--- - branch: MAIN date: Wed Jan 6 15:12:31 UTC 2021 files: - new: '1.45' old: '1.44' path: pkgsrc/net/socat/Makefile pathrev: pkgsrc/net/socat/Makefile@1.45 type: modified - new: '1.29' old: '1.28' path: pkgsrc/net/socat/distinfo pathrev: pkgsrc/net/socat/distinfo@1.29 type: modified id: 20210106T151231Z.73075ed6ff8d7b927e77c5c5ac109743acb7e2ac log: "socat: Update to 1.7.4.0\n\nChanges:\n1.7.4.0\n-------\nSecurity:\n Buffer size option (-b) is internally doubled for CR-CRLF conversion,\n but not checked for integer overflow. This could lead to heap based\n buffer overflow, assuming the attacker could provide this parameter.\n Test: BLKSIZE_INT_OVERFL\n Thanks to Lê Hiếu Bùi for reporting this issue and sending an\n example exploit.\n\nCorrections:\n Socats address parser read over end of string when there were unbalanced\n quotes\n Test: UNBALANCED_QUOTE\n\n Removed unused usleep() call from sycls.c\n\n Unsetenv() was conditional in sysutils.c but not in xio-openssl.c thus\n building failed on Solaris 9.\n Thanks to Greg Earle for reporting this issue and providing a patch.\n\n Mitigated race condition of quickly terminating SYSTEM or EXEC child\n processes.\n\n Option o-direct might require alignment of read/write buffer to, e.g.,\n 512 bytes, Socat now takes care of this when allocating the buffer.\n With this fix read() succeeds, however, write() still might fail when\n not writing complete pages.\n Test: O_DIRECT\n\n There was a race condition in the way Socat UDP-RECVFROM and similar\n addresses with option fork prevents one packet from triggering\n multiple processes. The symptom was that Socat master process seemed to\n hang and did not process further packets. The fix makes use of\n pselect() system call.\n Thanks to Fulvio Scapin for reporting this issue.\n\n UNIX domain client addresses applied file system entry options (group\n NAMED) to the server socket instead of the client (bind) socket entry.\n Tests: UNIX_SENDTO_UNLINK UNIX_CONNECT_UNLINK\n Thanks to Nico Williams for reporting this major issue.\n\n Length of single address options was limited to 511 bytes. This value\n is now increased to 2047 bytes.\n Change suggested by Mario Camou.\n\n Addresses of type RECVFROM with option fork looped with an error\n message in case that the second address failed before consuming the\n packet. The fix makes RECVFROM drop the packet when the second address\n failed before reading it. Use retry or forever option with the second\n address if you want to avoid data loss.\n Thanks to Chunmei Xu for reporting this issue and proving the patch.\n\n Socats DTLS implementation has been reworked and appears to work now\n reasonably over UDP.\n New addresses: OPENSSL-DTLS-SERVER (DTLS-L),\n \tOPENSSL-DTLS-CLIENT (DTLS)\n Tests: OPENSSL_DTLS_CLIENT OPENSSL_DTLS_SERVER\n \tOPENSSL_METHOD_DTLS1 OPENSSL_METHOD_DTLS1.2\n Thanks to Brandon Carpenter, Qing Wan, and Pavel Nakonechnyi for\n sending patches.\n\n filan did not output the socket protocol.\n filan -s assumed each stream socket to be TCP and each datagram socket\n to be UDP. Now it uses SO_PROTOCOL and getprotoent() for correct output.\n\n Help text showed two parameters for UDP4-RECVFROM address, but only\n is allowed.\n Thanks to John the Scott for reporting this issue.\n\n Error messages from SSL_read() and SSL_write() sometimes stated\n SSL_connect instead of originating function name.\n\n Fixed some more non functional minor issues.\n\nPorting:\n In gcc version 10 the default changed from -fcommon to -fno-common.\n Consequently, linking filan and procan failed with error\n \"multiple definition of `deny_severity'\" and `allow_severity'\n Fixed by removing definitions in filan.c and procan.c\n Debian issue 957823\n Thanks to László Böszörményi and others for reporting this issue.\n\n Solaris 9 does not provide strndup(); added substitute code.\n Thanks to Greg Earle for providing a patch.\n\n Added configure option --enable-openssl-base to specify the location of\n a non-OS OpenSSL installation\n\n There are systems whose kernel understands SCTP but getaddrinfo does\n not. As workaround after EIA_SOCKTYPE on name and service resolution\n fall back to ai_socktype=0; if it fails with EAI_SERVICE, set\n ai_protocol=0 and try again\n Test: SCTP_SERVICENAME\n\n Per file filesystem options were still name ext2-* and depended on\n . Now they are called fs-* and depend on .\n These fs-* options are also available on old systems with ext2_fs.h\n\n New options openssl-min-proto-version (min-version) and\n openssl-max-proto-version (max-version) give access to the related\n OpenSSL set-macros and substitute deprecated version-specific methods.\n Test: OPENSSL_MIN_VERSION\n\n With OpenSSL use OPENSSL_init_SSL when available, instead of deprecated\n SSL_library_init.\n\n With OPENSSL_API_COMPAT=0x10000000L the files openssl/dh.h, openssl/bn.h\n must explicitely be included.\n Thanks to Rosen Penev for reporting and sending a patch.\n\nTesting:\n test.sh now produces a list of tests that could not be performed for\n any reason. This helps to analyse these cases.\n\n OpenSSL s_server appearently started to neglect TCPs half close feature.\n Test OPENSSL_TCP4 has been changed to tolerate this.\n\n OpenSSL changed its behaviour when connection is rejected. Tests\n OPENSSLCERTSERVER, OPENSSL_CN_CLIENT_SECURITY, and\n OPENSSL_CN_SERVER_SECURITY now tolerate this.\n\n OpenSSL no longer allows explicit renegotiation with TLSv1.3, thus the\n appropriate tests failed.\n Fix: use TLSv1.2 for renegotiation tests\n Tests: OPENSSLRENEG1 OPENSSLRENEG2\n\n Ubuntu 20.04 requires 2048 bit certificates with OpenSSL\n\n Archlinux 2020 has not which command; its ip,ss commands have modified\n version strings\n\n More testing issues solved:\n * ss to pipe might omit column separator\n * UDP6MULTICAST_UNIDIR fails on newer Linux kernels\n * do not use sort -V\n * renamed testaddrs() to testfeats(), and introduced new testaddrs()\n\nNew features:\n GOPEN and UNIX-CLIENT addresses now support sockets of type SEQPACKET.\n Test: GOPENUNIXSEQPACKET\n Feature suggested by vi0oss.\n\n The generic setsockopt-int and related options are, in case of\n listening/accepting addresses, applied to the connected socket(s). To enable\n setting options on the listening socket, a new option setsockopt-listen\n has been implemented. See the documentation for info on data types.\n Tests: SETSOCKOPT SETSOCKOPT_LISTEN\n Thanks to Steven Danna and Korian Edeline for reporting this issue.\n\n Filan option -S gives short description like -s but with improved\n format\n\n Socat OpenSSL client, when server was specified using IP address, did\n not verify connection on certificates SubjectAltName IP entries.\n Tests: OPENSSL_SERVERALTAUTH OPENSSL_SERVERALTIP4AUTH OPENSSL_SERVERALTIP6AUTH\n Fixes Red Hat bug 1805132\n\n Added options -r and -R for raw dump of transferred data to files.\n Test: OPTION_RAW_DUMP\n\n Added option ip-transparent (socket option IP_TRANSPARENT)\n Thanks to Wang Shanker for sending a patch.\n\n OPENSSL-CONNECT now automatically uses the SNI feature, option\n openssl-no-sni turns it off. Option openssl-snihost overrides the value\n of option openssl-commonname or the server name.\n Tests: OPENSSL_SNI OPENSSL_NO_SNI\n Thanks to Travis Burtrum for providing the initial patch\n\n New option accept-timeout (listen-timeout)\n Test: ACCEPTTIMEOUT\n Proposed by Roland\n\n New option ip-add-source-membership\n Feature inspired by Brian (b f31415)\n\n INCOMPATIBLE CHANGE: Address UDP-DATAGRAM now does not check peerport\n of replies, as it did up to version 1.7.3.4. Use option sourceport when\n you need the old behaviour.\n Test: UDP_DATAGRAM_SOURCEPORT\n Feature inspired by Hans Bueckler for SSDP inquiry (for UPnP)\n\n New option proxy-authorization-file reads PROXY-CONNECT credentials\n from file and makes it possible to hide this data from the process\n table.\n Test: PROXYAUTHFILE\n Thanks to Charles Stephens for sending an initial patch.\n\n Added AF_VSOCK support with VSOCK-CONNECT and VSOCK-LISTEN addresses.\n Developed by Stefano Garzarella.\n\nCoding:\n Added printf formats for uint16_t etc.\n\nDocumentation:\n Address UDP-RECV does not support option fork.\n Thanks to Fulvio Scapin for reporting that mistake in docu.\n\n TUN address documentation showed TCP for backend which may merge\n consecutive packets which causes data loss.\n Thanks to Tomasz Lakota for reporting this issue.\n" module: pkgsrc subject: 'CVS commit: pkgsrc/net/socat' unixtime: '1609945951' user: leot