [NSE][GH-629] Added two new fingerprints to http-default-accounts
(APC Management Card, older NetScreen ScreenOS) [Steve Benson, nnposter]
o [NSE][GH-716] Fix for oracle-tns-version which was sending an invalid TNS
probe due to a string escaping mixup. [Alexandr Savca]
o [NSE][GH-694] ike-version now outputs information about supported attributes
and unknown vendor ids. Also, a new fingerprint for FortiGate VPNs was
submitted by Alexis La Goutte. [Daniel Miller]
o [GH-700] Enabled support for TLS SNI on the Windows platform. [nnposter]
o [GH-649] New service probe and match lines for the JMON and RSE services of
IBM Explorer for z/OS. [Soldier of Fortran]
o Removed a duplicate service probe for Memcached added in 2011 (the original
probe was added in 2008) and reported as duplicate in 2013 by Pavel Kankovsky.
o New service probe and match line for NoMachine NX Server remote desktop.
[Justin Cacak]
o [Zenmap] Fixed a recurring installation problem on OS X/macOS where Zenmap
was installed to /Applications/Applications/Zenmap.app instead of
/Applications/Zenmap.app.
o [Zenmap][GH-639] Zenmap will no longer crash when no suitable temporary
directory is found. Patches contributed by [Varunram Ganesh] and [Sai Sundhar]
o [Zenmap][GH-626] Zenmap now properly handles the -v0 (no output) option,
which was added in Nmap 7.10. Previously, this was treated the same as not
specifying -v at all. [lymanZerga11]
o [GH-630] Updated or removed some OpenSSL library calls that were deprecated
in OpenSSL 1.1. [eroen]
o [NSE] Script ssh-hostkey now recognizes and reports Ed25519 keys [nnposter]
o [NSE][GH-627] Fixed script hang in several brute scripts due to the "threads"
script-arg not being converted to a number. Error message was
"nselib/brute.lua:1188: attempt to compare number with string" [Arne Beer]
Provides telnet client functionality.
This class also has, through delegation, all the methods of a socket object
(by default, a TCPSocket, but can be set by the Proxy option to new()).
This provides methods such as close() to end the session and sysread() to read
data directly from the host, instead of via the waitfor() mechanism.
Note that if you do use sysread() directly when in telnet mode, you should
probably pass the output through preprocess() to extract telnet command
sequences.
pkgsrc changes:
- pull upstream fix for redmine ticket #1031 (twitpic gzipped xfer)
- pull changes to use delayer-deferred 2.0.0 for redmine ticket
#916 (extra follow/follower activities) and
#995 (abnormal cpu load with delayer-deferred 1.1.0)
Upstream changes:
- ruby-gnome2 3.1.6
- subcommands that create spec files don't accept . as a pathname
- free memories on loading images earlier
- avoid to use deprecated Gdk::PixbufLoader
Pkgsrc changes:
===============
* Update dependencies to match requirements.txt
* Adapt to PLIST changes
Upstream changes:
=================
Release 2.1.3
-------------
Features Added:
* Ephemeral config support #707
* Add a srx_cluster_redundancy_group fact. #711
Bugs Fixed:
* ignore_warning fails when single that is first child of . #712
* mode='telnet' did not logout non-cli user #713
* JSONLoadError was thrown when load valid JSON config #717/#718
* Fix XML normalization feature when using NETCONF over console. #719/#720
* Handle differences in |display xml rpc #722
Release 2.1.2
-------------
Bugs Fixed:
* Doc badge was pointing to older version #694
* Fix new-style fact gathering for SRX clusters. #697/#698
* Properly handle SW upgrades on multi-RE and/or multi-chassis
systems when using new-style fact gathering. #700
* Raise JSONLoadError if json config is malformed #706
* Handle ConnectClosedError exception for lock() and unlock() #708
Release 2.1.1
-------------
Bugs Fixed:
* Fix regressions caused by ignore_warning. #691
Release 2.1.0
-------------
Features Added:
* Enhanced fact gathering. Facts are now gathered "on demand."
Additional facts are added.
* The definition of facts and return values are properly documented. #638
* Support for YANG get RPCs. #672
* Add an ignore_warning argument to suppress RpcError exceptions
for warnings. #672/#685
* Enhanced the sw.install() method with basic ISSU and NSSU
support using the issu and nssu
* boolean arguments. #606/#630/#632
* ** NSSU support has not yet been tested and should currently
be considered experimental.
* Provide a master property and a re_name property for Device. #682
* Enhanced reboot() method to take an all_re boolean parameter
which controls if only the connected
* Routing Engine, or all Routing Engines, are rebooted. #613
* Enhanced the warning message produced by the cli() method to
recommend the corresponding
* dev.rpc.<method>() call. #603
* Add support for update parameter to configuration load() method. #681
* Added directory_usage to utils #629/#631/#636
* Adding support for NFX/JDM fact gathering. #652/#659
* Connected property. #664
Bugs Fixed:
* Updated the interface-name glob pattern to correctly match
et-<x>/<y>/<z> interfaces
* in several tables and views. #609
* Take care of special chars on screen during console connection. #610
* Address issue with fact gathering stopping when it encounters
a problem. #615
* Minor typos fixed in RuntimeError exception message and in comments. #621
* Added console_has_banner parameter. #622
* Add CentOS Support to install instructions #623
* Key value is needed in _IsisAdjacencyLogTable #627
* Improved functionality and documentation of Docker build.
#637/#673/#674/#677
* added remote port ID to lldp.yml (OP) #645
* Fix documentation for rollback() #647
* Fix for fact gathering pprint. #660/#661
* update ospf view, add bgp/inventory #665
* Updated doc string for close function #686
* Add Travis builds for Python 3.5 and 3.6 #687
* StartShell.run to take this as None for non returning commands #680
* Modify ignore_warning return value to mimic normal RPC return value. #688
Release 2.0.1
-------------
* StartShell to take timeout (30 second by default) as paramter
* Proper exception handling in case of Console connection #595
* Fix: Config.lock() return exception when normalize is on
* Added microbadge badge for the Docker image #593
* Fix: print dev for Console conn was printing object not Device(....) #591
* Fix: To take care of special chars with StartShell->run function call #589
* Fix: ssh private key file to be considered for scp util #586
* Added Dockerfile to enable automated image builds on project commits #585
Pkgsrc changes:
* Adapt PLIST and patch to README.rst.
Upstream changes:
v0.5.3
- Add notifications support
- Add support for ecdsa keys
- Various bug fixes
