* Temporary file names no longer use the process ID as part of the name
* Use arc4random_uniform() instead of random() or lrand48()
* The prngd or egd daemon can now be used on systems without /dev/urandom
* Added long option support for compatibility with GNU coreutils version
* Fixed an installation issue on Cygwin
2008.10.07 -- Version 2.1_rc13
* Bundled OpenSSL 0.9.8i with Windows installer.
* Management interface can now listen on a unix
domain socket, for example:
management /tmp/openvpn unix
Also added management-client-user and management-client-group
directives to control which processes are allowed to connect
to the socket.
* Copyright change to OpenVPN Technologies, Inc.
2008.09.23 -- Version 2.1_rc12
* Patched Makefile.am so that the new t_cltsrv-down.sh script becomes
part of the tarball (Matthias Andree).
* Fixed --lladdr bug introduced in 2.1-rc9 where input validation code
was incorrectly expecting the lladdr parameter to be an IP address
when it is actually a MAC address (HoverHell).
2008.09.14 -- Version 2.1_rc11
* Fixed a bug that can cause SSL/TLS negotiations in UDP mode
to fail if UDP packets are dropped.
2008.09.10 -- Version 2.1_rc10
* Added "--server-bridge" (without parameters) to enable
DHCP proxy mode: Configure server mode for ethernet
bridging using a DHCP-proxy, where clients talk to the
OpenVPN server-side DHCP server to receive their IP address
allocation and DNS server addresses.
* Added "--route-gateway dhcp", to enable the extraction
of the gateway address from a DHCP negotiation with the
OpenVPN server-side LAN.
* Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns
on Windows. If the bypass IP address is 0.0.0.0 or 255.255.255.255,
ignore it.
* Warn when ethernet bridging that the IP address of the bridge adapter
is probably not the same address that the LAN adapter was set to
previously.
* When running as a server, warn if the LAN network address is
the all-popular 192.168.[0|1].x, since this condition commonly
leads to subnet conflicts down the road.
* Primarily on the client, check for subnet conflicts between
the local LAN and the VPN subnet.
* Added a 'netmask' parameter to get_default_gateway, to return
the netmask of the adapter containing the default gateway.
Only implemented on Windows so far. Other platforms will
return 255.255.255.0. Currently the netmask information is
only used to warn about subnet conflicts.
* Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO
and USE_SSL flags are enabled (Alon Bar-Lev).
* Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new
--script-security rules. Also adds retrying if the addresses are in
use (Matthias Andree).
* Fixed build issue with ./configure --disable-socks --disable-http.
* Fixed separate compile errors in options.c and ntlm.c that occur
on strict C compilers (such as old versions of gcc) that require
that C variable declarations occur at the start of a {} block,
not in the middle.
* Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which
the new implementation of extract_x509_field_ssl depends on.
* LZO compression buffer overflow errors will now invalidate
the packet rather than trigger a fatal assertion.
* Fixed minor compile issue in ntlm.c (mid-block declaration).
* Added --allow-pull-fqdn option which allows client to pull DNS names
from server (rather than only IP address) for --ifconfig, --route, and
--route-gateway. OpenVPN versions 2.1_rc7 and earlier allowed DNS names
for these options to be pulled and translated to IP addresses by default.
Now --allow-pull-fqdn will be explicitly required on the client to enable
DNS-name-to-IP-address translation of pulled options.
* 2.1_rc8 and earlier did implicit shell expansion on script
arguments since all scripts were called by system().
The security hardening changes made to 2.1_rc9 no longer
use system(), but rather use the safer execve or CreateProcess
system calls. The security hardening also introduced a
backward incompatibility with 2.1_rc8 and earlier in that
script parameters were no longer shell-expanded, so
for example:
client-connect "docc CLIENT-CONNECT"
would fail to work because execve would try to execute
a script called "docc CLIENT-CONNECT" instead of "docc"
with "CLIENT-CONNECT" as the first argument.
This patch fixes the issue, bringing the script argument
semantics back to pre 2.1_rc9 behavior in order to preserve
backward compatibility while still using execve or CreateProcess
to execute the script/executable.
* Modified ip_or_dns_addr_safe, which validates pulled DNS names,
to more closely conform to RFC 3696:
(1) DNS name length must not exceed 255 characters
(2) DNS name characters must be limited to alphanumeric,
dash ('-'), and dot ('.')
* Fixed bug in intra-session TLS key rollover that was introduced with
deferred authentication features in 2.1_rc8.
008.07.31 -- Version 2.1_rc9
* Security Fix -- affects non-Windows OpenVPN clients running
OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT
vulnerable nor are any versions of the OpenVPN server vulnerable).
An OpenVPN client connecting to a malicious or compromised
server could potentially receive an "lladdr" or "iproute" configuration
directive from the server which could cause arbitrary code execution on
the client. A successful attack requires that (a) the client has agreed
to allow the server to push configuration directives to it by including
"pull" or the macro "client" in its configuration file, (b) the client
succesfully authenticates the server, (c) the server is malicious or has
been compromised and is under the control of the attacker, and (d) the
client is running a non-Windows OS. Credit: David Wagner.
* Miscellaneous defensive programming changes to multiple
areas of the code. In particular, use of the system() call
for calling executables such as ifconfig, route, and
user-defined scripts has been completely revamped in favor
of execve() on unix and CreateProcess() on Windows.
* In Windows build, package a statically linked openssl.exe to work around
observed instabilities in the dynamic build since the migration to
OpenSSL 0.9.8h.
2008.06.11 -- Version 2.1_rc8
* Added client authentication and packet filtering capability
to management interface. In addition, allow OpenVPN plugins
to take advantage of deferred authentication and packet
filtering capability.
* Added support for client-side connection profiles.
* Fixed unbounded memory growth bug in environmental variable
code that could have caused long-running OpenVPN sessions
with many TLS renegotiations to incrementally
increase memory usage over time.
* Windows release now packages openssl-0.9.8h.
* Build system changes -- allow building on Windows using
autoconf/automake scripts (Alon Bar-Lev).
* Changes to Windows build system to make it easier to do
partial builds, with a reduced set of prerequisites,
where only a subset of OpenVPN installer
components are built. See ./domake-win comments.
* Cleanup IP address for persistence interfaces for tap and also
using ifconfig, gentoo#209055 (Alon Bar-Lev).
* Fall back to old version of extract_x509_field for OpenSSL 0.9.6.
* Clarified tcp-queue-limit man page entry (Matti Linnanvuori).
* Added new OpenVPN icon and installer graphic.
* Minor pkitool changes.
* Added --pkcs11-id-management option, which will cause OpenVPN to
query the management interface via the new NEED-STR asynchronous
notification query to get additional PKCS#11 options (Alon Bar-Lev).
* Added NEED-STR management interface asynchronous query and
"needstr" management interface command to respond to the query
(Alon Bar-Lev).
* Added Dragonfly BSD support (Francis-Gudin).
* Quote device names before passing to up/down script (Josh Cepek).
* Bracketed struct openvpn_pktinfo with #pragma pack(1) to
prevent structure padding from causing an incorrect length
to be returned by sizeof (struct openvpn_pktinfo) on 64-bit
platforms.
* On systems that support res_init, always call it
before calling gethostbyname to ensure that
resolver configuration state is current.
* Added NTLMv2 proxy support (Miroslav Zajic).
* Fixed an issue in extract_x509_field_ssl where the extraction
would fail on the first field of the subject name, such as
the common name in: /CN=foo/emailAddress=
foo@bar.comThis e-mail address is being protected from spambots. You need
JavaScript enabled to view it
* Made "Linux ip addr del failed" error nonfatal.
* Amplified --client-cert-not-required warning.
* Added #pragma pack to proto.h.
Changes between GMP version 4.2.3 and 4.2.4
Bugs:
* Fix bug with parsing exponent '+' sign in mpf.
* Fix an allocation bug in mpf_set_str, also affecting mpf_init_set_str, and
mpf_inp_str.
Speedups:
* None, except that proper processor recognition helps affected processors.
Features:
* Recognize new AMD processors.
2.2.7 - 26 September 2008
Welcome to the GnuCash 2.2.7 Release.
Fixed Bugs:
o #139651: Register: Split transaction with multiple currencies fails
o #309863: Balance Sheet: Rounding errors with prices from pricedb
o #341362: Price Editor: Price is displayed as fraction instead
of decimal
o #376298: Price Editor: Window Contents Corrupted After
Manually Adding a Price
o #378734: Drop down calendar only works once
o #430121: Incorrect Sign Symbol for Fractional Commodity/Security Sale
o #454340: Security Editor: duplicate rows after editing a security
o #454827: Reports: Incorrect share value of stocks in foreign currency
o #464771: Investment Portfolio: Report crashes without price data
o #483393: Reports: Allow mixed denominators in numeric collectors
o #504935: Add currencies XDR and XXX
o #506873: Win32: Cannot install online price retrieval with
ActivePerl 5.10
o #520570: Drop-down calendar for "reconcile information" non-responsive
o #522095: Updating stock prices does not update totals shown in windows
o #526313: GnuCash does not support the new currency in Venezuela
o #529816: Supplement "CUSIP" by "ISIN", to give people outside
USA a hint
o #539640: Price Editor: Security disappears from price list
o #539962: Void function cannot return value with sun cc
o #540148: GnuCash cannot be built with libgoffice-0.8
o #541970: Balance Sheet: "Nearest in time" exchange rate not correct
o #543061: Fractional not working in IDR (rupiah) currency
o #543780: Transfer Dialog: CRIT messages in gnucash.trace from
exchange rate dialog
o #545316: Drop-down calendar is not clickable when posting invoice
o #545722: Can't change date in dialog boxes
o #546064: gnucash.desktop file does not comply with
desktop-file-validate
o #548601: AqBanking Import: Obscuring zero balance windows
after getting transactions
o #548891: QIF Import: GnuCash crashes when
.gnucash/qif-accounts-map is readonly
o #549115: Popup calendar unresponsive in modal dialogs
o #549595: Silently removes main files while trying to save without lock
o #549738: Reports: Default date on aging and customer reports
is too far in the future
o #551038: Reports: Alt-O shortcut in report options dialog crashes app
o #552306: Fails to save file when using a network filesystem on Mac
Other Changes:
o New Finnish translation
o Complete Romanian translation
o Usability improvements in the price and the security editor
o Lower number of false positives when checking aqbanking
results for failures
o Correct import of remote names, zero balances from aqbanking3
o Update translations: Catalan, Dutch, German, Italian, Polish
Sat Sep 13 20:40:01 BST 2008 - surfraw 2.2.3
* Surfraw now defaults to graphical mode. See surfraw(1)
for how to change the default back.
* Search for default browsers during build.
This can be overridden by passing --with-text-browser=BROWSER
and --with-graphical-browser=BROWSER to ./configure.
* New elvis: piratebay, genportage. Thanks to J.R. Mauro.
* Detect which awk to use.
* Fixed slinuxdoc and webster.
* Removed bashisms.
* Fixed uninstall.
* Add --disable-sr option to ./configure to disable installing the
'sr' symbolic link, to avoid clashes with the SR programming language.
* Bug fix: FFTW computes incorrect results when the user plans both
REDFT11 and RODFT11 transforms of certain sizes. The bug is caused
by incorrect sharing of twiddle-factor tables between the two
transforms, and only occurs when both are used. Thanks to Paul
A. Valiant for the bug report.
* Don't split large commands into multiple commands; just fail on them.
This prevents cross-site request forgery (CSRF)-like attacks,
when a web browser is used to access an ftp server.
* Enhance -C to support an optional @host ('-C user[@host]'):
checks whether user as connecting from host would be granted
access by ftpusers(5).
* Support IPv6 in the host directive of ftpusers(5).
* Implement -n to disable hostname lookups.
* Disable SOCKS support; I don't have the ability to test it,
and the autoconf checks were very out of date.
* Add configure --with-pam to enable PAM authentication support.
Defaults to checking for PAM.
* Add configure --with-skey to enable S/Key authentication support.
Incompatible with --with-pam, defaults to no.
* Fix pathnames in the installed manual pages to contain
the appropriate $(prefix) substitution.
* Use fcntl(3) locking instead of flock(3) or lockf(3).
* Various other portability improvements.
stricter filtering to defeat some additional DNS attacks and support for
source address randomisation and optional capitalisation support. The
former can be configured when multiple public IPs are present, the
latter is considered experimental as a small number of servers doesn't
support it.
cc65 is a complete cross development package for 65(C)02 systems, including
a powerful macro assembler, a C compiler, linker, librarian and several
other tools.
LZMA Utils is a set of utilities for LZMA compression and decompression.
They aim to have an interface very similar to the well known gzip and
bzip2 utilities.
Change FTP backend to use passive mode by default and fallback to active
mode on syntax errors as discussed with and suggested by Luke Mewburn.
Retire 'p' now and introduce 'a' flag to get the old default behavior.
