Update vsftpd to 3.0.3 released in July 2015.
Changelog: https://security.appspot.com/vsftpd/Changelog.txt
Release blog: http://scarybeastsecurity.blogspot.fi/2015/07/vsftpd-303-released-and-horrors-of-ftp.html
- Increase VSFTP_AS_LIMIT to 200MB; various reports.
- Make the PWD response more RFC compliant; report from Barry Kelly
<barry@modeltwozero.com>.
- Remove the trailing period from EPSV response to work around BT Internet
issues; report from Tim Bishop <tdb@mirrorservice.org>.
- Fix syslog_enable issues vs. seccomp filtering. Report from Michal Vyskocil
<mvyskocil@suse.cz>. At least, syslogging seems to work on my Fedora now.
- Allow gettimeofday() in the seccomp sandbox. I can't repro failures, but I
probably have a different distro / libc / etc. and there are multiple reports.
- Some kernels support PR_SET_NO_NEW_PRIVS but not PR_SET_SECCOMP, so handle
this case gracefully. Report from Vasily Averin <vvs@odin.com>.
- List the TLS1.2 cipher AES128-GCM-SHA256 as first preference by default.
- Make some compile-time SSL defaults (such as correct client shutdown
handling) stricter.
- Disable Nagle algorithm during SSL data connection shutdown, to avoid 200ms
delays. From Tim Kosse <tim.kosse@filezilla-project.org>.
- Kill the FTP session if we see HTTP protocol commands, to avoid
cross-protocol attacks. A report from Jann Horn <jann@thejh.net>.
- Kill the FTP session if we see session re-use failure. A report from
Tim Kosse <tim.kosse@filezilla-project.org>.
(vsftpd-3.0.3pre1)
- Enable ECDHE, Tim Kosse <tim.kosse@filezilla-project.org>.
- Default cipher list is now just ECDHE-RSA-AES256-GCM-SHA384.
- Minor SSL logging improvements.
- Un-default tunable_strict_ssl_write_shutdown again. We still have
tunable_strict_ssl_read_eof defaulted now, which is the important one to prove
upload integrity.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
sqm-scripts and luci-app-sqm now live in the same Makefile and are built
from the upstream git repository, rather than having the files included
here.
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* 010_fix_getnameinfo.patch is no longer needed
* 011-cron-without-pthread-fix.patch added, fixes incorrect
ifdef when building without pthreads
Signed-off-by: Michael Haas <haas@computerlinguist.org>
Fixes regression already fixed in oldpackages commit
012eec3f60
but re-introduced in commit 6636e13f2a.
This patch also enables IPv6 support.
Signed-off-by: Ondřej Caletka <ondrej@caletka.cz>
being based on curl 0.70.0 gnurl is affected by
CVE-2015-3144
CVE-2015-3145
CVE-2015-3153
CVE-2015-3236
Import patches from curl package to fix that.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* always re-create config-file when service is started
* use /lib/upgrade/keep.d instead of /etc/sysupgrade.conf sed'ery
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* add gnunet-vpn binary, it was missing
* clean-up -datastore, it contained files already packaged in -mysql
* remove gnunet-import-gns.sh from -utils, it can live in -gns
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
ntripcaster developer agency (http://igs.bkg.bund.de/) no longer provides sources for download.
Created a github repository to provide sources and allow contributions.
Fixed install location for configuration files.
Signed-off-by: Nuno Goncalves <nunojpg@gmail.com>
ntripserver developer agency http://igs.bkg.bund.de/ does not reliably provide a source mirror with version naming.
Created a github repository to provide sources and allow contributions.
Signed-off-by: Nuno Goncalves <nunojpg@gmail.com>
ntripclient developer agency http://igs.bkg.bund.de/ does not reliably provide a source mirror with version naming.
Created a github repository to provide sources and allow contributions.
Signed-off-by: Nuno Goncalves <nunojpg@gmail.com>
simple.qos had accidentally set up the egress shaper twice, once
with the true egress parameters and a second time using the ingress
parameters, effectively misconfiguring both directions. This bub
only affected situations where 3-tier ingress classification was
used.
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
sqm_logger tried tro wait indefinitely if passed an empty string.
This in turn makes sqm-scripts hang. Quoting the input argument in sqm_logger
seems to fix the problem.
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
Hannu Nyman
heil
Toke Høiland-Jørgensen
Noah Meyerhans
Daniel Golle
Nuno Goncalves
Alexandru Ardelean
Nicolas Thill
Maxim Storchak
Ondrej Mikle
Julen Landa Alustiza
W. Michael Petullo
Michael Haas
Ondřej Caletka
Peter Wagner
Damiano Renfer
Jian Chang
Jonathan McCrohan
Jeroen Louwes
Daniel Gimpelevich
Adam Lebsack
Othmar Truniger
Christian Beier
Mislav Novakovic
Sebastian Moeller