Collection.
The Perl 5 module Net::MAC allows you to
- store a MAC address in a Perl object
- find out information about a stored MAC address
- convert a MAC address into a specified format
- easily compare two MAC addresses for string or numeric equality
- Security-related bugs in the Bluetooth ACL, Bluetooth RFCOMM, PRP, Q.931,
MATE, and USB dissectors, as well as the Tammos CommView file parser have
been fixed.
- Many other bugs have been fixed.
This update addresses the security vulnerabilies reported
in wnpa-sec-2008-06.
to trigger/signal a rebuild for the transition 5.8.8 -> 5.10.0.
The list of packages is computed by finding all packages which end
up having either of PERL5_USE_PACKLIST, BUILDLINK_API_DEPENDS.perl,
or PERL5_PACKLIST defined in their make setup (tested via
"make show-vars VARNAMES=...").
Version 1.0.2
(October 14 2008, from branches/release/1.0.x)
svn://svn.gna.org/svn/clive/tags/1.0.2
User-visible changes:
* Added --hosts to list supported hosts
* Removed myvideo support (broken)
Developer-visible changes:
* Fixed googlevideo support, extraction would fail for some videos
* Fixed "AttributeError: 'builtin_function_or_method' object has no
attribute 'write'" (partially related to bug #12290)
* Added embedded link support for metacafe
- Thanks to Kai Wasserbach <debian@carbon-project.org> for the fix
* Updated AUTHORS and HACKING file
* Fixed man files with some syntax problems (bug #12266)
- Thanks to Marco Rodrigues <gothicx@sapo.pt> for the fixes
Bump ABI depends because of shlib major bump.
--- 3.0.36 2008/09/26
Various ODR chapter fixes.
Windows version uses libxml2 2.6.32+, libxslt 1.1.23+ and ICU 4.0.
Added missing source for Windows compilation, mutex.c.
Fixed compilation of YAZ for Visual Studio 2008. Bug #2256.
For SRU connections in ZOOM all records up to "count" are now fetched.
Fixed crash in generic frontend server (and yaz-ztest) which occurred
in Windows due to bad error handling for Libxml2.
Added facility for sending arbitrary records (ASN.1 any) using
ZOOM C's Extended service update. Patch by Sam Reynolds.
New options for ZOOM C's connection, logapdu which makes ZOOM log
APDUs.
--- 3.0.34 2008/06/18
YAZ uses GNU TLS without the OpenSSL compatibility wrapper.
--- 3.0.32 2008/06/12
Fixed memory violation that could occur when decoding UTF-8. This bug
was only present in 3.0.30 of YAZ.
--- 3.0.30 2008/06/06
Implemented SSL sockets using GNU TLS. OpenSSL is still supported, but
GNU TLS is used by default (if found).
yaz-ztest returns OPAC records if a client asks for OPAC.
Improved speed of MARC-8 encoding.
Added support for lossy and loss-less MARC-8 encoding.
Changed yaz_record_conv_record to be reentrant for XSLT conversions.
Added new Windows Service wrapper (sc).
yaz-client's itemorder command may now send a file.
Fixed yaz-marcdump to allow the use of NS prefix for record element.
Added new function yaz_log_xml_errors.
Allow (but warn) unknown XML attributes in MARCXML parsing.
Handle G1 sequneces in MARC-8 decoding. Bug #2115.
The UTF-8 to MARC-8 conversion now uses a different set of characters
for Greek symbols. Bug #2120.
--- 3.0.26 2008/02/21
Added yaz_daemon (daemon.h).
Fixed bug #2068: pkg-config trouble
Fixed bug #395: ZOOM_record / OPAC record encoding problems.
--- 3.0.24 2008/01/28
Document --with-xml2 option.
Added OPAC XML XSD (etc/opacxml.xsd).
Allow glob mask for name attribute in retrieval element for the
generic frontend server's retrieval facility.
Changed yaz_poll_poll to return yaz_poll_except for all returned events
except POLLIN/POLLOUT.
Fixed error handling in cs_listen. Bug #2037.
--- 3.0.22 2008/01/20
Fixed version in yaz/yaz-version.h.
Fixed bug #2027: Crash when closing connection.
Changed configure so that ICU support is only enabled if only ICU
and Libxml2 is available (because the ICU chain is XML based).
--- 3.0.20 2008/01/15
YAZ now makes ICU utilities for Windows. A separate DLL, yaz_icu3.dll,
is built. Only this DLL depends on the ICU runtime.
yaz-ziffy is no longer part of YAZ. It is distributed separately by
Index Data because ziffy's license is GPL2 rather then 'Revised BSD'.
Changed license of CCL module to 'Revised BSD'. After consultation with
remaining members of the original EUROPAGATE consortium, we are re-issuing
the CCL module without a separate license. The software was developed by
Index Data as part of a research project. The special license was included
to help feed usage information back to the project consortium to support
project evaluation. At this time, the project consortium has long-since
disbanded, and the majority of the original principals have retired. At the
same time, we have significantly modified the software during the following
years, to the point where very practically no original code remains. To
simplify re-use of the software, we have contacted those members of the
consortium who could be reached, and agreed to re-issue the module as a
proper part of the YAZ package.
Tcl scripts uses /usr/bin/tclsh as preferred shell.
CQL closer to being version 1.2 compliant. CQL also allows free-form
terms, such as 'title=a b', and thus, make the CQL parser more CCL-like
and user-frendly.
Fixed bug in ZOOM_options_getl WRT setting of parameter lenp. This
bug could make Extended services handling crash in the ZOOM layer. This
bug was only present in YAZ 3.0.18.
--- 3.0.18 2007/12/19
ziffy uses YAZ' options rather than getopt; getopt is unavailable on
some systems.
yaz-marcdump reads and writes collection wrapped records.
Handle OPAC for record conversion module.
Fixes for ICU wrapper.
Allow ICU libs to be controlled with --with-icu .
--- 3.0.16 2007/11/12
Added yaz_poll which is a wrapper for select/poll. When poll is available
and non-buggy, it is used, by yaz_poll . This allows more than 1024
sockets to be in use.
Added ICU wrapper library which exposes ICU http://www.icu-project.org/
functionality through an XML based configuration (ICU chain). This system
is useful for search facilities such as Pazpar2 and Zebra that needs to
perform tokenization of indexed material. The ICU code in a separate
library libyaz3_icu.a.
Added HTTP tunnel facility for COMSTACK, bug #1752.
This is a facility that allows a Web proxy, such as squid, to tunnel
Z39.50 traffic. This facility is "transparent" to must applications
using YAZ. It's enabled by using pseudo transport connect: followed by
the proxy address, followed by command, then follwed by he regular
"virtual" addresss. For example,
connect:webproxy.com:3128,tcp:z3950.loc.gov:7090/voyager .
More MARC-8/UTF-8 conversion fixes. Bugs #1666, #1667, #1778.
--- 3.0.14 2007/09/21
Fixed bad memory reference in ZOOM_record - cuased by member not being
initialized. This was a problem only in YAZ 3.0.12.
Fixed bug in conversion from MARC to XML: Non-XML characters in control
fields were not removed.
Changed the way C code is generated from codetables.xml. Made a MARC-8
conversion trie for each characterSet section rather than codeTable.
This is ensure the code can deal with G0/G1 sequences. Use of a newer version
of codetables.xml from Larry Dixson, LOC. Bug #1464.
--- 3.0.12 2007/09/12
ZOOM C now handles SRU surrogate diagnostics (i.e. errors returned
from ZOOM_record_error).
ZOOM C function ZOOM_record_get returns record schema for type="schema".
Implemented HTTP Basic authentication to SRU/GET, SRU/POST and SRW requests.
Added new ZOOM C connection option 'sru_option' which specifies SRU version.
Better SRW-to-Bib-1 diagnostic mapping.
ZOOM C and yaz-client announces SRU version 1.2 by default.
yaz-client 'sru' command may specifiy both SRU version and transport (SOAP,
GET or POST).
Fixed in yaz_sru_decode to allow other version than 1.1.
--- 3.0.10 2007/08/22
Added support for SRU scan for ZOOM.
Added support for the use of the older versions or Extended Service
Update in ZOOM. To faciliate this, an option "updateVersion" may be
set to the version , 1=first, 2=second, 3=third. The third version is
what ZOOM C has used so far. And that, obviously, is the default.
Added support for CCL queries in Z39.50 queries sent to the GFS (and
therefore in Zebra and in SimpleServer-based applications). The new
<ccl2rpn> element in a GFS configuration file, if present, names a CCL
qualifier file used to transform incoming CCL queries into Type-1 RPN,
which is passed into the back-end search callback function.
Added support for HTTP Basic authentication in clients: the SRU/W
codec encodes the username/password elements of the PDU structure
appropriately, and these may be set using the "user" and "password"
options in ZOOM-C applications (the same options that are used for
Z39.50 authentication).
--- 3.0.8 2007/06/25
Fixed bug #1208: SSL appears to be broken in ZOOM.
Fixed bug #1206: Libxml2 include path weirdness.
Added oid_name_to_dotstring.
Allow elementSetName to be specified for ZOOM C record update.
Allow waitAction to be specified for ZOOM C based for Extended Services.
Fixed NULL ptr reference bug in yaz-ztest - caused by omitted record
syntax OID. Bug introduced in YAZ 3 series.
Updated WIN32 build to include Libxml2 2.6.28 / Libxslt 1.1.19.
--- 3.0.6 2007/06/06
Fixed bug #1157: yaz-client does not read .yazclientrc from current
directory. yaz-client now reads commands from file given by option -f
if specified; then tries to read .yazclientrc in current directory.
Failing that, it reads .yazclientrc from user's home directory.
Added support for correlationInfo Note and ID for Record Update via
ZOOM C.
Added yaz-client command querycharset which specifies character set for
query terms for Z39.50 RPN queries and Z39.50 Scan Requests
(termListAndStartPoint).
Charset ISO5428:1984 is an alias for ISO5428-1984.
Implemented a way to perform scan in a result set using Z39.50. This
is achieved by attaching the result set name in the characterInfo
(type InternationalString) of OtherInformation in the Scan Request PDU.
The result set is identified in the otherinformation by the new OID:
USERINFO, Z3950_PREFIX.10.1000.81.4, "Scan-Set
This allows for scan in result set and faceted search . Zebra did some
of this in the APT term using attribute type 8 and value being result
set. Using the OtherInformation approach for this is cleaner and easier
to work with in proxies and the like. This facility can be used in
yaz-client using new command setscan which takes a result set as first
argument, start position (APT) as second.
Changed decoding of SRU XML packed records to deal with servers that
have recordData with XML data with multiple root nodes. Also make
comparison for recordPacking case insensitive. Again, one server
returns "XML" where others return "xml".
For SRU responses allow Content-Type application/xml as well as text/xml.
--- 3.0.4 2007/05/21
Fixed bug in character set conversion of BER strings. Bug introduced
in 3.0.0.
--- 3.0.2 2007/05/08
For OIDs use Odr_oid type everywhere, i.e. do not assume Odr_oid=int.
For OID class, use oid_class consistently.
Fixed external handling for SUTRS and Explain records (bug appeared in 3.0
series).
Added partial support for ISO5428-1984, which is the "Greek alphabet coded
character set for bibliographic information interchange". By Giannis Kosmas.
Added documentation on new OID API.
--- 3.0.0 2007/05/02
Changes to generic frontend server interface: added new member
'query_charset' for bend_initrequest structure. A backend init handler
should set this member to its native character set for query terms.
When defined, the frontend server logic will announce this character set
to a client if the negotiationModel bit is set by the client. All server
implementors are encouraged to specify this. If a backend server does not
specify this a warning is issued using yaz_log(YLOG_WARN,..).
Added CCL utility to remove terms (stop words) from resulting RPN
tree. This is handled by functions with prefix ccl_stop_words_ .
New ZOOM C option, "rpnCharset", which allows client-side conversion of
terms in RPN queries.
Clean-up the CCL API. Moved some internal structures from ccl.h to
private header cclp.h. Changed ccl_parser_create so that a Bibset must
be supplied. Removed tokenize API from ccl.h - including ccl_parser_find.
This is replaced by ccl_parser_find_str which takes a string instead.
Split YAZ library into two libs : libyaz.la and libyaz_server.la.
libyaz.la is the core of YAZ except the generic frontend server and
does not depend on POSIX threads anymore. libyaz_server.la is the
generic frontend server facilities and uses POSIX thread functionality
if available. The libyaz.la no longer depends on POSIX threads because
the number of global structures is limited. NMEM no longer re-uses blocks
between threads ; it simply free's memory immediately but allocates in
"large" chunks as usual. We don't expect any performance penalties
because of this. The yaz_log system is still using a global log_level so
caution must be taken when modifying it with yaz_log_init_.. +
yaz_log_mask_str. This, however, should not cause any trouble because
these functions are called during initialization of application code
anyway. `yaz-config --libs server` returns libs for server applications;
`yaz-config --libs` returns libs for non-server applications.
New OID database - with public definitions in oid_db.h. Removed old OID
database including the head oid.h and definitions such as enum oid_value
and struct oident. The new OID database uses the same string names as
before but the 'protocol' is gone. There are now only two representations
raw OID (int *) and string. Functions with prefix yaz_string_to_oid
converts from string to OID; functions with prefix yaz_oid_to_string
converts the other way.
Change to emit_term() in CQL-to-PQF query translation: when a term has
the /regexp relation modifier, do not process it for leading and
trailing "^" and "*", which have quite different meanings in regular
expressions.
Attempted fix of bug #976: Segfault in yaz_iconv. The yaz_iconv function
write handlers no longer carries a 'last' parameter. This will make
yaz_iconv flush "less" characters. A flush is performed by call to
yaz_iconv(cd, 0, 0, &outbut, &outbytesleft) .
Definition of wrbuf_diags moved to querytowrbuf.h. Function wrbuf_put_zquery
removed, because function yaz_query_to_wrbuf does the same.
API changes to WRBUF. wrbuf_free removed; replaced by wrbuf_destroy. And
wrbuf_puts no longer appends '\0'. Use wrbuf_cstr to get C-string out.
Deprecated MARC utility functions removed.
Changed prototype of yaz_marc_decode_buf: const char for result and size_t
for rsize.
Approved by MAINTAINER.
Pkgsrc changes: switched to the IO-Socket-INET6 distribution
tarball without changing the package name, mark as not
requiring any compiler.
Changes since last packaged version (2.01):
2008-10-06 Shlomi Fish <shlomif@iglu.org.il>
* Applied a modified version of a patch by Anicka Bernathova
<anicka@suse.cz>:
{{{
Previously IO-Socket-INET6 tried to bind even when one side
is AF_INET and the other AF_INET6 and this cannot work.
The FAMILY_CHECK loop is meant to make sure both sides have
the same family.
}}}
* New Release IO-Socket-INET6-2.56
2008-09-24 Shlomi Fish <shlomif@iglu.org.il>
* Fixed: http://rt.cpan.org/Ticket/Display.html?id=39550 :
Problem with connect to IPv4 w/o given domain on FreeBSD6.1 (and
other BSD systems). (Thanks to Steffen Ullrich)
* New Release IO-Socket-INET6-2.55
2008-02-22 Shlomi Fish <shlomif@iglu.org.il>
* Added pack_sockaddr_in6_all to the imports from Socket6 to fix
the "configure" sub in several cases. Added t/configure6.t to test it.
* New Release IO-Socket-INET6-2.54
2008-02-21 Shlomi Fish <shlomif@iglu.org.il>
* Converted to Build.PL and placed INET6.pm under lib/.
* Added a "repository" URL to the POD.
* Added the pod.t and pod-coverage.t files and we now have full POD
coverage.
* Added more dependencies to the Build.PL.
* Added the credit of "Shlomi Fish".
* Changed the email address of Rafael to the new one in the ChangeLog
and README files.
* Someone reported that sockflow() and peerflow() were broken. The reason
for that was that unpack_sockaddr_in6_all was not imported from Socket6.
This release fixes it (with tests in t/host6.t).
* New Release IO-Socket-INET6-2.53
2008-02-05 Shlomi Fish <shlomif@iglu.org.il>
* New Release IO-Socket-INET6-2.52
* Added a test for peerhost() too.
* Fixed sockhost() with the fact that inet_ntop() was not imported.
- Added a test.
* Added "use warnings" to IO::Socket::INET6.
* Added a modified version of my patch (with more comments) to patch
the problems I found in IO-Socket-INET6. (generating
warnings upon using and failed tests.).
2004-18-10 Rafael Martinez Torres <rmartine@fdi.ucm.es>
* New Release INET6-2.51 .
* Patch from David Town <David.Town@marconi.com>
- peeraddr(), sockaddr() methods implemented.
- peerhost(), peerport(), sockhost(), sockport() improved efficiency.
- New optional parameters: Local(Peer)Flow,Local(Peer)Scopeid. (Only for IPv6)
- Local hack for MSWin32 platforms.
Patches mainly from adam@ with some changes by me
05 September 2008 - Version 2.1.0 has been released.
The focus of this release is features.
Feature Improvements
* Clients may now be defined dynamically, based on IP address. See raddb/sites-available/dynamic-clients.
* SNMP support is now available through an experimental Perl script. See scripts/snmp-proxy/README
* SNMP statistics are also available through Status-Server packets. See raddb/sites-available/status
* Added more Microsoft attributes from bug #568.
* The linelog module has more functionality and flexibility. See raddb/modules/linelog.
* The debugging output has been sanitized. It should be much more readable.
* Debug logs can now be turned on/off while the server is running, for a user, group, realm, etc. See the log section of raddb/radiusd.conf.
* Added support for WiMAX Forum attributes. The dynamic keys are not yet calculated. See share/dictionary.wimax
* Added session resumption for PEAP and TTLS. See raddb/eap.conf, and the cache sub-section.
* Added radmin command-line tool for administering a running server. See man radmin and raddb/sites-available/control-socket.
Bug Fixes
* Double escaping of '\\' in the users (and some other) files has been fixed. If you have '\\' in the users file, your configuration will need to be checked, and fixed!
* Parse security section of radiusd.conf. This was accidentally deleted in 2.0.5. Closes bug #566.
* Bind to interface before IP, which allows DHCP sockets to listen on "*" for multiple interfaces.
* Fix handling of giaddr in DHCP responses.
* Corrected parsing of status_check in home_server so that it works.
* Fix hints so that "Puser" works again.
* Removed length restrictions on attribute names in the dictionaries.
* Update socket code to avoid C compiler optimizations.
25 September 2008 - Version 2.1.1 has been released.
The focus of this release is stability.
Feature Improvements
* Many more options and features are available via radmin. See man radmin and raddb/sites-available/control-socket.
* Many more commands available via the control socket. Connect via radmin, and type help for more information.
* Added dictionary.networkphysics and dictionary.lancom.
* Calculate WiMAX MIP keys, and added sample WiMAX SQL tables.
Bug Fixes
* Fixed bug that made radmin not work.
* Fixed Suse && Debian package scripts.
* Fixed issues with dynamic clients.
* Fixed configure checks for -lreadline
* rlm_sqlippool no longer needs to be linked to rlm_sql.
* Add statistics for detail file listeners. This closes bug #593.
* Fixed printing of some WiMAX attributes.
* Fixed double free on exit() in rlm_attr_filter.
* Fixed build issues on Solaris.
* Fixed fast session resumption for EAP-TLS.
ORBit2-2.14.16
- bug fixes
+ fix make check on Mac OS/X
+ The ORBNetID option was not consistent in relation to
ORBIIOPIPName. This fix ensures that ORBIIOPIPName always
takes precedence. (Jules Colding)
ORBit2-2.14.15
- bug fixes
+ fix some leaks (Jules Colding)
+ fix for Mike's recent fixes (Mike Gorse)
+ fix potential make loop (Diego Pettenò)
2008.10.07 -- Version 2.1_rc13
* Bundled OpenSSL 0.9.8i with Windows installer.
* Management interface can now listen on a unix
domain socket, for example:
management /tmp/openvpn unix
Also added management-client-user and management-client-group
directives to control which processes are allowed to connect
to the socket.
* Copyright change to OpenVPN Technologies, Inc.
2008.09.23 -- Version 2.1_rc12
* Patched Makefile.am so that the new t_cltsrv-down.sh script becomes
part of the tarball (Matthias Andree).
* Fixed --lladdr bug introduced in 2.1-rc9 where input validation code
was incorrectly expecting the lladdr parameter to be an IP address
when it is actually a MAC address (HoverHell).
2008.09.14 -- Version 2.1_rc11
* Fixed a bug that can cause SSL/TLS negotiations in UDP mode
to fail if UDP packets are dropped.
2008.09.10 -- Version 2.1_rc10
* Added "--server-bridge" (without parameters) to enable
DHCP proxy mode: Configure server mode for ethernet
bridging using a DHCP-proxy, where clients talk to the
OpenVPN server-side DHCP server to receive their IP address
allocation and DNS server addresses.
* Added "--route-gateway dhcp", to enable the extraction
of the gateway address from a DHCP negotiation with the
OpenVPN server-side LAN.
* Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns
on Windows. If the bypass IP address is 0.0.0.0 or 255.255.255.255,
ignore it.
* Warn when ethernet bridging that the IP address of the bridge adapter
is probably not the same address that the LAN adapter was set to
previously.
* When running as a server, warn if the LAN network address is
the all-popular 192.168.[0|1].x, since this condition commonly
leads to subnet conflicts down the road.
* Primarily on the client, check for subnet conflicts between
the local LAN and the VPN subnet.
* Added a 'netmask' parameter to get_default_gateway, to return
the netmask of the adapter containing the default gateway.
Only implemented on Windows so far. Other platforms will
return 255.255.255.0. Currently the netmask information is
only used to warn about subnet conflicts.
* Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO
and USE_SSL flags are enabled (Alon Bar-Lev).
* Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new
--script-security rules. Also adds retrying if the addresses are in
use (Matthias Andree).
* Fixed build issue with ./configure --disable-socks --disable-http.
* Fixed separate compile errors in options.c and ntlm.c that occur
on strict C compilers (such as old versions of gcc) that require
that C variable declarations occur at the start of a {} block,
not in the middle.
* Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which
the new implementation of extract_x509_field_ssl depends on.
* LZO compression buffer overflow errors will now invalidate
the packet rather than trigger a fatal assertion.
* Fixed minor compile issue in ntlm.c (mid-block declaration).
* Added --allow-pull-fqdn option which allows client to pull DNS names
from server (rather than only IP address) for --ifconfig, --route, and
--route-gateway. OpenVPN versions 2.1_rc7 and earlier allowed DNS names
for these options to be pulled and translated to IP addresses by default.
Now --allow-pull-fqdn will be explicitly required on the client to enable
DNS-name-to-IP-address translation of pulled options.
* 2.1_rc8 and earlier did implicit shell expansion on script
arguments since all scripts were called by system().
The security hardening changes made to 2.1_rc9 no longer
use system(), but rather use the safer execve or CreateProcess
system calls. The security hardening also introduced a
backward incompatibility with 2.1_rc8 and earlier in that
script parameters were no longer shell-expanded, so
for example:
client-connect "docc CLIENT-CONNECT"
would fail to work because execve would try to execute
a script called "docc CLIENT-CONNECT" instead of "docc"
with "CLIENT-CONNECT" as the first argument.
This patch fixes the issue, bringing the script argument
semantics back to pre 2.1_rc9 behavior in order to preserve
backward compatibility while still using execve or CreateProcess
to execute the script/executable.
* Modified ip_or_dns_addr_safe, which validates pulled DNS names,
to more closely conform to RFC 3696:
(1) DNS name length must not exceed 255 characters
(2) DNS name characters must be limited to alphanumeric,
dash ('-'), and dot ('.')
* Fixed bug in intra-session TLS key rollover that was introduced with
deferred authentication features in 2.1_rc8.
008.07.31 -- Version 2.1_rc9
* Security Fix -- affects non-Windows OpenVPN clients running
OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT
vulnerable nor are any versions of the OpenVPN server vulnerable).
An OpenVPN client connecting to a malicious or compromised
server could potentially receive an "lladdr" or "iproute" configuration
directive from the server which could cause arbitrary code execution on
the client. A successful attack requires that (a) the client has agreed
to allow the server to push configuration directives to it by including
"pull" or the macro "client" in its configuration file, (b) the client
succesfully authenticates the server, (c) the server is malicious or has
been compromised and is under the control of the attacker, and (d) the
client is running a non-Windows OS. Credit: David Wagner.
* Miscellaneous defensive programming changes to multiple
areas of the code. In particular, use of the system() call
for calling executables such as ifconfig, route, and
user-defined scripts has been completely revamped in favor
of execve() on unix and CreateProcess() on Windows.
* In Windows build, package a statically linked openssl.exe to work around
observed instabilities in the dynamic build since the migration to
OpenSSL 0.9.8h.
2008.06.11 -- Version 2.1_rc8
* Added client authentication and packet filtering capability
to management interface. In addition, allow OpenVPN plugins
to take advantage of deferred authentication and packet
filtering capability.
* Added support for client-side connection profiles.
* Fixed unbounded memory growth bug in environmental variable
code that could have caused long-running OpenVPN sessions
with many TLS renegotiations to incrementally
increase memory usage over time.
* Windows release now packages openssl-0.9.8h.
* Build system changes -- allow building on Windows using
autoconf/automake scripts (Alon Bar-Lev).
* Changes to Windows build system to make it easier to do
partial builds, with a reduced set of prerequisites,
where only a subset of OpenVPN installer
components are built. See ./domake-win comments.
* Cleanup IP address for persistence interfaces for tap and also
using ifconfig, gentoo#209055 (Alon Bar-Lev).
* Fall back to old version of extract_x509_field for OpenSSL 0.9.6.
* Clarified tcp-queue-limit man page entry (Matti Linnanvuori).
* Added new OpenVPN icon and installer graphic.
* Minor pkitool changes.
* Added --pkcs11-id-management option, which will cause OpenVPN to
query the management interface via the new NEED-STR asynchronous
notification query to get additional PKCS#11 options (Alon Bar-Lev).
* Added NEED-STR management interface asynchronous query and
"needstr" management interface command to respond to the query
(Alon Bar-Lev).
* Added Dragonfly BSD support (Francis-Gudin).
* Quote device names before passing to up/down script (Josh Cepek).
* Bracketed struct openvpn_pktinfo with #pragma pack(1) to
prevent structure padding from causing an incorrect length
to be returned by sizeof (struct openvpn_pktinfo) on 64-bit
platforms.
* On systems that support res_init, always call it
before calling gethostbyname to ensure that
resolver configuration state is current.
* Added NTLMv2 proxy support (Miroslav Zajic).
* Fixed an issue in extract_x509_field_ssl where the extraction
would fail on the first field of the subject name, such as
the common name in: /CN=foo/emailAddress=
foo@bar.comThis e-mail address is being protected from spambots. You need
JavaScript enabled to view it
* Made "Linux ip addr del failed" error nonfatal.
* Amplified --client-cert-not-required warning.
* Added #pragma pack to proto.h.
* Don't split large commands into multiple commands; just fail on them.
This prevents cross-site request forgery (CSRF)-like attacks,
when a web browser is used to access an ftp server.
* Enhance -C to support an optional @host ('-C user[@host]'):
checks whether user as connecting from host would be granted
access by ftpusers(5).
* Support IPv6 in the host directive of ftpusers(5).
* Implement -n to disable hostname lookups.
* Disable SOCKS support; I don't have the ability to test it,
and the autoconf checks were very out of date.
* Add configure --with-pam to enable PAM authentication support.
Defaults to checking for PAM.
* Add configure --with-skey to enable S/Key authentication support.
Incompatible with --with-pam, defaults to no.
* Fix pathnames in the installed manual pages to contain
the appropriate $(prefix) substitution.
* Use fcntl(3) locking instead of flock(3) or lockf(3).
* Various other portability improvements.
stricter filtering to defeat some additional DNS attacks and support for
source address randomisation and optional capitalisation support. The
former can be configured when multiple public IPs are present, the
latter is considered experimental as a small number of servers doesn't
support it.
Change FTP backend to use passive mode by default and fallback to active
mode on syntax errors as discussed with and suggested by Luke Mewburn.
Retire 'p' now and introduce 'a' flag to get the old default behavior.
Fix line buffering to not drop content after the line we are interested
in. This magically worked for a local tnftpd that was only sending a
normal one line return message due to the challenge response protocol
always having the desired size. With the patch fetch_read will process
the remaining part of the buffer and fetch_getln will remember how much
of the data it was actually interested in, so it will now process the
complete output again.
- only include openssl if the openssl option is present
- include arpa/inet.h to get ntohl and friends on older platforms like
Interix
- use new netdb.h compat code from libnbcompat
- include inttypes.h only when present
- don't name local variables err, Interix has a symbol like that in
default namespace
- allow fetch_read to do short read and do more intelligent buffering
for header processing; effectively don't do a system call for each
byte read
