X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=secnet.git;a=blobdiff_plain;f=NEWS;h=8094c3e79c448870a606cd3aca1224a4fd58b9bc;hp=be5c38ac77ff2b5a351976a472919920002a7fcc;hb=HEAD;hpb=469fd1d95b2528212a46b155cb115c078de4228f diff --git a/NEWS b/NEWS index be5c38a..8094c3e 100644 --- a/NEWS +++ b/NEWS @@ -1,11 +1,218 @@ * Planned for the future -Netlink device that implements an Ethernet bridge. +Please note that the 0.1 series of secnet releases is now 'maintenance +only'; further development continues in secnet-0.2. -Modular transform code: choice of block ciphers, modes, sequence -numbers / timestamps, etc. similar to IWJ's udptunnel +Debconf support - if you are using the Debian packaged version and +your secnet configuration is autogenerated using debconf then the +upgrade to version 0.2.0 should just involve installing the package; +an appropriate 0.2-style configuration file will be generated +automatically. -* New in versino 0.1.11 +* New in version 0.1.18 + +ipaddr.py now declares its character encoding; required by recent +versions of Python + +* New in version 0.1.17 + +autoconf updates for cross-compilation / more modern autoconf from +Ross Younger + +MacOS X support from Richard Kettlewell + +Makefile fix: Update bison pattern rule to indicate that both the +.tab.c and .tab.h files are generated by the same command. + +i386 ip_csum implementation updated to work with modern gcc + +Rename global 'log' to 'slilog' to avoid conflict with gcc built-in +log() function. + +* New in version 0.1.16 + +XXX XXX PROTOCOL COMPATIBILITY IS BROKEN BETWEEN VERSION 0.1.16 AND +XXX XXX ALL PREVIOUS VERSIONS. + +Bugfix: rsa.c private-key now works properly when you choose not to +verify it. + +Bugfix: serpent key setup was only using the first 8 bytes of the key +material. (Oops!) Ian Jackson contributed a fix so the full 32 bytes +are used, in big-endian mode. + +Debatable-bugfix: RSA operations now use PKCS1 v1.5-style padding + +"Hacky parallelism" contributed by Ian Jackson; this permits +public-key operations to be performed in a subprocess during key +exchange, to make secnet more usable on very slow machines. This is +not compiled in by default; if you find you need it (because key +exchanges are taking more than a second or two) then add +-DHACKY_PARALLEL to FLAGS in the Makefile.in and recompile. + +udp module updates from Peter Benie: + 1) Handle the case where authbind-helper terminates with a signal + 2) Cope with signals being delivered during waitpid + 3) Add 'address' (optional) to the udp settings. This is an IP address + that the socket will be bound to. + 4) Change the endianess of the arguments to authbind-helper. + sprintf("%04X") already translates from machine repesentation to most + significant octet first so htons reversed it again. + +All uses of alloca() expunged by Peter Benie. + +make-secnet-sites now supports configurations where each tunnel gets +its own interface on the host, and the IP router code in secnet is +disabled. make-secnet-sites has been rewritten for clarity. For +information on how to configure secnet for one-interface-per-tunnel, +see the example.conf file. + +* New in version 0.1.15 + +Now terminates with an error when an "include" filename is not +specified in the configuration file (thanks to RJK). + +RSA private key operations optimised using CRT. Thanks to SGT. + +Now compiles cleanly with -Wwrite-strings turned on in gcc. + +Anything sent to stderr once secnet has started running in the +background is now redirected to the system/log facility. + +* New in version 0.1.14 + +The --help and --version options now send their output to stdout. + +Bugfix: TUN flavour "BSD" no longer implies a BSD-style ifconfig and +route command invocation. Instead "ioctl"-style is used, which should +work on both BSD and linux-2.2 systems. + +If no "networks" parameter is specified for a netlink device then it +is assumed to be 0.0.0.0/0 rather than the empty set. So, by default +there is a default route from each netlink device to the host machine. +The "networks" parameter can be used to implement a primitive +firewall, restricting the destination addresses of packets received +through tunnels; if a more complex firewall is required then implement +it on the host. + +* New in version 0.1.13 + +site.c code cleaned up; no externally visible changes + +secnet now calls setsid() after becoming a daemon. + +secnet now supports TUN on Solaris 2.5 and above (and possibly other +STREAMS-based systems as well). + +The TUN code now tries to auto-detect the type of "TUN" in use +(BSD-style, Linux-style or STREAMS-style). If your configuration file +specifies "tun-old" then it defaults to BSD-style; however, since +"tun-old" will be removed in a future release, you should change your +configuration file to specify "tun" and if there's a problem also +specify the flavour in use. + +Example: +netlink tun-old { + ... +}; +should be rewritten as +netlink tun { + flavour "bsd"; + ... +}; + +The flavours currently defined are "bsd", "linux" and "streams". + +The TUN code can now be configured to configure interfaces and +add/delete routes using one of several methods: invoking a +"linux"-style ifconfig/route command, a "bsd"-style ifconfig/route +command, "solaris-2.5"-style ifconfig/route command or calling ioctl() +directly. These methods can be selected using the "ifconfig-type" and +"route-type" options. + +Example: +netlink tun { + ifconfig-type "ioctl"; + route-type "ioctl"; + ... +}; + +The ioctl-based method is now the default for Linux systems. + +Magic numbers used within secnet are now collected in the header file +"magic.h". + +netlink now uses ICMP type=0 code=13 for 'administratively prohibited' +instead of code 9. See RFC1812 section 5.2.7.1. + +The UDP comm module now supports a proxy server, "udpforward". This +runs on a machine which is directly accessible by secnet and which can +send packets to appropriate destinations. It's useful when the proxy +machine doesn't support source- and destination-NAT. The proxy server +is specified using the "proxy" key in the UDP module configuration; +parameters are IP address (string) and port number. + +Bugfix: ipset_to_subnet_list() in ipaddr.c now believed to work in all +cases, including 0.0.0.0/0 + +* New in version 0.1.12 + +IMPORTANT: fix calculation of 'now' in secnet.c; necessary for correct +operation. + +(Only interesting for people building and modifying secnet by hand: +the Makefile now works out most dependencies automatically.) + +The netlink code no longer produces an internal routing table sorted +by netmask length. Instead, netlink instances have a 'priority'; the +table of routes is sorted by priority. Devices like laptops that have +tunnels that must sometimes 'mask' parts of other tunnels should be +given higher priorities. If a priority is not specified it is assumed +to be zero. + +Example usage: +site laptop { ... + link netlink { + route "192.168.73.74/31"; + priority 10; + }; +}; + +* New in version 0.1.11 + +Lists of IP addresses in the configuration file can now include +exclusions as well as inclusions. For example, you can specify all +the hosts on a subnet except one as follows: + +networks "192.168.73.0/24","!192.168.73.70"; + +(If you were only allowed inclusions, you'd have to specify that like +this: +networks "192.168.73.71/32","192.168.73.68/31","192.168.73.64/30", + "192.168.73.72/29","192.168.73.80/28","192.168.73.96/27", + "192.168.73.0/26","192.168.73.128/25"; +) + +secnet now ensures that it invokes userv-ipif with a non-overlapping +list of subnets. + +There is a new command-line option, --sites-key or -s, that enables +the configuration file key that's checked to determine the list of +active sites (default "sites") to be changed. This enables a single +configuration file to contain multiple cofigurations conveniently. + +NAKs are now sent when packets arrive that are not understood. The +tunnel code initiates a key setup if it sees a NAK. Future +developments should include configuration options that control this. + +The tunnel code notifies its peer when secnet is terminating, so the +peer can close the session. + +The netlink "exclude-remote-networks" option has now been replaced by +a "remote-networks" option; instead of specifying networks that no +site may access, you specify the set of networks that remote sites are +allowed to access. A sensible example: "192.168.0.0/16", +"172.16.0.0/12", "10.0.0.0/8", "!your-local-network" * New in version 0.1.10