--- - branch: MAIN date: Fri Feb 9 16:46:42 UTC 2018 files: - new: '1.44' old: '1.43' path: pkgsrc/net/vsftpd/Makefile pathrev: pkgsrc/net/vsftpd/Makefile@1.44 type: modified - new: '1.16' old: '1.15' path: pkgsrc/net/vsftpd/distinfo pathrev: pkgsrc/net/vsftpd/distinfo@1.16 type: modified - new: '1.6' old: '1.5' path: pkgsrc/net/vsftpd/patches/patch-aa pathrev: pkgsrc/net/vsftpd/patches/patch-aa@1.6 type: modified - new: '1.6' old: '1.5' path: pkgsrc/net/vsftpd/patches/patch-ad pathrev: pkgsrc/net/vsftpd/patches/patch-ad@1.6 type: modified - new: '1.6' old: '1.5' path: pkgsrc/net/vsftpd/patches/patch-ae pathrev: pkgsrc/net/vsftpd/patches/patch-ae@1.6 type: modified - new: '1.5' old: '1.4' path: pkgsrc/net/vsftpd/patches/patch-ac pathrev: pkgsrc/net/vsftpd/patches/patch-ac@1.5 type: modified - new: '1.7' old: '1.6' path: pkgsrc/net/vsftpd/patches/patch-af pathrev: pkgsrc/net/vsftpd/patches/patch-af@1.7 type: modified id: 20180209T164642Z.f8eacc154b221d8e171a9530c43ad77dd9b91a76 log: "vsftpd: updated to 3.0.3\n\nv2.3.5\n======\n- Try and force glibc to cache zoneinfo files in an attempt to work around\nglibc parsing vulnerability. Thanks to Kingcope.\n- Only report CHMOD in SITE HELP if it's enabled. Thanks to Martin Schwenke\n.\n- Some simple fixes and cleanups from Thorsten Brehm .\n- Only advertise \"AUTH SSL\" if one of SSLv2, SSLv3 is enabled. Thanks to\nsteve willing .\n- Handle connect() failures properly. Thanks to Takayuki Nagata\n.\n- Add stronger checks for the configuration error of running with a writeable\nroot directory inside a chroot(). This may bite people who carelessly turned\non chroot_local_user but such is life.\n\nv3.0.0\n======\n- Update vsf_findlibs.sh to work on Ubuntu 11.10+\n- Make listen mode the default.\n- Add -Werror to build flags.\n- Fix missing \"const\" in ssl.c\n- Add seccompsandbox.c to support a seccomp filter sandbox; works against Ubuntu\n12.04 ABI.\n- Rearrange ftppolicy.c a bit so the syscall list is easily comparable with\nseccompsandbox.c\n- Rename deprecated \"sandbox\" to \"ptrace_sandbox\".\n- Add a few more state checks to the privileged helper processes.\n- Add tunable \"seccomp_sandbox\", default on.\n- Use hardened build flags. Distros of course override these and provide their\nown build flags but no harm in showing how it could be done.\n- Retry creating a PASV socket upon port reuse race between bind() and listen(),\npatch from Ralph Wuerthner .\n- Don't die() if recv() indicates a closed remote connection. Problem report\non a Windows client from Herbert van den Bergh,\n.\n- Add new config setting \"allow_writeable_chroot\" to help people in a bit of\na spot with the v2.3.5 defensive change. Only applies to non-anonymous.\n- Remove a couple of fixed things from BUGS.\n- strlen() trunction fix -- no particular impact.\n- Apply some tidyups from mmoufid@yorku.ca.\n(vsftpd-3.0.0-pre1)\n- Fix delete_failed_uploads if there is a timeout. Report from Alejandro\nHernå\x8F©ndez Hdez .\n- Fix other data channel bugs such as failure to log failure upon timeout.\n- Use exit codes a bit more consistently.\n- Fix bad interaction between SSL and trans_chunk_size.\n- Redo data timeout to fire properly for SSL sessions.\n- Redo idle timeout to fire properly for SSL sessions.\n- Make sure PROT_EXEC isn't allowed, thanks to Will Drewry for noticing.\n- Use 10 minutes as a max linger time just in case an alarm gets lost.\n(vsftpd-3.0.0-pre2)\n- Change PR_SET_NO_NEW_PRIVS define, from Kees Cook.\n- Add AES128-SHA to default SSL cipher suites for FileZilla compatibility.\nUnfortunately the default vsftpd SSL confiuration still doesn't fully work\nwith FileZilla, because FileZilla has a data connection security problem:\nno client certificate presentation and no session reuse. At least the error\nmessage is now very clear.\n- Add restart_syscall to seccomp policy. Triggers reliably if you strace whilst\na data transfer is in progress.\n- Fix delete_failed_uploads for anonymous sessions.\n- Don't listen for urgent data if the control connection is SSL, due to possible\nprotocol synchronization issues.\n\nv3.0.1\n======\n- Fix some seccomp related build errors on certain CentOS and Debian versions.\n- Seccomp filter sandbox: missing munmap() -- oops. Did you know that qsort()\nopens and maps /proc/meminfo but only for larger item counts?\n- Seccomp filter sandbox: deny socket() gracefully for text_userdb_names.\n- Fix various NULL crashes with nonsensical config settings. Noted by Tianyin Xu\n.\n- Force cast to unsigned char in is* char functions.\n- Fix harmless integer issues in strlist.c.\n- Started on a (possibly ill-advised?) crusade to compile cleanly with\nWconversion. Decided to suspend the effort half-way through.\n\nv3.0.2\n======\n- One more seccomp policy fix: mremap (denied).\n- Support STOU with no filename, uses a STOU. prefix.\n\nv3.0.3\n======\n- Increase VSFTP_AS_LIMIT to 200MB; various reports.\n- Make the PWD response more RFC compliant; report from Barry Kelly\n.\n- Remove the trailing period from EPSV response to work around BT Internet\nissues; report from Tim Bishop .\n- Fix syslog_enable issues vs. seccomp filtering. Report from Michal Vyskocil\n. At least, syslogging seems to work on my Fedora now.\n- Allow gettimeofday() in the seccomp sandbox. I can't repro failures, but I\nprobably have a different distro / libc / etc. and there are multiple reports.\n- Some kernels support PR_SET_NO_NEW_PRIVS but not PR_SET_SECCOMP, so handle\nthis case gracefully. Report from Vasily Averin .\n- List the TLS1.2 cipher AES128-GCM-SHA256 as first preference by default.\n- Make some compile-time SSL defaults (such as correct client shutdown\nhandling) stricter.\n- Disable Nagle algorithm during SSL data connection shutdown, to avoid 200ms\ndelays. From Tim Kosse .\n- Kill the FTP session if we see HTTP protocol commands, to avoid\ncross-protocol attacks. A report from Jann Horn .\n- Kill the FTP session if we see session re-use failure. A report from\nTim Kosse .\n(vsftpd-3.0.3pre1)\n- Enable ECDHE, Tim Kosse .\n- Default cipher list is now just ECDHE-RSA-AES256-GCM-SHA384.\n- Minor SSL logging improvements.\n- Un-default tunable_strict_ssl_write_shutdown again. We still have\ntunable_strict_ssl_read_eof defaulted now, which is the important one to prove\nupload integrity.\n(vsftpd-3.0.3pre2)\n" module: pkgsrc subject: 'CVS commit: pkgsrc/net/vsftpd' unixtime: '1518194802' user: triaxx