diff options
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 164 |
1 files changed, 0 insertions, 164 deletions
@@ -1,170 +1,6 @@ OpenVPN Change Log Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <sales@openvpn.net> -2017.06.21 -- Version 2.4.3 -Antonio Quartulli (1): - Ignore auth-nocache for auth-user-pass if auth-token is pushed - -David Sommerseth (3): - crypto: Enable SHA256 fingerprint checking in --verify-hash - copyright: Update GPLv2 license texts - auth-token with auth-nocache fix broke --disable-crypto builds - -Emmanuel Deloget (8): - OpenSSL: don't use direct access to the internal of X509 - OpenSSL: don't use direct access to the internal of EVP_PKEY - OpenSSL: don't use direct access to the internal of RSA - OpenSSL: don't use direct access to the internal of DSA - OpenSSL: force meth->name as non-const when we free() it - OpenSSL: don't use direct access to the internal of EVP_MD_CTX - OpenSSL: don't use direct access to the internal of EVP_CIPHER_CTX - OpenSSL: don't use direct access to the internal of HMAC_CTX - -Gert Doering (6): - Fix NCP behaviour on TLS reconnect. - Remove erroneous limitation on max number of args for --plugin - Fix edge case with clients failing to set up cipher on empty PUSH_REPLY. - Fix potential 1-byte overread in TCP option parsing. - Fix remotely-triggerable ASSERT() on malformed IPv6 packet. - Update Changes.rst with relevant info for 2.4.3 release. - -Guido Vranken (6): - refactor my_strupr - Fix 2 memory leaks in proxy authentication routine - Fix memory leak in add_option() for option 'connection' - Ensure option array p[] is always NULL-terminated - Fix a null-pointer dereference in establish_http_proxy_passthru() - Prevent two kinds of stack buffer OOB reads and a crash for invalid input data - -Jérémie Courrèges-Anglas (2): - Fix an unaligned access on OpenBSD/sparc64 - Missing include for socket-flags TCP_NODELAY on OpenBSD - -Matthias Andree (1): - Make openvpn-plugin.h self-contained again. - -Selva Nair (1): - Pass correct buffer size to GetModuleFileNameW() - -Steffan Karger (11): - Log the negotiated (NCP) cipher - Avoid a 1 byte overcopy in x509_get_subject (ssl_verify_openssl.c) - Skip tls-crypt unit tests if required crypto mode not supported - openssl: fix overflow check for long --tls-cipher option - Add a DSA test key/cert pair to sample-keys - Fix mbedtls fingerprint calculation - mbedtls: fix --x509-track post-authentication remote DoS (CVE-2017-7522) - mbedtls: require C-string compatible types for --x509-username-field - Fix remote-triggerable memory leaks (CVE-2017-7521) - Restrict --x509-alt-username extension types - Fix potential double-free in --x509-alt-username (CVE-2017-7521) - -Steven McDonald (1): - Fix gateway detection with OpenBSD routing domains - - -2017.05.11 -- Version 2.4.2 -David Sommerseth (5): - auth-token: Ensure tokens are always wiped on de-auth - docs: Fixed man-page warnings discoverd by rpmlint - Make --cipher/--auth none more explicit on the risks - plugin: Fix documentation typo for type_mask - plugin: Export secure_memzero() to plug-ins - -Hristo Venev (1): - Fix extract_x509_field_ssl for external objects, v2 - -Selva Nair (1): - In auth-pam plugin clear the password after use - -Steffan Karger (10): - cleanup: merge packet_id_alloc_outgoing() into packet_id_write() - Don't run packet_id unit tests for --disable-crypto builds - Fix Changes.rst layout - Fix memory leak in x509_verify_cert_ku() - mbedtls: correctly check return value in pkcs11_certificate_dn() - Restore pre-NCP frame parameters for new sessions - Always clear username/password from memory on error - Document tls-crypt security considerations in man page - Don't assert out on receiving too-large control packets (CVE-2017-7478) - Drop packets instead of assert out if packet id rolls over (CVE-2017-7479) - -ValdikSS (1): - Set a low interface metric for tap adapter when block-outside-dns is in use - -2017.03.21 -- Version 2.4.1 -Antonio Quartulli (4): - attempt to add IPv6 route even when no IPv6 address was configured - fix redirect-gateway behaviour when an IPv4 default route does not exist - CRL: use time_t instead of struct timespec to store last mtime - ignore remote-random-hostname if a numeric host is provided - -Christian Hesse (7): - man: fix formatting for alternative option - systemd: Use automake tools to install unit files - systemd: Do not race on RuntimeDirectory - systemd: Add more security feature for systemd units - Clean up plugin path handling - plugin: Remove GNUism in openvpn-plugin.h generation - fix typo in notification message - -David Sommerseth (6): - management: >REMOTE operation would overwrite ce change indicator - management: Remove a redundant #ifdef block - git: Merge .gitignore files into a single file - systemd: Move the READY=1 signalling to an earlier point - plugin: Improve the handling of default plug-in directory - cleanup: Remove faulty env processing functions - -Emmanuel Deloget (8): - OpenSSL: check for the SSL reason, not the full error - OpenSSL: don't use direct access to the internal of X509_STORE_CTX - OpenSSL: don't use direct access to the internal of SSL_CTX - OpenSSL: don't use direct access to the internal of X509_STORE - OpenSSL: don't use direct access to the internal of X509_OBJECT - OpenSSL: don't use direct access to the internal of RSA_METHOD - OpenSSL: SSLeay symbols are no longer available in OpenSSL 1.1 - OpenSSL: use EVP_CipherInit_ex() instead of EVP_CipherInit() - -Eric Thorpe (1): - Fix Building Using MSVC - -Gert Doering (4): - Add openssl_compat.h to openvpn_SOURCES - Fix '--dev null' - Fix installation of IPv6 host route to VPN server when using iservice. - Make ENABLE_OCC no longer depend on !ENABLE_SMALL - -Gisle Vanem (1): - Crash in options.c - -Ilya Shipitsin (2): - Resolve several travis-ci issues - travis-ci: remove unused files - -Olivier Wahrenberger (1): - Fix building with LibreSSL 2.5.1 by cleaning a hack. - -Selva Nair (4): - Fix push options digest update - Always release dhcp address in close_tun() on Windows. - Add a check for -Wl, --wrap support in linker - Fix user's group membership check in interactive service to work with domains - -Simon Matter (1): - Fix segfault when using crypto lib without AES-256-CTR or SHA256 - -Steffan Karger (8): - More broadly enforce Allman style and braces-around-conditionals - Use SHA256 for the internal digest, instead of MD5 - OpenSSL: 1.1 fallout - fix configure on old autoconf - Fix types in WIN32 socket_listen_accept() - Remove duplicate X509 env variables - Fix non-C99-compliant builds: don't use const size_t as array length - Deprecate --ns-cert-type - Be less picky about keyUsage extensions - - 2016.12.26 -- Version 2.4.0 David Sommerseth (5): dev-tools: Added script for updating copyright years in files |