1.1.6:
This version fixes a rekey timeout crash.
1.1.5:
This release fixes the KILL command and disconnection related
problems.
1.1.4:
This version fixes 64-bit alignment issues.
1.1.3:
This version fixes several crashes, a WATCH command busy-loop, QoS
rate limit handling, and many other bugs.
1.1.2:
This version fixes a possible buffer overflow.
1.1.1:
This version fixes a crash related to processing of NEW_CLIENT
packets.
1.1:
This version was ported to the new SILC Toolkit 1.1. Support for
dynamic router connections and HTTP statistics back end were added.
Support was added for the upcoming SILC Protocol version 1.3 and
SILC Public Key version 2. Other major bugfixes were also made.
1.1beta4:
This version fixes public key authentication as responder, OPER
and SILCOPER public key authentication, and other minor bugs.
1.1beta3:
This version fixes a CTR mode rekey crash and other CTR mode issues.
1.1beta2:
This beta release fixes many crash bugs.
the owner of all installed files is a non-root user. This change
affects most packages that require special users or groups by making
them use the specified unprivileged user and group instead.
(1) Add two new variables PKG_GROUPS_VARS and PKG_USERS_VARS to
unprivileged.mk. These two variables are lists of other bmake
variables that define package-specific users and groups. Packages
that have user-settable variables for users and groups, e.g. apache
and APACHE_{USER,GROUP}, courier-mta and COURIER_{USER,GROUP},
etc., should list these variables in PKG_USERS_VARS and PKG_GROUPS_VARS
so that unprivileged.mk can know to set them to ${UNPRIVILEGED_USER}
and ${UNPRIVILEGED_GROUP}.
(2) Modify packages to use PKG_GROUPS_VARS and PKG_USERS_VARS.
Changes:
This release fixes a small problem with parsing the 1.3 protocol version
string correctly. Clients that conform to the 1.3 protocol will not be
able to connect to a SILC server that isn't running this version.
Changes:
- Fixed a denial of service vulnerability: If invalid hmac or cipher
was specified on joining a channel, server crashed.
Upgrading is recommended.
set OVERRIDE_DIRDEPTH to find any libtool scripts deeper in the WRKSRC
tree unless they're named something other than "libtool".
SHLIBTOOL_OVERRIDE generally doesn't need to be specified either -- just
define it to the empty list and shlibtool-override will look for libtool
scripts.
INSTALL/DEINSTALL script creation within pkgsrc.
If an INSTALL or DEINSTALL script is found in the package directory,
it is automatically used as a template for the pkginstall-generated
scripts. If instead, they should be used simply as the full scripts,
then the package Makefile should set INSTALL_SRC or DEINSTALL_SRC
explicitly, e.g.:
INSTALL_SRC= ${PKGDIR}/INSTALL
DEINSTALL_SRC= # emtpy
As part of the restructuring of the pkginstall framework internals,
we now *always* generate temporary INSTALL or DEINSTALL scripts. By
comparing these temporary scripts with minimal INSTALL/DEINSTALL
scripts formed from only the base templates, we determine whether or
not the INSTALL/DEINSTALL scripts are actually needed by the package
(see the generate-install-scripts target in bsd.pkginstall.mk).
In addition, more variables in the framework have been made private.
The *_EXTRA_TMPL variables have been renamed to *_TEMPLATE, which are
more sensible names given the very few exported variables in this
framework. The only public variables relating to the templates are:
INSTALL_SRC INSTALL_TEMPLATE
DEINSTALL_SRC DEINSTALL_TEMPLATE
HEADER_TEMPLATE
The packages in pkgsrc have been modified to reflect the changes in
the pkginstall framework.
- fix insecure file creation in /tmp, patch from silc cvs
the impact of this issue is very low. it allows an attacker to overwrite
arbitrary files owned by the user running silcd ("silcd", in pkgsrc) IFF
the owner of the process or root send SIGUSR1 signal to the process to dump
stats. the only file owned by the "silcd" user is typically the log file
which resides in a directory inaccessible by anyone except the user itself
and root so the potential attacker would need to guess its name.
http://www.zataz.net/adviso/silc-server-toolkit-06152005.txt
please note that the advisory also incorrectly states that silc-toolkit is
vulnerable too. the code in question is never compiled in the toolkit so
it's not affected.
Bump PKGREVISION.
backslashes anymore. A single backslash is enough. Changed the
definition in all affected packages. For those that are not caught, an
additional check is placed into bsd.pkginstall.mk.
Changes:
1.0:
====
Only minor bugfixes were made to the previous version.
- Fixed channel public key list saving on backup router on JOIN
command reply.
- New optimized logging.
0.9.21:
=======
A small bugfix release.
- Added default limit how many channels one client can join (50).
- Added missing getopt.[ch].
- Fixed compilation with pkg-config files
0.9.20:
=======
A bugfix release to the SILC Server. In addition of various bugfixes,
this version now also includes new math library that from now on will be
included in all SILC distributions.
- Added more liberal channel names from the previous more stricter
identifier string change.
- Added SERVICE command to server, though services aren't supported yet.
- Fixed MOTD command to send empty reply if motd does not exist.
- Fixed LIST command.
- Fixed query to stop if client goes away.
- Added pkg-config check to the configure.
- Several other bugfixes were made.
And always is defined as share/examples/rc.d
which was the default before.
This rc.d scripts are not automatically added to PLISTs now also.
So add to each corresponding PLIST as required.
This was discussed on tech-pkg in late January and late April.
Todo: remove the RCD_SCRIPTS_EXAMPLEDIR uses in MESSAGES and elsewhere
and remove the RCD_SCRIPTS_EXAMPLEDIR itself.
Changes:
- convert to options.mk
0.9.19p1:
=========
A little update with this 0.9.19p1. After such a major release problems
were expected and the p1 fixes some crashes. Upgrade strongly
recommended.
0.9.19:
=======
And after a long break new SILC Server is out. This version finalizes the
SILC protocol version 1.2 development and introduces UTF-8 nicknames, channel
names, usernames and host names. It is now possible to create practically any
kind of nicknames and channel names. Practically all letters, numbers and
punctuation marks are supported. Special characters, control characters and
various odd symbol characters however are not allowed. Several minor and
major bugs has been fixed as well. Upgrading is strongly recommended. Old
clients that does not yet support UTF-8 encoded nicknames and channel names
are still able to connect and function normally as long as they do not need
to handle odd UTF-8 encoded names.
- Added support for UTF-8 encoded identifier strings, such as nicknames
and channel names.
- Fixed founder mode handling on JOIN on normal/backup on empty
channels.
- Fixed WATCH command handling on backup router.
- Fixed WATCH command announcing. The WATCH and SILC Gaim buddy list
should work better now.
- Simplified INVITE and BAN string handling in server. Announcing
INVITE and BAN strings should work more reliably now.
- Fixed several bugs from the backup and resuming protocol.
- Fixed, hopefully, all the wrong server statistics numbers.
- Fixed CLOSE command to handle backup routers correctly.
- Fixed various detaching and resuming bugs.
- Fixed announcing to not announce unregistered (ghost) clients.
- Fixed reconnect_keep_trying and QoS settings in server config files.
- Several other bugfixes were made.
under share/examples/rc.d. The variable name already was named
RCD_SCRIPTS_EXAMPLEDIR.
This is from ideas from Greg Woods and others.
Also bumped PKGREVISION for all packages using RCD_SCRIPTS mechanism
(as requested by wiz).
in the process. (More information on tech-pkg.)
Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and
installing .la files.
Bump PKGREVISION (only) of all packages depending directly on the above
via a buildlink3 include.
All library names listed by *.la files no longer need to be listed
in the PLIST, e.g., instead of:
lib/libfoo.a
lib/libfoo.la
lib/libfoo.so
lib/libfoo.so.0
lib/libfoo.so.0.1
one simply needs:
lib/libfoo.la
and bsd.pkg.mk will automatically ensure that the additional library
names are listed in the installed package +CONTENTS file.
Also make LIBTOOLIZE_PLIST default to "yes".
the RCD_SCRIPTS rc.d script(s) to the PLIST.
This GENERATE_PLIST idea is part of Greg A. Woods'
PR #22954.
This helps when the RC_SCRIPTS are installed to
a different ${RCD_SCRIPTS_EXAMPLEDIR}. (Later,
the default RCD_SCRIPTS_EXAMPLEDIR will be changed
to be more clear that they are the examples.)
These patches also remove the etc/rc.d/ scripts from PLISTs
(of packages that use RCD_SCRIPTS). (This also removes
now unused references from openssh* makefiles. Note that
qmail package has not been changed yet.)
I have been doing automatic PLIST registration for RC_SCRIPTS
for over a year. Not all of these packages have been tested,
but many have been tested and used.
Somethings maybe to do:
- a few packages still manually install the rc.d scripts to
hard-coded etc/rc.d. These need to be fixed.
- maybe remove from mk/${OPSYS}.pkg.dist mtree specifications too.
Changes:
0.9.18:
=======
Upgrade release because of couple serious bugs in the 0.9.17. Especially
backup router had stability problems with 0.9.17. This was due to a rekey bug
when performing rekey with PFS, and because of another bug it caused the
backup (and other servers too) to crash. If you are running a normal server
or backup router then ugprading is strongly recommended. If you are running
any kind of server with PFS enabled in rekey, upgrading is recommended.
- Fixed protocol completion handling in connection closing.
- Fixed rekey with PFS to work on backup with disabled connections.
- Fixed CMODE command reply to return the user limit correctly.
- Fixed the watch notify to be called for resuming clients.
0.9.17:
=======
- Implemented the user limit to the CMODE_CHANGE notify and to the CMODE
and JOIN command replies, as defined in the new protocol specs.
- Implemented the public key support to WATCH command, as defined in
the new protocol specs.
- Added asynchronous connecting to remote router/server.
- Fixed the WHOIS public key deleting.
- Several other bugfixes were also made.
Some pkgsrc things
- Fix PLISTs for packages that use -release
- Include canonicalisation of a couple of paths for the benefit
of qt3-*
- the normal version=sunos patching
- fix all library_names_spec for the standard set of symlinks
The libtool things some of which had already made it into pkgsrc libtool.
New in 1.5.2: 2004-01-25; CVS version 1.5.0a, Libtool team:
* lt_dlrealloc is an official part of the libltdl API.
* --tag, --silent and --debug options are preserved and reused when libtool
calls itself for relinking etc.
* `-pthread' and similar options are honoured when linking shared libraries.
* -no-suppress in compile mode shows compiler output for both PIC and non-PIC
object compilation.
* New link mode option `-precious-files-regex' to prevent accidental removal
of files you want to keep, such as test coverage data, from the temporary
output directory.
* Directories specified in /etc/ld.so.conf are no longer hardcoded on Linux.
* Recognises the 'R' symbol type on Solaris so read-only symbols can be
exported.
* Bug fixes.
New in 1.5: 2003-04-14; CVS version 1.4e, Libtool team:
* First stable release of multi-language architecture.
* libtool and libltdl support for Mac OS/X.
* libltdl will now use cygwins dlopen API instead of always forcing
LoadLibrary.
* Support auto-import patch to binutils on cygwin for much improved dll
support.
* Bug fixes.
New in 1.4.3: 2002-10-13; CVS version 1.4.2a, Robert Boehne:
* The libltdl subdirectory now bootstraps correctly with Automake 1.5.
* srcdir != builddir builds with Automake 1.5 work correctly.
* Support for mips-compaq-nonstopux.
* New command line argument, --preserve-dup-deps prevents removal of
duplicate dependent libraries.
New in 1.4d: 2002-01-07; CVS version 1.4c, Libtool team:
* Help strings display correctly again.
* Better error messages when library linking fails.
* Better error messages from libltdl when loading fails.
* Better search path management in libltdl with `lt_dlinsertsearchdir' call.
* Support /lib/w32api in recent cygwin releases.
* Support cross compilation to mingw.
* Support for .rc files (Windows resource compiler).
* Improved handling of mingw gcc.
* Improved handling of $PATH with entries containing spaces.
* Improved support for linking with gcc on aix4* and aix5*.
* Improved support for GCC 3.0.
* Initial support for QNX RTOS, UnixWare 7 and OpenUNIX 8.
* Bug fixes to the OpenBSD port.
* Bug fixes.
New in 1.4.2: 2001-09-11; CVS version 1.4.1a, Gary V. Vaughan:
* libltdl now builds on solaris again
* diagnose and warn about not-quite-working combinations of gcc and
ld on solaris.
* Improved OpenBSD support.
* Improved cygwin support.
* Bugfixes.
New in 1.4.1: 2001-09-03; CVS version 1.4.0a, Libtool team:
* Better error messages from libltdl when loading fails.
* Don't leave here-doc files behind.
* Improved support for OpenBSD.
* Libtool will build with autoconf-2.50 and higher.
* Plug memory management bugs in libltdl.
* Prefer shl_load to dlopen for better operation on HP-UX.
New in 1.4b: 2001-07-09; CVS version 1.4a, Libtool team:
* Now bootstraps with autoconf-2.50 and automake-1.4-p4.
* Always try to build at least a static lib, even if both static and
shared libs were disabled.
* Full support for C++ compiler.
* Support for GNU gcj compiler.
* libltdl can now load all modules in a given path according to user
supplied criteria with `lt_dlforeachfile' call.
* Improved support for AIX ia64, djgpp, HPUX, hurd, OpenBSD, sco3.2*.
* Internal mutex handling no longer has namespace clashes on NCR MP-RAS.
* New pdemo and tagdemo tests.
* Bug fixes.
Changes:
- Added public key based search support to WHOIS command. Users can be
searched by their public key now. To search users by public key using
SILC Client, do the following (see the /HELP WHOIS for revised help
information on searching by public key):
To search nickname 'nick' that has the specified public key, give:
/WHOIS nick -pubkey /path/to/the/public_key.pub
To search all usesr that has the specified public key, give:
/WHOIS -pubkey /path/to/the/public_key.pub
- Removed RC6 cipher.
- Fixed the MOTD command to work properly. Motds can now be fetched from
remote servers.
- Fixed the INVITE string handling during joining to use correct server
name. Invite strings such as *@sauna.silcnet.org!*@*foobar.com now
works.
- Fixed the CUMODE for founder mode work correctly when there is already a
founder on channel. Normal server cannot anymore "replace" a founder
which is founder on router (even if authentication works). User on
router can "replace" founder that is on normal server assuming
authentication is successful.
- Fixed UMODE mode change bug when anonymous mode was already set. Now
modes can be changed normally.
- Minor fixes to backup router protocol. Some problems may still exist
and testing this feature is recommended.
- Improvements to router-to-router connections. Normal communication
should work. NOTE: This is experimental and you can expect problems
if you set up such network.
- Several other bugfixes.
This release focuses especially fixing the remaining MAC failed errors that
people have been experiencing and the infamous Error in select() error which
should now finally be gone. Upgrading is strongly recommended.
Changes:
- Fixed KICK command to not send the command reply twice.
- Fixed the QoS unregistering to avoid the errors in select() for invalid
socket connection.
- Fixed the rekey protocol timeout handling
- Fixed the packet processing to avoid clearing QoS data underneath the QoS.
This version is a major upgrade release and everyone running older version is
strongly recommended to upgrade to this version. This version introduces
several bugfixes, security fixes and bunch of new features. This also
completes the development work for the SILC protocol version 1.2.
Changes:
- removed patch-ac, merged into distribution
- create server keys with strict permissions
0.9.14:
=======
- Several bugfixes and security fixes were made. A major remote exploit
was also fixed.
- The SILC Server now ignores SIGXFSZ and SIGXCPU signals which will
terminate the process if they occur. They can occur in poorly
configured environment.
- Fixed SERVER_SIGNOFF notify handling which caused ghosts to remain in
the network.
- Fixed inviting and banning by public key. Fixed invite and ban string
handling. Implemented SILC 1.2 complying invite and ban data
distribution between routers and servers. To also comply with SILC 1.2,
prohibited using '@' and '!' characters in invite and ban strings.
- Support for channel public keys added. A new feature in SILC 1.2, that
allows join authentication using digital signatures. Use the latest
SILC Client to take advantage of this feature.
- Support for SILC 1.2 backup protocol. This version introduces rewritten
version of the backup router protocol. The purpose of the backup router
protocol is to prevent servers from splitting from the rest of the SILC
network if the primary router becomes unresponsive. There are no
changes to the configuration of the backup router support, and old
configurations will work with this version too.
This version is now able to detect much better different network failure
situations and understand how to work with them. The servers are now
able to actually detect when the backup router can/must be used. They
are also able, in case of error in backup router protocol, to resume
back to either to the backup router or to the primary router, and always
recover from desyncs automatically (usually within 60 seconds).
- Support for command reply error arguments was added. This allows
clients to better handle error conditions within command execution.
- The founder public key distribution now complies with the SILC 1.2.
USE_PKGINSTALL is "YES". bsd.pkg.install.mk will no longer automatically
pick up a INSTALL/DEINSTALL script in the package directory and assume that
you want it for the corresponding *_EXTRA_TMPL variable.
Changes:
- Fixed EOF handling in SILC Config.
- Do not send full INVITE and BAN lists in INVITE and BAN
notifys, only the changed information.
- Fixed INVITE notify sending in INVITE command, send it
only when needed.
- Handle the founder key change properly in CMODE_CHANGE
notify. Bug #122.
- Remove the mark for output (mark it only for input) after
purging outgoing queue. Prevents the "Error in select()"
floods.
- Check server private key file permissions before starting
the server.
- NULL terminate allocated string in silc_buffer_strformat.
- Rewrote the invite/ban list string handling in server to
use SilcBuffer instead.
- Fixed double free in CMODE command when setting new HMAC
for channel.
- Added couple of missing memset's to zero sensitive memory.
have it be automatically included by bsd.pkg.mk if USE_PKGINSTALL is set
to "YES". This enforces the requirement that bsd.pkg.install.mk be
included at the end of a package Makefile. Idea suggested by Julio M.
Merino Vidal <jmmv at menta.net>.
- use SHLIBTOOL_OVERRIDE instead of LIBTOOL_OVERRIDE, the ugly
static libraries hack is now gone.
Changes from 0.9.11 to 0.9.12
=============================
* Added macros SILC_SWAB_[16|32] to swab byte order of
16-bit and 32-bit unsigned integers.
* Use the SILC_SWAB_16 instead of htons() in server when
handling ports since the ports in structures are always
in little-endian order (regardless of platform).
* Send DISCONNECT in close admin command in server.
* Check whether we are already connecting to a remote router
(in addition of checking whether we are already connected)
before creating new connection.
* Check that socket is valid after QoS is applied to data.
* Make sure the socket connecetion is not closed to early
when closing connection in server. Also make sure the
connection is always closed after error in a protocol.
* Fixed server crash with double Primary block in config file.
* Fixed various memory leaks around the config file parser.
* Fixed a double free in INVITE command error handling in
server.
IMPORTANT NOTE: This version does not include backwards support
for the old style SILC private key so if you
skipped 0.9.10 version you won't be able to run
this server without generating new key pair.
Changes from 0.9.10 to 0.9.11
=============================
* Workaround GCC bug which causes memory exhaustion when
compiling sha1 with optimizations on UltraSPARC. from openbsd
* Added some sanity checks in server for correctness of the
server configuration.
* More log printing during backup router protocol.
* Removed backwards support for old private key file format.
* Removed backwards support for not-so-strict decryption length
check, it's strict now.
* Fixed error handling of invalid client entry when calling
commands in server. Fixes a crash.
* Fixed double free in async host lookup code.
* On backup router handle now the SERVER_SIGNOFF from router
for local connected servers too, and close the connections.
Do not process them as normally signing off servers when they
really signoff by sending EOF fe, but always assume that
router sends the SERVER_SIGNOFF.
* Fixed socket unsetting when closing connections.
* Fixed close command to use the port correctly when closing
server connections.
* Check for NULL outbuf in silc_socket_write. It is possible
that it is NULL is some odd case.
* Do not call final protocol callback for backup router
resuming protocol when closing connection. It is closed
by timeout in case of error.
* Backup reconnect to router if backup resuming protocol failed.
* Fixed double free in SKE library error hadling when signature
error occurred.
* Fixed double free in invite list adding code when adding
invite strings.
The private key file format has changed due to a bug in the
older code. When you run this server version it automatically
changes your private key file to the correct format.
The future versions of the SILC Server will not do that, so
do not skip this version or you will need to generate new key
pair after 0.9.11 is released.
Also backup router bugs was fixed which caused several
interesting decryption problems, so upgrading regardless
if you are runinng normal server, backup router or primary
router is strongly recommended.
Changes from 0.9.9.1 to 0.9.10
==============================
* Added the config directive PublicKeyDir for the client
block.
* Extended the SILC_SERVER_LOG_ERROR macro to all available
logging channels.
* Load only files with .pub suffix in PublicKeyDir.
* Fixed a typo in resuming code that fixed detach/resume
code in server.
* Fixed CMODE setting in server when founder mode was set.
* Fixed wrong invite and ban list handling in server command
reply.
* Fixed CUMODE founder authentication in server to not check
for client's public key since it's not supposed to do that.
* Fixed backup router bugs: When backup resumes router and
receives a CHANNEL_MESSAGE packet the backup must not act
as router since the packet header decryption would be
different. Also, when relaying packets to channel, do not
re-encrypt packets on backup that came from the primary
since the connection isn't really router-router connection.
