X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=debian%2Fchangelog;h=7d9c4eb133de78f623a513a8e045bf250024b2a4;hb=3f218844e64ad71315f390d7e34af836dab2e04e;hp=438be85f8ee2cf7de2d7f4803e930da1d38e2fd4;hpb=b957a1c9c7eeb6743cc36e5c93cd6a93f6105ae9;p=secnet.git

diff --git a/debian/changelog b/debian/changelog
index 438be85..7d9c4eb 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,67 @@
+secnet (0.5.2~) unstable; urgency=medium
+
+  * 
+
+ --
+
+secnet (0.5.1) unstable; urgency=medium
+
+  POTENTIALLY INCOMPATIBLE CHANGE.  Some security implications.
+
+  * make-secnet-sites: Prefix names when writing secnet sites.conf file.
+
+    make-secnet-sites must copy names (vpn, location and site names) from
+    the input sites file (which is not wholly trusted) to the secnet
+    config file.  Prior to this release, naming a location or site the
+    same as a secnet predefined name could generate a broken sites.conf
+    which secnet would reject.  (With the existing featureset,
+    malfunctions other than rejection, eg privilege escalation, are not
+    possible.)
+
+    make-secnet-sites now adds a prefix to these names when writing
+    sites.conf.  This will not affect configurations which use the
+    make-secnet-sites-provided `all-sites' key, as is usual.  Other
+    configurations will break unless the references in the static part of
+    the config are adjusted.
+
+    Previous behaviour can be restored with the --no-conf-key-prefix
+    option.  (Planned future enhancements to secnet are likely to make use
+    of that option, with untrusted input, dangerously insecure.)
+
+  other changes to make-secnet-sites:
+  * Fix argument parsing.  Fixes a regression affecting -P in 0.5.0,
+    and also fixes new facilities introduced in 0.5.0.
+  * Sort the properties on output (and adjust the test case expected
+    outputs).  Tests now pass on (at least) Python 2.7.13, 3.5.3, 3.7.5.
+  * Delete some unused code.
+
+  secnet:
+  * Change one idiom to avoid a warning from GCC9.  No functional change.
+
+  build system - MAJOR CHANGES:
+  * Fix out-of-tree builds.  (Broken in 0.5.0)
+  * Replace recursive make with use of the new subdirmk system.
+    This represents a fairly comprehensive overhaul of the makefiles.
+    Several bugs (esp. involving dependencies between files in different
+    directories) are fixed.
+  * Drop `make check' from `make all'.  (Otherwise there is no way
+    to ask for `all' without `check'.)
+  * Suppress two unhelpful new compiler warnings from GCC9.
+  * Release checklist update.
+
+  documentation:
+  * Creit Mark Wooding properly in CREDITS.
+  * Include DEVELOPER-CERTIFICATE.
+
+  tests:
+  * Locations now have different names to sites.
+  * Somewhat better debugging output from mtest.
+  * Do not run msgcode-test except with `make fullcheck'.
+  * Other minor bugfixes and improvments.
+  * stest: Suppress unhelpful -Wno-unused-result (needed for stretch).
+
+ -- Ian Jackson <ijackson@chiark.greenend.org.uk>  Fri, 22 Nov 2019 23:13:14 +0000
+
 secnet (0.5.0) unstable; urgency=medium
 
   make-secnet-sites SECURITY FIX:
@@ -20,9 +84,12 @@ secnet (0.5.0) unstable; urgency=medium
   * Bad address syntax error does not wrongly mention IPv6 scopes.
   * Minor refactoring to support forthcoming work.  [Mark Wooding]
 
-  other bugfixes:
+  other bugfixes, improvements and changes to secnet itself:
+  * Better logging of why we are sending NAK messages.
   * Correctly use the verified copy of the peer remote capabilities
     from MSG3.  (Bug is not a vulnerability.)    [Mark Wooding]
+  * Significant internal rearrangements and refactorings, to support
+    forthcoming key management work.  [Mark Wooding and Ian Jackson]
 
   build system etc.:
   * Completely overhaul release checklist; drop dist target.
@@ -30,14 +97,12 @@ secnet (0.5.0) unstable; urgency=medium
   * polypath.c: Fix missing include of <limits.h>.  [Mark Wooding]
   * Add a Wireshark dissector `secnet-wireshark.lua'.  It is not
     installed anywhere right now.  [Mark Wooding]
-  * Significant internal rearrangements and refactorings, to support
-    forthcoming key management work.  [Mark Wooding and Ian Jackson]
 
   documentation:
   * Improve documentation of capability negotiation in NOTES, secnet(8)
     and magic.h.  [Mark Wooding]
 
- --
+ -- Ian Jackson <ijackson@chiark.greenend.org.uk>  Thu, 24 Oct 2019 19:11:54 +0100
 
 secnet (0.4.5) unstable; urgency=medium