| ####################### V 1.7.3.4: | |
| Corrections: | |
| Header of xiotermios_speed() declared parameter unsigned int instead of | |
| speed_t, thus compiling failed on MacOS | |
| Thanks to Joe Strout and others for reporting this bug. | |
| Thanks to Andrew Childs and others for sending a patch. | |
| Under certain circumstances, termios options of the first address were | |
| applied to the second address, resulting in error | |
| "Inappropriate ioctl for device" | |
| This affected version 1.7.3.3 only. | |
| Test: TERMIOS_PH_ALL | |
| Thanks to Ivan J. for reporting this issue. | |
| Socat failed to compile when no poll() system call was found by | |
| configure. | |
| Thanks to Jason White for sending a patch. | |
| Due to use of SSL_CTX_clear_mode() Socat failed to compile on old | |
| systems with, e.g., OpenSSL-0.9.8. Thanks to Simon Matter and Moritz B. | |
| for reporting this problem and sending initial patches. | |
| getaddrinfo() in IP4-SENDTO and IP6-SENDTO addresses failed with | |
| "ai_socktype not supported" when protocol 6 was addressed. | |
| The fix removes the possibility to use service names with SCTP. | |
| Test: IP_SENDTO_6 | |
| Thanks to Sören for sending an initial patch. | |
| Under certain circumstances, Socat printed the "socket ... is at EOF" | |
| multiple times. | |
| Test: MULTIPLE_EOF | |
| Newer parts of test.sh used substitutions ${x,,*} or ${x^^*} that are | |
| not implemented in older bash versions. | |
| ####################### V 1.7.3.3: | |
| Corrections: | |
| Makefile.in did not specify dependencies of filan on vsnprintf_r.o | |
| and snprinterr.o | |
| Added definition of FILAN_OBJS | |
| Thanks to Craig Leres, Clayton Shotwell, and Chris Packham for | |
| providing patches. | |
| configure option --enable-msglevel did not work with numbers | |
| The autoconf mechanism for determining SHIFT_OFFSET did not work when | |
| cross compiling. | |
| Thanks to Max Freisinger from Gentoo for sending a patch. | |
| Socat still depended on obsolete gethostbyname() function, thus | |
| compiling with MUSL libc failed. | |
| Problem reported by Kennedy33. | |
| The async signal safe diagnostic system used FDs 3 and 4 internally, so | |
| use of appropriate fdin or fdout led to failures. | |
| Test: DIAG_FDIN | |
| Problem reported by Onur Sentürk. | |
| The socket based mechanism for passing messages and signal information | |
| from signal handler to process could reach and kill the wrong process. | |
| Introduces functions diag_sock_pair(), diag_fork() | |
| Thanks to Darren Zhao for analysing and reporting this problem. | |
| Option ipv6-join-group did not work because it was applied in the wrong | |
| phase | |
| Test: UDP6MULTICAST_UNIDIR | |
| Thanks to Angus Gratton for sending a patch. | |
| Setting ispeed and ospeed failed for some serial devices because the | |
| two settings were applied with two different get/set cycles, Thanks to | |
| Alexandre Fenyo for providing an initial patch. | |
| However, the actual fix is part of a conceptual change of the termios | |
| module that aims for applying all changes in a single tcsetaddr call. | |
| Fixes FreeBSD Bug 198441 | |
| Termios options TAB0,TAB1,TAB2,TAB3, and XTABS did not have an effect. | |
| Thanks to Alan Walters for reporting this bug. | |
| Substituted cumbersom ISPEED_OFFSET mechanism for cfsetispeed() calls | |
| With TCP6-LISTEN and the other passive IPv6 addresses the range option | |
| just failed: due to a bug in the syntax parser and two more bugs in | |
| the xiocheckrange_ip6() function. | |
| The syntax has now been changed from "[::1/128]" to "[::1]/128"! | |
| Thanks Leah Neukirchen for sending an initial fix. | |
| For name resolution Socat only checked the first character of the host | |
| name to decide if it is an IPv4 address. This was not RFC conform. This | |
| fix removes the possibility for use of IPv4 addresses with IPv6, e.g. | |
| TCP6:127.0.0.1:80 | |
| Debian issue 695885 | |
| Thanks to Nicolas Fournil for reporting this issue. | |
| Print a useful error message when single character options appear to be | |
| merged in Socat invocation | |
| Test: SOCCAT_OPT_HINT | |
| Fixed some docu typos. | |
| Thanks to Travis Wellman, Thomas <tjps636>, Dan Kenigsberg, | |
| Julian Zinn, and Simon Matter | |
| Porting: | |
| OpenSSL functions TLS1_client_method() and similar are | |
| deprecated. Socat now uses recommended TLS_client_method(). The old | |
| functions and dependend option openssl-method can still be | |
| used when configuring socat with --enable-openssl-method | |
| Shell scripts in socat distribution are now headed with: | |
| #! /usr/bin/env bash | |
| to make them better portable to systems without /bin/bash | |
| Thanks to Maya Rashish for sending a patch | |
| RES_AAONLY, RES_PRIMARY are deprecated. You can still enable them with | |
| configure option --enable-res-deprecated. | |
| New versions of OpenSSL preset SSL_MODE_AUTO_RETRY which may hang socat. | |
| Solution: clear SSL_MODE_AUTO_RETRY when it is set. | |
| Renamed configure.in to configure.ac and set an appropriate symlink for | |
| older environments. | |
| Related Gentoo bug 426262: Warning on configure.in | |
| Thanks to Francesco Turco for reporting that warning. | |
| Fixed new IPv6 range code for platforms without s6_addr32 component. | |
| Testing: | |
| test.sh: Show a warning when phase-1 (insecure phase) of a security | |
| test fails | |
| OpenSSL tests failed on actual Linux distributions. Measures: | |
| Increased key lengths from 768 to 1024 bits | |
| Added test.sh option -C to delete temp certs from prevsious runs | |
| Provide DH-parameter in certificate in PEM | |
| OpenSSL s_server option -verify 0 must be omitted | |
| OpenSSL authentication method aNULL no longer works | |
| Failure of cipher aNULL is not a failure | |
| Failure of methods SSL3 and SSL23 is desired | |
| test.sh depended on ifconfig and netstat utilities which are no longer | |
| availabie in some distributions. test.sh now checks for and prefers | |
| ip and ss. | |
| Thanks to Ruediger Meier for reporting this problem. | |
| More corrections to test.sh: | |
| Language settings could still influence test results | |
| netstat was still required | |
| Suppress usleep deprecated messag | |
| Force use of IPv4 with some certificates | |
| Set timeout for UDPxMAXCHILDREN tests | |
| Git: | |
| Added missing Config/Makefile.DragonFly-2-8-2, | |
| Config/config.DragonFly-2-8-2.h | |
| Removed testcert.conf (to be generated by test.sh) | |
| Cosmetics: | |
| Simplified handling of missing termios defines. | |
| New features: | |
| Permit combined -d options as -dd etc. | |
| ####################### V 1.7.3.2: | |
| corrections: | |
| SIGSEGV and other signals could lead to a 100% CPU loop | |
| Failing name resolution could lead to SIGSEGV | |
| Thanks to Max for reporting this issue. | |
| Include <stddef.h> for ptrdiff_t | |
| Thanks to Jeroen Roovers for reporting this issue. | |
| Building with --disable-sycls failed due to missing sslcls.h defines | |
| Socat hung when configured with --disable-sycls. | |
| Some minor corrections with includes etc. | |
| Option so-reuseport did not work. Thanks to Some Raghavendra Prabhu | |
| for sending a patch. | |
| Programs invoked with EXEC, nofork, and -u or -U had stdin and stdout | |
| incorrectly assigned | |
| Test: EXEC_NOFORK_UNIDIR | |
| Thanks to David Reiss for reporting this problem. | |
| Socat exited with status 0 even when a program invoked with SYSTEM or | |
| EXEC failed. | |
| Tests: SYSTEM_RC EXEC_RC | |
| Issue reported by Felix Winkelmann. | |
| AddressSanitizer reported a few buffer overflows (false positives). | |
| Nevertheless fixed Socat source. | |
| Issue reported by Hanno Böck. | |
| Socat did not use option ipv6-join-group. | |
| Test: USE_IPV6_JOIN_GROUP | |
| Thanks to Linus Lüssing for sending a patch. | |
| UDP-LISTEN did not honor the max-children option. | |
| Test: UDP4MAXCHILDREN UDP6MAXCHILDREN | |
| Thanks to Leander Berwers for reporting this issue. | |
| Options so-rcvtimeo and so-sndtimeo do not work with poll()/select() | |
| and therefore were useless. | |
| Thanks to Steve Borenstein for reporting this issue. | |
| Option dhparam was documented as dhparams. Added the alias name | |
| dhparams to fix this. | |
| Thanks to Alexander Neumann for sending a patch. | |
| Options shut-down and shut-close did not work. | |
| Thanks to Stefan Schimanski for providing a patch. | |
| There was a bug in printing readline log message caused by a misleading | |
| indentation. | |
| Thanks to Paul Wouters for reporting. | |
| The internal vsnprintf_r function looped or crashed on size parameter | |
| with hexadecimal output. | |
| Ignore exit code of child process when it was killed by master due to | |
| EOF | |
| Corrected byte order on read of IPV6_TCLASS value from ancillary | |
| message | |
| Fixed type of the bool element in options. This had bug caused failures | |
| e.g. of ignoreeof on big-endian systems when bool was not based on int. | |
| On systems with predefined bool type whose size differs from int some | |
| IPv6 and TCP options (per setsockopt()) failed. | |
| Length of integral data in ancillary messages varies (TOS: 1 byte, | |
| TTL: 4 bytes), the old implementation failed for TTL on big-endian | |
| hosts. | |
| Fixed an issue in options processing: TUN and DNS flags had failed on | |
| big-endian systems and the NO- forms had probable never worked. | |
| porting: | |
| Type conflict between int and sig_atomic_t between declaration and | |
| definition of diag_immediate_type and diag_immediate_exit broke | |
| compilation on FreeBSD 10.1 with clang. Thanks to Emanuel Haupt for | |
| reporting this bug. | |
| Socat failed to compile on platforms with OpenSSL without | |
| DTLSv1_client_method or DTLSv1_server_method. | |
| Thanks to Simon Matter for sending a patch. | |
| NuttX OS headers do not provide struct ip, thus socat did not compile. | |
| Made struct ip subject to configure. | |
| Thanks to SP for reporting this issue. | |
| Socat failed to compile with OpenSSL version 1.0.2d where | |
| SSLv3_server_method and SSLv3_client_method are no longer defined. | |
| Thanks to Mischa ter Smitten for reporting this issue and providing | |
| a patch. | |
| configure checked for OpenSSL EC_KEY assuming it is a define but it | |
| is a type, thus OpenSSL ECDHE ciphers failed even on Linux. | |
| Thanks to Andrey Arapov for reporting this bug. | |
| Changes to make socat compile with OpenSSL 1.1. | |
| Thanks to Sebastian Andrzej Siewior e.a. from the Debian team for | |
| providing the base patch. | |
| Debian Bug#828550 | |
| Make Socat compatible with BoringSSL. | |
| Thanks to Matt Braithwaite for providing a patch. | |
| OpenSSL: Use RAND_status to determine PRNG state | |
| Thanks to Adam Langley for providing a patch | |
| AIX-7 uses an extended O_ACCMODE that does not fit socat's internal | |
| requirements. Thanks to Garrick Trowsdale for providing a patch | |
| LibreSSL support: check for OPENSSL_NO_COMP | |
| Thanks to Bernard Spil for providing a patch | |
| testing: | |
| socks4echo.sh and socks4a-echo.sh hung with new bash with read -n | |
| test.sh: stderr; option -v (verbose); FDOUT_ERROR description | |
| improved proxy.sh - it now also takes hostnames | |
| A few corrections in test.sh | |
| DTLS1 test hangs on some distributions. Test is now only performed | |
| with OpenSSL 1.0.2 or higher. | |
| More corrections to test.sh that reveal a mistake with IPV6_TCLASS | |
| docu: | |
| Corrected source of socat man page to correctly show man references | |
| like socket(2); removed obseolete entries from See Also | |
| Docu and some comments mentioned addresses SSL-LISTEN and SSL-CONNECT | |
| that do not exist (OPENSSL-LISTEN, SSL-L; and OPENNSSL-CONNECT, SSL | |
| are correct). | |
| Thanks to Zhigang Wang for reporting this issue. | |
| Fixed a couple of English spelling and grammar mistakes. | |
| Thanks to Jakub Wild for sending the patches. | |
| NOEXPAND() was not resolved 2 times. | |
| More minor docu corrections | |
| legal: | |
| Added contributors to copyright notices. Suggested by Matt Braithwaite. | |
| ####################### V 1.7.3.1: | |
| security: | |
| Socat security advisory 8 | |
| A stack overflow in vulnerability was found that can be triggered when | |
| command line arguments (complete address specifications, host names, | |
| file names) are longer than 512 bytes. | |
| Successful exploitation might allow an attacker to execute arbitrary | |
| code with the privileges of the socat process. | |
| This vulnerability can only be exploited when an attacker is able to | |
| inject data into socat's command line. | |
| A vulnerable scenario would be a CGI script that reads data from clients | |
| and uses (parts of) this data as hostname for a Socat invocation. | |
| Test: NESTEDOVFL | |
| Credits to Takumi Akiyama for finding and reporting this issue. | |
| Socat security advisory 7 | |
| MSVR-1499 | |
| In the OpenSSL address implementation the hard coded 1024 bit DH p | |
| parameter was not prime. The effective cryptographic strength of a key | |
| exchange using these parameters was weaker than the one one could get by | |
| using a prime p. Moreover, since there is no indication of how these | |
| parameters were chosen, the existence of a trapdoor that makes possible | |
| for an eavesdropper to recover the shared secret from a key exchange | |
| that uses them cannot be ruled out. | |
| Futhermore, 1024bit is not considered sufficiently secure. | |
| Fix: generated a new 2048bit prime. | |
| Thanks to Santiago Zanella-Beguelin and Microsoft Vulnerability | |
| Research (MSVR) for finding and reporting this issue. | |
| ####################### V 1.7.3.0: | |
| security: | |
| Socat security advisory 6 | |
| CVE-2015-1379: Possible DoS with fork | |
| Fixed problems with signal handling caused by use of not async signal | |
| safe functions in signal handlers that could freeze socat, allowing | |
| denial of service attacks. | |
| Many changes in signal handling and the diagnostic messages system were | |
| applied to make the code async signal safe but still provide detailled | |
| logging from signal handlers: | |
| Coded function vsnprintf_r() as async signal safe incomplete substitute | |
| of libc vsnprintf() | |
| Coded function snprinterr() to replace %m in strings with a system error | |
| message | |
| Instead of gettimeofday() use clock_gettime() when available | |
| Pass Diagnostic messages from signal handler per unix socket to the main | |
| program flow | |
| Use sigaction() instead of signal() for better control | |
| Turn off nested signal handler invocations | |
| Thanks to Peter Lobsinger for reporting and explaining this issue. | |
| Red Hat issue 1019975: add TLS host name checks | |
| OpenSSL client checks if the server certificates names in | |
| extensions/subjectAltName/DNS or in subject/commonName match the name | |
| used to connect or the value of the openssl-commonname option. | |
| Test: OPENSSL_CN_CLIENT_SECURITY | |
| OpenSSL server checks if the client certificates names in | |
| extensions/subjectAltNames/DNS or subject/commonName match the value of | |
| the openssl-commonname option when it is used. | |
| Test: OPENSSL_CN_SERVER_SECURITY | |
| Red Hat issue 1019964: socat now uses the system certificate store with | |
| OPENSSL when neither options cafile nor capath are used | |
| Red Hat issue 1019972: needs to specify OpenSSL cipher suites | |
| Default cipherlist is now "HIGH:-NULL:-PSK:-aNULL" instead of empty to | |
| prevent downgrade attacks | |
| new features: | |
| OpenSSL addresses set couple of environment variables from values in | |
| peer certificate, e.g.: | |
| SOCAT_OPENSSL_X509_SUBJECT, SOCAT_OPENSSL_X509_ISSUER, | |
| SOCAT_OPENSSL_X509_COMMONNAME, | |
| SOCAT_OPENSSL_X509V3_SUBJECTALTNAME_DNS | |
| Tests: ENV_OPENSSL_{CLIENT,SERVER}_X509_* | |
| Added support for methods TLSv1, TLSv1.1, TLSv1.2, and DTLS1 | |
| Tests: OPENSSL_METHOD_* | |
| Enabled OpenSSL server side use of ECDHE ciphers. Feature suggested | |
| by Andrey Arapov. | |
| Added a new option termios-rawer for ptys. | |
| Thanks to Christian Vogelgsang for pointing me to this requirement | |
| corrections: | |
| Bind with ABSTRACT commands used non-abstract namespace (Linux). | |
| Test: ABSTRACT_BIND | |
| Thanks to Denis Shatov for reporting this bug. | |
| Fixed return value of nestlex() | |
| Option ignoreeof on the right address hung. | |
| Test: IGNOREEOF_REV | |
| Thanks to Franz Fasching for reporting this bug. | |
| Address SYSTEM, when terminating, shut down its parent addresses, | |
| e.g. an SSL connection which the parent assumed to still be active. | |
| Test: SYSTEM_SHUTDOWN | |
| Passive (listening or receiving) addresses with empty port field bound | |
| to a random port instead of terminating with error. | |
| Test: TCP4_NOPORT | |
| configure with some combination of disable options produced config | |
| files that failed to compile due to missing IPPROTO_TCP. | |
| Thanks to Thierry Fournier for report and patch. | |
| fixed a few minor bugs with OpenSSL in configure and with messages | |
| Socat did not work in FIPS mode because 1024 instead of 512 bit DH prime | |
| is required. Thanks to Zhigang Wang for reporting and sending a patch. | |
| Christophe Leroy provided a patch that fixes memory leaks reported by | |
| valgrind | |
| Help for filan -L was bad, is now corrected to: | |
| "follow symbolic links instead of showing their properties" | |
| Address options fdin and fdout were silently ignored when not applicable | |
| due to -u or -U option. Now these combinations are caught as errors. | |
| Test: FDOUT_ERROR | |
| Issue reported by Hendrik. | |
| Added option termios-cfmakeraw that calls cfmakeraw() and is preferred | |
| over option raw which is now obsolote. On SysV systems this call is | |
| simulated by appropriate setting. | |
| Thanks to Youfu Zhang for reporting issue with option raw. | |
| porting: | |
| Socat included <sys/poll.h> instead of POSIX <poll.h> | |
| Thanks to John Spencer for reporting this issue. | |
| Version 1.7.2.4 changed the check for gcc in configure.ac; this | |
| broke cross compiling. The particular check gets reverted. | |
| Thanks to Ross Burton and Danomi Manchego for reporting this issue. | |
| Debian Bug#764251: Set the build timestamp to a deterministic time: | |
| support external BUILD_DATE env var to allow to build reproducable | |
| binaries | |
| Joachim Fenkes provided an new adapted spec file. | |
| Type bool and macros Min and Max are defined by socat which led to | |
| compile errors when they were already provided by build framework. | |
| Thanks to Liyu Liu for providing a patch. | |
| David Arnstein contributed a patch for NetBSD 5.1 including stdbool.h | |
| support and appropriate files in Config/ | |
| Lauri Tirkkonen contributed a patch regarding netinet/if_ether.h | |
| on Illumos | |
| Changes for Openindiana: define _XPG4_2, __EXTENSIONS__, | |
| _POSIX_PTHREAD_SEMANTICS; and minor changes | |
| Red Hat issue 1182005: socat 1.7.2.4 build failure missing | |
| linux/errqueue.h | |
| Socat failed to compile on on PPC due to new requirements for | |
| including <linux/errqueue.h> and a weakness in the conditional code. | |
| Thanks to Michel Normand for reporting this issue. | |
| doc: | |
| In the man page the PTY example was badly formatted. Thanks to | |
| J.F.Sebastian for sending a patch. | |
| Added missing CVE ids to security issues in CHANGES | |
| testing: | |
| Do not distribute testcert.conf with socat source but generate it | |
| (and new testcert6.conf) during test.sh run. | |
| ####################### V 1.7.2.4: | |
| corrections: | |
| LISTEN based addresses applied some address options, e.g. so-keepalive, | |
| to the listening file descriptor instead of the connected file | |
| descriptor | |
| Thanks to Ulises Alonso for reporting this bug | |
| make failed after configure with non gcc compiler due to missing | |
| include. Thanks to Horacio Mijail for reporting this problem | |
| configure checked for --disable-rawsocket but printed | |
| --disable-genericsocket in the help text. Thanks to Ben Gardiner for | |
| reporting and patching this bug | |
| In xioshutdown() a wrong branch was chosen after RECVFROM type addresses. | |
| Probably no impact. | |
| Thanks to David Binderman for reporting this issue. | |
| procan could not cleanly format ulimit values longer than 16 decimal | |
| digits. Thanks to Frank Dana for providing a patch that increases field | |
| width to 24 digits. | |
| OPENSSL-CONNECT with bind option failed on some systems, eg.FreeBSD, with | |
| "Invalid argument" | |
| Thanks to Emile den Tex for reporting this bug. | |
| Changed some variable definitions to make gcc -O2 aliasing checker happy | |
| Thanks to Ilya Gordeev for reporting these warnings | |
| On big endian platforms with type long >32bit the range option applied a | |
| bad base address. Thanks to hejia hejia for reporting and fixing this bug. | |
| Red Hat issue 1022070: missing length check in xiolog_ancillary_socket() | |
| Red Hat issue 1022063: out-of-range shifts on net mask bits | |
| Red Hat issue 1022062: strcpy misuse in xiosetsockaddrenv_ip4() | |
| Red Hat issue 1022048: strncpy hardening: corrected suspicious strncpy() | |
| uses | |
| Red Hat issue 1021958: fixed a bug with faulty buffer/data length | |
| calculation in xio-ascii.c:_xiodump() | |
| Red Hat issue 1021972: fixed a missing NUL termination in return string | |
| of sysutils.c:sockaddr_info() for the AF_UNIX case | |
| fixed some typos and minor issues, including: | |
| Red Hat issue 1021967: formatting error in manual page | |
| UNIX-LISTEN with fork option did not remove the socket file system entry | |
| when exiting. Other file system based passive address types had similar | |
| issues or failed to apply options umask, user e.a. | |
| Thanks to Lorenzo Monti for pointing me to this issue | |
| porting: | |
| Red Hat issue 1020203: configure checks fail with some compilers. | |
| Use case: clang | |
| Performed changes for Fedora release 19 | |
| Adapted, improved test.sh script | |
| Red Hat issue 1021429: getgroupent fails with large number of groups; | |
| use getgrouplist() when available instead of sequence of calls to | |
| getgrent() | |
| Red Hat issue 1021948: snprintf API change; | |
| Implemented xio_snprintf() function as wrapper that tries to emulate C99 | |
| behaviour on old glibc systems, and adapted all affected calls | |
| appropriately | |
| Mike Frysinger provided a patch that supports long long for time_t, | |
| socklen_t and a few other libc types. | |
| Artem Mygaiev extended Cedril Priscals Android build script with pty code | |
| The check for fips.h required stddef.h | |
| Thanks to Matt Hilt for reporting this issue and sending a patch | |
| Check for linux/errqueue.h failed on some systems due to lack of | |
| linux/types.h inclusion. Thanks to Michael Vastola for sending a patch. | |
| autoconf now prefers configure.ac over configure.in | |
| Thanks to Michael Vastola for sending a patch. | |
| type of struct cmsghdr.cmsg is system dependend, determine it with | |
| configure; some more print format corrections | |
| docu: | |
| libwrap always logs to syslog | |
| added actual text version of GPLv2 | |
| ####################### V 1.7.2.3: | |
| security: | |
| Socat security advisory 5 | |
| CVE-2014-0019: socats PROXY-CONNECT address was vulnerable to a buffer | |
| overflow with data from command line (see socat-secadv5.txt) | |
| Credits to Florian Weimer of the Red Hat Product Security Team | |
| ####################### V 1.7.2.2: | |
| security: | |
| Socat security advisory 4 | |
| CVE-2013-3571: | |
| after refusing a client connection due to bad source address or source | |
| port socat shutdown() the socket but did not close() it, resulting in | |
| a file descriptor leak in the listening process, visible with lsof and | |
| possibly resulting in EMFILE Too many open files. This issue could be | |
| misused for a denial of service attack. | |
| Full credits to Catalin Mitrofan for finding and reporting this issue. | |
| ####################### V 1.7.2.1: | |
| security: | |
| Socat security advisory 3 | |
| CVE-2012-0219: | |
| fixed a possible heap buffer overflow in the readline address. This bug | |
| could be exploited when all of the following conditions were met: | |
| 1) one of the addresses is READLINE without the noprompt and without the | |
| prompt options. | |
| 2) the other (almost arbitrary address) reads malicious data (which is | |
| then transferred by socat to READLINE). | |
| Workaround: when using the READLINE address apply option prompt or | |
| noprompt. | |
| Full credits to Johan Thillemann for finding and reporting this issue. | |
| ####################### V 1.7.2.0: | |
| corrections: | |
| when UNIX-LISTEN was applied to an existing file it failed as expected | |
| but removed the file. Thanks to Bjoern Bosselmann for reporting this | |
| problem | |
| fixed a bug where socat might crash when connecting to a unix domain | |
| socket using address GOPEN. Thanks to Martin Forssen for bug report and | |
| patch. | |
| UDP-LISTEN would alway set SO_REUSEADDR even without fork option and | |
| when user set it to 0. Thanks to Michal Svoboda for reporting this bug. | |
| UNIX-CONNECT did not support half-close. Thanks to Greg Hughes who | |
| pointed me to that bug | |
| TCP-CONNECT with option nonblock reported successful connect even when | |
| it was still pending | |
| address option ioctl-intp failed with "unimplemented type 26". Thanks | |
| to Jeremy W. Sherman for reporting and fixing that bug | |
| socat option -x did not print packet direction, timestamp etc; thanks | |
| to Anthony Sharobaiko for sending a patch | |
| address PTY does not take any parameters but did not report an error | |
| when some were given | |
| Marcus Meissner provided a patch that fixes invalid output and possible | |
| process crash when socat prints info about an unnamed unix domain | |
| socket | |
| Michal Soltys reported the following problem and provided an initial | |
| patch: when socat was interrupted, e.g. by SIGSTOP, and resumed during | |
| data transfer only parts of the data might have been written. | |
| Option o-nonblock in combination with large transfer block sizes | |
| may result in partial writes and/or EAGAIN errors that were not handled | |
| properly but resulted in data loss or process termination. | |
| Fixed a bug that could freeze socat when during assembly of a log | |
| message a signal was handled that also printed a log message. socat | |
| development had been aware that localtime() is not thread safe but had | |
| only expected broken messages, not corrupted stack (glibc 2.11.1, | |
| Ubuntu 10.4) | |
| an internal store for child pids was susceptible to pid reuse which | |
| could lead to sporadic data loss when both fork option and exec address | |
| were used. Thanks to Tetsuya Sodo for reporting this problem and | |
| sending a patch | |
| OpenSSL server failed with "no shared cipher" when using cipher aNULL. | |
| Fixed by providing temporary DH parameters. Thanks to Philip Rowlands | |
| for drawing my attention to this issue. | |
| UDP-LISTEN slept 1s after accepting a connection. This is not required. | |
| Thanks to Peter Valdemar Morch for reporting this issue | |
| fixed a bug that could lead to error or socat crash after a client | |
| connection with option retry had been established | |
| fixed configure.in bug on net/if.h check that caused IF_NAMESIZE to be | |
| undefined | |
| improved dev_t print format definition | |
| porting: | |
| Cedril Priscal ported socat to Android (using Googles cross compiler). | |
| The port includes the socat_buildscript_for_android.sh script | |
| added check for component ipi_spec_dst in struct in_pktinfo so | |
| compilation does not fail on Cygwin (thanks to Peter Wagemans for | |
| reporting this problem) | |
| build failed on RHEL6 due to presence of fips.h; configure now checks | |
| for fipsld too. Thanks to Andreas Gruenbacher for reporting this | |
| problem | |
| check for netinet6/in6.h only when IPv6 is available and enabled | |
| don't fail to compile when the following defines are missing: | |
| IPV6_PKTINFO IPV6_RTHDR IPV6_DSTOPTS IPV6_HOPOPTS IPV6_HOPLIMIT | |
| Thanks to Jerry Jacobs for reporting this problem (Mac OS X Lion 10.7) | |
| check if define __APPLE_USE_RFC_2292 helps to enable IPV6_* (MacOSX | |
| Lion 7.1); thanks to Jerry Jacobs to reporting this problem and | |
| proposing a solution | |
| fixed compiler warnings on Mac OS X 64bit. Thanks to Guy Harris for | |
| providing the patch. | |
| corrections for OpenEmbedded, especially termios SHIFT values and | |
| ISPEED/OSPEED. Thanks to John Faith for providing the patch | |
| minor corrections to docu and test.sh resulting from local compilation | |
| on Openmoko SHR | |
| fixed sa_family_t compile error on DragonFly. Thanks to Tony Young for | |
| reporting this issue and sending a patch. | |
| Ubuntu Oneiric: OpenSSL no longer provides SSLv2 functions; libutil.sh | |
| is now bsd/libutil.h; compiler warns on vars that is only written to | |
| new features: | |
| added option max-children that limits the number of concurrent child | |
| processes. Thanks to Sam Liddicott for providing the patch. | |
| Till Maas added support for tun/tap addresses without IP address | |
| added an option openssl-compress that allows to disable the compression | |
| feature of newer OpenSSL versions. Thanks to Michael Hanselmann for | |
| providing this contribution (sponsored by Google Inc.) | |
| docu: | |
| minor corrections in docu (thanks to Paggas) | |
| client process -> child process | |
| ####################### V 1.7.1.3: | |
| security: | |
| Socat security advisory 2 | |
| CVE-2010-2799: | |
| fixed a stack overflow vulnerability that occurred when command | |
| line arguments (whole addresses, host names, file names) were longer | |
| than 512 bytes. | |
| Note that this could only be exploited when an attacker was able to | |
| inject data into socat's command line. | |
| Full credits to Felix Gröbert, Google Security Team, for finding and | |
| reporting this issue | |
| ####################### V 1.7.1.2: | |
| corrections: | |
| user-late and group-late, when applied to a pty, affected the system | |
| device /dev/ptmx instead of the pty (thanks to Matthew Cloke for | |
| pointing me to this bug) | |
| socats openssl addresses failed with "nonblocking operation did not | |
| complete" when the peer performed a renegotiation. Thanks to Benjamin | |
| Delpy for reporting this bug. | |
| info message during socks connect showed bad port number on little | |
| endian systems due to wrong byte order (thanks to Peter M. Galbavy for | |
| bug report and patch) | |
| Debian bug 531078: socat execs children with SIGCHLD ignored; corrected | |
| to default. Thanks to Martin Dorey for reporting this bug. | |
| porting: | |
| building socat on systems that predefined the CFLAGS environment to | |
| contain -Wall failed (esp.RedHat). Thanks to Paul Wouters for reporting | |
| this problem and to Simon Matter for providing the patch | |
| support for Solaris 8 and Sun Studio support (thanks to Sebastian | |
| Kayser for providing the patches) | |
| on some 64bit systems a compiler warning "cast from pointer to integer | |
| of different size" was issued on some option definitions | |
| added struct sockaddr_ll to union sockaddr_union to avoid "strict | |
| aliasing" warnings (problem reported by Paul Wouters) | |
| docu: | |
| minor corrections in docu | |
| ####################### V 1.7.1.1: | |
| corrections: | |
| corrected the "fixed possible SIGSEGV" fix because SIGSEGV still might | |
| occur under those conditions. Thanks to Toni Mattila for first | |
| reporting this problem. | |
| ftruncate64 cut its argument to 32 bits on systems with 32 bit long type | |
| socat crashed on systems without setenv() (esp. SunOS up to Solaris 9); | |
| thanks to Todd Stansell for reporting this bug | |
| with unidirectional EXEC and SYSTEM a close() operation was performed | |
| on a random number which could result in hanging e.a. | |
| fixed a compile problem caused by size_t/socklen_t mismatch on 64bit | |
| systems | |
| docu mentioned option so-bindtodev but correct name is so-bindtodevice. | |
| Thanks to Jim Zimmerman for reporting. | |
| docu changes: | |
| added environment variables example to doc/socat-multicast.html | |
| ####################### V 1.7.1.0: | |
| new features: | |
| address options shut-none, shut-down, and shut-close allow to control | |
| socat's half close behaviour | |
| with address option shut-null socat sends an empty packet to the peer | |
| to indicate EOF | |
| option null-eof changes the behaviour of sockets that receive an empty | |
| packet to see EOF instead of ignoring it | |
| introduced option names substuser-early and su-e, currently equivalent | |
| to option substuser (thanks to Mike Perry for providing the patch) | |
| corrections: | |
| fixed some typos and improved some comments | |
| ####################### V 1.7.0.1: | |
| corrections: | |
| fixed possible SIGSEGV in listening addresses when a new connection was | |
| reset by peer before the socket addresses could be retrieved. Thanks to | |
| Mike Perry for sending a patch. | |
| fixed a bug, introduced with version 1.7.0.0, that let client | |
| connections with option connect-timeout fail when the connections | |
| succeeded. Thanks to Bruno De Fraine for reporting this bug. | |
| option end-close "did not apply" to addresses PTY, SOCKET-CONNECT, | |
| and most UNIX-* and ABSTRACT-* | |
| half close of EXEC and SYSTEM addresses did not work for pipes and | |
| sometimes socketpair | |
| help displayed for some option a wrong type | |
| under some circumstances shutdown was called multiple times for the | |
| same fd | |
| ####################### V 1.7.0.0: | |
| new features: | |
| new address types SCTP-CONNECT and SCTP-LISTEN implement SCTP stream | |
| mode for IPv4 and IPv6; new address options sctp-maxseg and | |
| sctp-nodelay (suggested by David A. Madore; thanks to Jonathan Brannan | |
| for providing an initial patch) | |
| new address "INTERFACE" for transparent network interface handling | |
| (suggested by Stuart Nicholson) | |
| added generic socket addresses: SOCKET-CONNECT, SOCKET-LISTEN, | |
| SOCKET-SENDTO, SOCKET-RECVFROM, SOCKET-RECV, SOCKET-DATAGRAM allow | |
| protocol independent socket handling; all parameters are explicitely | |
| specified as numbers or hex data | |
| added address options ioctl-void, ioctl-int, ioctl-intp, ioctl-string, | |
| ioctl-bin for generic ioctl() calls. | |
| added address options setsockopt-int, setsockopt-bin, and | |
| setsockopt-string for generic setsockopt() calls | |
| option so-type now only affects the socket() and socketpair() calls, | |
| not the name resolution. so-type and so-prototype can now be applied to | |
| all socket based addresses. | |
| new address option "escape" allows to break a socat instance even when | |
| raw terminal mode prevents ^C etc. (feature suggested by Guido Trotter) | |
| socat sets environment variables SOCAT_VERSION, SOCAT_PID, SOCAT_PPID | |
| for use in executed scripts | |
| socat sets environment variables SOCAT_SOCKADDR, SOCAT_SOCKPORT, | |
| SOCAT_PEERADDR, SOCAT_PEERPORT in LISTEN type addresses (feature | |
| suggested by Ed Sawicki) | |
| socat receives all ancillary messages with each received packet on | |
| datagram related addresses. The messages are logged in raw form with | |
| debug level, and broken down with info level. note: each type of | |
| ancillary message must be enabled by appropriate address options. | |
| socat provides the contents of ancillary messages received on RECVFROM | |
| addresses in appropriate environment variables: | |
| SOCAT_TIMESTAMP, SOCAT_IP_DSTADDR, SOCAT_IP_IF, SOCAT_IP_LOCADDR, | |
| SOCAT_IP_OPTIONS, SOCAT_IP_TOS, SOCAT_IP_TTL, SOCAT_IPV6_DSTADDR, | |
| SOCAT_IPV6_HOPLIMIT, SOCAT_IPV6_TCLASS | |
| the following address options were added to enable ancillary messages: | |
| so-timestamp, ip-pktinfo (not BSD), ip-recvdstaddr (BSD), ip-recverr, | |
| ip-recvif (BSD), ip-recvopts, ip-recvtos, ip-recvttl, ipv6-recvdstopts, | |
| ipv6-recverr, ipv6-recvhoplimit, ipv6-recvhopopts, ipv6-recvpathmtu, | |
| ipv6-recvpktinfo, ipv6-recvrthdr, ipv6-recvtclass | |
| new address options ipv6-tclass and ipv6-unicast-hops set the related | |
| socket options. | |
| STREAMS (UNIX System V STREAMS) can be configured with the new address | |
| options i-pop-all and i-push (thanks to Michal Rysavy for providing a | |
| patch) | |
| corrections: | |
| some raw IP and UNIX datagram modes failed on BSD systems | |
| when UDP-LISTEN continued to listen after packet dropped by, e.g., | |
| range option, the old listen socket would not be closed but a new one | |
| created. open sockets could accumulate. | |
| there was a bug in ip*-recv with bind option: it did not bind, and | |
| with the first received packet an error occurred: | |
| socket_init(): unknown address family 0 | |
| test: RAWIP4RECVBIND | |
| RECVFROM addresses with FORK option hung after processing the first | |
| packet. test: UDP4RECVFROM_FORK | |
| corrected a few mistakes that caused compiler warnings on 64bit hosts | |
| (thanks to Jonathan Brannan e.a. for providing a patch) | |
| EXEC and SYSTEM with stderr injected socat messages into the data | |
| stream. test: EXECSTDERRLOG | |
| when the EXEC address got a string with consecutive spaces it created | |
| additional empty arguments (thanks to Olivier Hervieu for reporting | |
| this bug). test: EXECSPACES | |
| in ignoreeof polling mode socat also blocked data transfer in the other | |
| direction during the 1s wait intervalls (thanks to Jorgen Cederlof for | |
| reporting this bug) | |
| corrected alphabetical order of options (proxy-auth) | |
| some minor corrections | |
| improved test.sh script: more stable timing, corrections for BSD | |
| replaced the select() calls by poll() to cleanly fix the problems with | |
| many file descriptors already open | |
| socat option -lf did not log to file but to stderr | |
| socat did not compile on Solaris when configured without termios | |
| feature (thanks to Pavan Gadi for reporting this bug) | |
| porting: | |
| socat compiles and runs on AIX with gcc (thanks to Andi Mather for his | |
| help) | |
| socat compiles and runs on Cygwin (thanks to Jan Just Keijser for his | |
| help) | |
| socat compiles and runs on HP-UX with gcc (thanks to Michal Rysavy for | |
| his help) | |
| socat compiles and runs on MacOS X (thanks to Camillo Lugaresi for his | |
| help) | |
| further changes: | |
| filan -s prefixes output with FD number if more than one FD | |
| Makefile now supports datarootdir (thanks to Camillo Lugaresi for | |
| providing the patch) | |
| cleanup in xio-unix.c | |
| ####################### V 1.6.0.1: | |
| new features: | |
| new make target "gitclean" | |
| docu source doc/socat.yo released | |
| corrections: | |
| exec:...,pty did not kill child process under some circumstances; fixed | |
| by correcting typo in xio-progcall.c (thanks to Ralph Forsythe for | |
| reporting this problem) | |
| service name resolution failed due to byte order mistake | |
| (thanks to James Sainsbury for reporting this problem) | |
| socat would hang when invoked with many file descriptors already opened | |
| fix: replaced FOPEN_MAX with FD_SETSIZE | |
| thanks to Daniel Lucq for reporting this problem. | |
| fixed bugs where sub processes would become zombies because the master | |
| process did not catch SIGCHLD. this affected addresses UDP-LISTEN, | |
| UDP-CONNECT, TCP-CONNECT, OPENSSL, PROXY, UNIX-CONNECT, UNIX-CLIENT, | |
| ABSTRACT-CONNECT, ABSTRACT-CLIENT, SOCKSA, SOCKS4A | |
| (thanks to Fernanda G Weiden for reporting this problem) | |
| fixed a bug where sub processes would become zombies because the master | |
| process caught SIGCHLD but did not wait(). this affected addresses | |
| UDP-RECVFROM, IP-RECVFROM, UNIX-RECVFROM, ABSTRACT-RECVFROM | |
| (thanks to Evan Borgstrom for reporting this problem) | |
| corrected option handling with STDIO; usecase: cool-write | |
| configure --disable-pty also disabled option waitlock | |
| fixed small bugs on systems with struct ip_mreq without struct ip_mreqn | |
| (thanks to Roland Illig for sending a patch) | |
| corrected name of option intervall to interval (old form still valid | |
| for us German speaking guys) | |
| corrected some print statements and variable names | |
| make uninstall did not uninstall procan | |
| fixed lots of weaknesses in test.sh | |
| corrected some bugs and typos in doc/socat.yo, EXAMPLES, C comments | |
| further changes: | |
| procan -c prints C defines important for socat | |
| added test OPENSSLEOF for OpenSSL half close | |
| ####################### V 1.6.0.0: | |
| new features: | |
| new addresses IP-DATAGRAM and UDP-DATAGRAM allow versatile broadcast | |
| and multicast modes | |
| new option ip-add-membership for control of multicast group membership | |
| new address TUN for generation of Linux TUN/TAP pseudo network | |
| interfaces (suggested by Mat Caughron); associated options tun-device, | |
| tun-name, tun-type; iff-up, iff-promisc, iff-noarp, iff-no-pi etc. | |
| new addresses ABSTRACT-CONNECT, ABSTRACT-LISTEN, ABSTRACT-SENDTO, | |
| ABSTRACT-RECV, and ABSTRACT-RECVFROM for abstract UNIX domain addresses | |
| on Linux (requested by Zeeshan Ali); option unix-tightsocklen controls | |
| socklen parameter on system calls. | |
| option end-close for control of connection closing allows FD sharing | |
| by sub processes | |
| range option supports form address:mask with IPv4 | |
| changed behaviour of OPENSSL-LISTEN to require and verify client | |
| certificate per default | |
| options f-setlkw-rd, f-setlkw-wr, f-setlk-rd, f-setlk-wr allow finer | |
| grained locking on regular files | |
| uninstall target in Makefile (lack reported by Zeeshan Ali) | |
| corrections: | |
| fixed bug where only first tcpwrap option was applied; fixed bug where | |
| tcpwrap IPv6 check always failed (thanks to Rudolf Cejka for reporting | |
| and fixing this bug) | |
| filan (and socat -D) could hang when a socket was involved | |
| corrected PTYs on HP-UX (and maybe others) using STREAMS (inspired by | |
| Roberto Mackun) | |
| correct bind with udp6-listen (thanks to Jan Horak for reporting this | |
| bug) | |
| corrected filan.c peekbuff[0] which did not compile with Sun Studio Pro | |
| (thanks to Leo Zhadanovsky for reporting this problem) | |
| corrected problem with read data buffered in OpenSSL layer (thanks to | |
| Jon Nelson for reporting this bug) | |
| corrected problem with option readbytes when input stream stayed idle | |
| after so many bytes | |
| fixed a bug where a datagram receiver with option fork could fork two | |
| sub processes per packet | |
| further changes: | |
| moved documentation to new doc/ subdir | |
| new documents (kind of mini tutorials) are provided in doc/ | |
| ####################### V 1.5.0.0: | |
| new features: | |
| new datagram modes for udp, rawip, unix domain sockets | |
| socat option -T specifies inactivity timeout | |
| rewrote lexical analysis to allow nested socat calls | |
| addresses tcp, udp, tcp-l, udp-l, and rawip now support IPv4 and IPv6 | |
| socat options -4, -6 and environment variables SOCAT_DEFAULT_LISTEN_IP, | |
| SOCAT_PREFERRED_RESOLVE_IP for control of protocol selection | |
| addresses ssl, ssl-l, socks, proxy now support IPv4 and IPv6 | |
| option protocol-family (pf), esp. for openssl-listen | |
| range option supports IPv6 - syntax: range=[::1/128] | |
| option ipv6-v6only (ipv6only) | |
| new tcp-wrappers options allow-table, deny-table, tcpwrap-etc | |
| FIPS version of OpenSSL can be integrated - initial patch provided by | |
| David Acker. See README.FIPS | |
| support for resolver options res-debug, aaonly, usevc, primary, igntc, | |
| recurse, defnames, stayopen, dnsrch | |
| options for file attributes on advanced filesystems (ext2, ext3, | |
| reiser): secrm, unrm, compr, ext2-sync, immutable, ext2-append, nodump, | |
| ext2-noatime, journal-data etc. | |
| option cool-write controls severeness of write failure (EPIPE, | |
| ECONNRESET) | |
| option o-noatime | |
| socat option -lh for hostname in log output | |
| traffic dumping provides packet headers | |
| configure.in became part of distribution | |
| socats unpack directory now has full version, e.g. socat-1.5.0.0/ | |
| corrected docu of option verify | |
| corrections: | |
| fixed tcpwrappers integration - initial fix provided by Rudolf Cejka | |
| exec with pipes,stderr produced error | |
| setuid-early was ignored with many address types | |
| some minor corrections | |
| ####################### V 1.4.3.1: | |
| corrections: | |
| PROBLEM: UNIX socket listen accepted only one (or a few) connections. | |
| FIX: do not remove listening UNIX socket in child process | |
| PROBLEM: SIGSEGV when TCP part of SSL connect failed | |
| FIX: check ssl pointer before calling SSL_shutdown | |
| In debug mode, show connect client port even when connect fails | |
| ####################### V 1.4.3.0: | |
| new features: | |
| socat options -L, -W for application level locking | |
| options "lockfile", "waitlock" for address level locking | |
| (Stefan Luethje) | |
| option "readbytes" limits read length (Adam Osuchowski) | |
| option "retry" for unix-connect, unix-listen, tcp6-listen (Dale Dude) | |
| pty symlink, unix listen socket, and named pipe are per default removed | |
| after use; option unlink-close overrides this new behaviour and also | |
| controls removal of other socat generated files (Stefan Luethje) | |
| corrections: | |
| option "retry" did not work with tcp-listen | |
| EPIPE condition could result in a 100% CPU loop | |
| further changes: | |
| support systems without SHUT_RD etc. | |
| handle more size_t types | |
| try to find makedepend options with gcc 3 (richard/OpenMacNews) | |
| ####################### V 1.4.2.0: | |
| new features: | |
| option "connect-timeout" limits wait time for connect operations | |
| (requested by Giulio Orsero) | |
| option "dhparam" for explicit Diffie-Hellman parameter file | |
| corrections: | |
| support for OpenSSL DSA certificates (Miika Komu) | |
| create install directories before copying files (Miika Komu) | |
| when exiting on signal, return status 128+signum instead of 1 | |
| on EPIPE and ECONNRESET, only issue a warning (Santiago Garcia | |
| Mantinan) | |
| -lu could cause a core dump on long messages | |
| further changes: | |
| modifications to simplify using socats features in applications | |
| ####################### V 1.4.1.0: | |
| new features: | |
| option "wait-slave" blocks open of pty master side until a client | |
| connects, "pty-intervall" controls polling | |
| option -h as synonym to -? for help (contributed by Christian | |
| Lademann) | |
| filan prints formatted time stamps and rdev (disable with -r) | |
| redirect filan's output, so stdout is not affected (contributed by | |
| Luigi Iotti) | |
| filan option -L to follow symbolic links | |
| filan shows termios control characters | |
| corrections: | |
| proxy address no longer performs unsolicited retries | |
| filan -f no longer needs read permission to analyze a file (but still | |
| needs access permission to directory, of course) | |
| porting: | |
| Option dsusp | |
| FreeBSD options noopt, nopush, md5sig | |
| OpenBSD options sack-disable, signature-enable | |
| HP-UX, Solaris options abort-threshold, conn-abort-threshold | |
| HP-UX options b900, b3600, b7200 | |
| Tru64/OSF1 options keepinit, paws, sackena, tsoptena | |
| further corrections: | |
| address pty now uses ptmx as default if openpty is also available | |
| ####################### V 1.4.0.3: | |
| security: | |
| Socat security advisory 1 | |
| CVE-2004-1484: | |
| fix to a syslog() based format string vulnerability that can lead to | |
| remote code execution. See advisory socat-adv-1.txt | |
| ####################### V 1.4.0.2: | |
| corrections: | |
| exec'd write-only addresses get a chance to flush before being killed | |
| error handler: print notice on error-exit | |
| filan printed wrong file type information | |
| ####################### V 1.4.0.1: | |
| corrections: | |
| socks4a constructed invalid header. Problem found, reported, and fixed | |
| by Thomas Themel, by Peter Palfrader, and by rik | |
| with nofork, don't forget to apply some process related options | |
| (chroot, setsid, setpgid, ...) | |
| ####################### V 1.4.0.0: | |
| new features: | |
| simple openssl server (ssl-l), experimental openssl trust | |
| new options "cafile", "capath", "key", "cert", "egd", and "pseudo" for | |
| openssl | |
| new options "retry", "forever", and "intervall" | |
| option "fork" for address TCP improves `gender changer´ | |
| options "sigint", "sigquit", and "sighup" control passing of signals to | |
| sub process (thanks to David Shea who contributed to this issue) | |
| readline takes respect to the prompt issued by the peer address | |
| options "prompt" and "noprompt" allow to override readline's new | |
| default behaviour | |
| readline supports invisible password with option "noecho" | |
| socat option -lp allows to set hostname in log output | |
| socat option -lu turns on microsecond resolution in log output | |
| corrections: | |
| before reading available data, check if writing on other channel is | |
| possible | |
| tcp6, udp6: support hostname specification (not only IP address), and | |
| map IP4 names to IP6 addresses | |
| openssl client checks server certificate per default | |
| support unidirectional communication with exec/system subprocess | |
| try to restore original terminal settings when terminating | |
| test.sh uses tmp dir /tmp/$USER/$$ instead of /tmp/$$ | |
| socks4 failed on platforms where long does not have 32 bits | |
| (thanks to Peter Palfrader and Thomas Seyrat) | |
| hstrerror substitute wrote wrong messages (HP-UX, Solaris) | |
| proxy error message was truncated when answer contained multiple spaces | |
| porting: | |
| compiles with AIX xlc, HP-UX cc, Tru64 cc (but might not link) | |
| ####################### V 1.3.2.2: | |
| corrections: | |
| PROXY CONNECT failed when the status reply from the proxy server | |
| contained more than one consecutive spaces. Problem reported by | |
| Alexandre Bezroutchko | |
| do not SIGSEGV when proxy address fails to resolve server name | |
| udp-listen failed on systems where AF_INET != SOCK_DGRAM (e.g. SunOS). | |
| Problem reported by Christoph Schittel | |
| test.sh only tests available features | |
| added missing IP and TCP options in filan analyzer | |
| do not apply stdio address options to both directions when in | |
| unidirectional mode | |
| on systems lacking /dev/*random and egd, provide (weak) entropy from | |
| libc random() | |
| porting: | |
| changes for HP-UX (VREPRINT, h_NETDB_INTERNAL) | |
| compiles on True64, FreeBSD (again), NetBSD, OpenBSD | |
| support for long long as st_ino type (Cygwin 1.5) | |
| compile on systems where pty can not be featured | |
| ####################### V 1.3.2.1: | |
| corrections: | |
| "final" solution for the ENOCHLD problem | |
| corrected "make strip" | |
| default gcc debug/opt is "-O" again | |
| check for /proc at runtime, even if configure found it | |
| src.rpm accidently supported SuSE instead of RedHat | |
| ####################### V 1.3.2.0: | |
| new features: | |
| option "nofork" connects an exec'd script or program directly | |
| to the file descriptors of the other address, circumventing the socat | |
| transfer engine | |
| support for files >2GB, using ftruncate64(), lseek64(), stat64() | |
| filan has new "simple" output style (filan -s) | |
| porting: | |
| options "binary" and "text" for controlling line termination on Cygwin | |
| file system access (hint from Yang Wu-Zhou) | |
| fix by Yang Wu-Zhou for the Cygwin "No Children" problem | |
| improved support for OSR: _SVID3; no IS_SOCK, no F_GETOWN (thanks to | |
| John DuBois) | |
| minor corrections to avoid warnings with gcc 3 | |
| further corrections and minor improvements: | |
| configure script is generated with autoconf 2.57 (no longer 2.52) | |
| configure passes CFLAGS to Makefile | |
| option -??? for complete list of address options and their short forms | |
| program name in syslog messages is derived from argv[0] | |
| SIGHUP now prints notice instead of error | |
| EIO during read of pty now gives Notice instead of Error, and | |
| triggers EOF | |
| use of hstrerror() for printing resolver error messages | |
| setgrent() got required endgrent() | |
| ####################### V 1.3.1.0: | |
| new features: | |
| integration of Wietse Venema's tcpwrapper library (libwrap) | |
| with "proxy" address, option "resolve" controls if hostname or IP | |
| address is sent in request | |
| option "lowport" establishes limited authorization for TCP and UDP | |
| connections | |
| improvement of .spec file for RPM creation (thanks to Gerd v. Egidy) | |
| An accompanying change in the numbering scheme results in an | |
| incompatibility with earlier socat RPMs! | |
| solved problems and bugs: | |
| PROBLEM: socat daemon terminated when the address of a connecting | |
| client did not match range option value instead of continue listening | |
| SOLVED: in this case, print warning instead of error to keep daemon | |
| active | |
| PROBLEM: tcp-listen with fork sometimes left excessive number of zombie | |
| processes | |
| SOLVED: dont assume that each exiting child process generates SIGCHLD | |
| when converting CRNL to CR, socat converted to NL | |
| further corrections: | |
| configure script now disables features that depend on missing files | |
| making it more robust in "unsupported" environments | |
| server.pem permissions corrected to 600 | |
| "make install" now does not strip; use "make strip; make install" | |
| if you like strip (suggested by Peter Bray) | |
| ####################### V 1.3.0.1: | |
| solved problems and bugs: | |
| PROBLEM: OPENSSL did not apply tcp, ip, and socket options | |
| SOLVED: OPENSSL now correctly handles the options list | |
| PROBLEM: CRNL to NL and CRNL to CR conversions failed when CRNL crossed | |
| block boundary | |
| SOLVED: these conversions now simply strip all CR's or NL's from input | |
| stream | |
| porting: | |
| SunOS ptys now work on x86, too (thanks to Peter Bray) | |
| configure looks for freeware libs in /pkgs/lib/ (thanks to Peter Bray) | |
| further corrections: | |
| added WITH_PROXY value to -V output | |
| added compile dependencies of WITH_PTY and WITH_PROXY | |
| -?? did not print option group of proxy options | |
| corrected syntax for bind option in docu | |
| corrected an issue with stdio in unidirectional mode | |
| options socksport and proxyport support service names | |
| ftp.sh script supports proxy address | |
| man page no longer installed with execute permissions (thanks to Peter | |
| Bray) | |
| fixed a malloc call bug that could cause SIGSEGV or false "out of | |
| memory" errors on EXEC and SYSTEM, depending on program name length and | |
| libc. | |
| ####################### V 1.3.0.0: | |
| new features: | |
| proxy connect with optional proxy authentication | |
| combined hex and text dump mode, credits to Gregory Margo | |
| address pty applies options user, group, and perm to device | |
| solved problems and bugs: | |
| PROBLEM: option reuseport was not applied (BSD, AIX) | |
| SOLVED: option reuseport now in phase PASTSOCKET instead of PREBIND, | |
| credits to Jean-Baptiste Marchand | |
| PROBLEM: ignoreeof with stdio was ignored | |
| SOLVED: ignoreeof now works correctly with address stdio | |
| PROBLEM: ftp.sh did not use user supplied password | |
| SOLVED: ftp.sh now correctly passes password from command line | |
| PROBLEM: server.pem had expired | |
| SOLVED: new server.pem valid for ten years | |
| PROBLEM: socks notice printed wrong port on some platforms | |
| SOLVED: socks now uses correct byte-order for port number in notice | |
| further corrections: | |
| option name o_trunc corrected to o-trunc | |
| combined use of -u and -U is now detected and prevented | |
| made message system a little more robust against format string attacks | |
| ####################### V 1.2.0.0: | |
| new features: | |
| address pty for putting socat behind a new pseudo terminal that may | |
| fake a serial line, modem etc. | |
| experimental openssl integration | |
| (it does not provide any trust between the peers because is does not | |
| check certificates!) | |
| options flock-ex, flock-ex-nb, flock-sh, flock-sh-nb to control all | |
| locking mechanism provided by flock() | |
| options setsid and setpgid now available with all address types | |
| option ctty (controlling terminal) now available for all TERMIOS | |
| addresses | |
| option truncate (a hybrid of open(.., O_TRUNC) and ftruncate()) is | |
| replaced by options o-trunc and ftruncate=offset | |
| option sourceport now available with TCP and UDP listen addresses to | |
| restrict incoming client connections | |
| unidirectional mode right-to-left (-U) | |
| solved problems and bugs: | |
| PROBLEM: addresses without required parameters but an option containing | |
| a '/' were incorrectly interpreted as implicit GOPEN address | |
| SOLVED: if an address does not have ':' separator but contains '/', | |
| check if the slash is before the first ',' before assuming | |
| implicit GOPEN. | |
| porting: | |
| ptys under SunOS work now due to use of stream options | |
| further corrections: | |
| with -d -d -d -d -D, don't print debug info during file analysis | |
| ####################### V 1.1.0.1: | |
| new features: | |
| .spec file for RPM generation | |
| solved problems and bugs: | |
| PROBLEM: GOPEN on socket did not apply option unlink-late | |
| SOLUTION: GOPEN for socket now applies group NAMED, phase PASTOPEN | |
| options | |
| PROBLEM: with unidirectional mode, an unnecessary close timeout was | |
| applied | |
| SOLUTION: in unidirectional mode, terminate without wait time | |
| PROBLEM: using GOPEN on a unix domain socket failed for datagram | |
| sockets | |
| SOLUTION: when connect() fails with EPROTOTYPE, use a datagram socket | |
| further corrections: | |
| open() flag options had names starting with "o_", now corrected to "o-" | |
| in docu, *-listen addresses were called *_listen | |
| address unix now called unix-connect because it does not handle unix | |
| datagram sockets | |
| in test.sh, apply global command line options with all tests | |
| ####################### V 1.1.0.0: | |
| new features: | |
| regular man page and html doc - thanks to kromJx for prototype | |
| new address type "readline", utilizing GNU readline and history libs | |
| address option "history-file" for readline | |
| new option "dash" to "exec" address that allows to start login shells | |
| syslog facility can be set per command line option | |
| new address option "tcp-quickack", found in Linux 2.4 | |
| option -g prevents option group checking | |
| filan and procan can print usage | |
| procan prints rlimit infos | |
| solved problems and bugs: | |
| PROBLEM: raw IP socket SIGSEGV'ed when it had been shut down. | |
| SOLVED: set eof flag of channel on shutdown. | |
| PROBLEM: if channel 2 uses a single non-socket FD in bidirectional mode | |
| and has data available while channel 1 reaches EOF, the data is | |
| lost. | |
| SOLVED: during one loop run, first handle all data transfers and | |
| _afterwards_ handle EOF. | |
| PROBLEM: despite to option NONBLOCK, the connect() call blocked | |
| SOLVED: option NONBLOCK is now applied in phase FD instead of LATE | |
| PROBLEM: UNLINK options issued error when file did not exist, | |
| terminating socat | |
| SOLVED: failure of unlink() is only warning if errno==ENOENT | |
| PROBLEM: TCP6-LISTEN required numeric port specification | |
| SOLVED: now uses common TCP service resolver | |
| PROBLEM: with PIPE, wrong FDs were shown for data transfer loop | |
| SOLVED: retrieval of FDs now pays respect to PIPE pecularities | |
| PROBLEM: using address EXEC against an address with IGNOREEOF, socat | |
| never terminated | |
| SOLVED: corrected EOF handling of sigchld | |
| porting: | |
| MacOS and old AIX versions now have pty | |
| flock() now available on Linux (configure check was wrong) | |
| named pipe were generated using mknod(), which requires root under BSD | |
| now they are generated using mkfifo | |
| further corrections: | |
| lots of address options that were "forgotten" at runtime are now | |
| available | |
| option BINDTODEVICE now also called SO-BINDTODEVICE, IF | |
| "make install" now installs binaries with ownership 0:0 | |
| ####################### V 1.0.4.2: | |
| solved problems and bugs: | |
| PROBLEM: EOF of one stream caused close of other stream, giving it no | |
| chance to go down regularly | |
| SOLVED: EOF of one stream now causes shutdown of write part of other | |
| stream | |
| PROBLEM: sending mail via socks address to qmail showed that crlf | |
| option does not work | |
| SOLVED: socks address applies PH_LATE options | |
| PROBLEM: in debug mode, no info about socat and platform was issued | |
| SOLVED: print socat version and uname output in debug mode | |
| PROBLEM: invoking socat with -t and no following parameters caused | |
| SIGSEGV | |
| SOLVED: -t and -b now check next argv entry | |
| PROBLEM: when opening of logfile (-lf) failed, no error was reported | |
| and no further messages were printed | |
| SOLVED: check result of fopen and print error message if it failed | |
| new features: | |
| address type UDP-LISTEN now supports option fork: it internally applies | |
| socket option SO_REUSEADDR so a new UDP socket can bind to port after | |
| `accepting´ a connection (child processes might live forever though) | |
| (suggestion from Damjan Lango) | |
| ####################### V 1.0.4.1: | |
| solved problems and bugs: | |
| PROB: assert in libc caused an endless recursion | |
| SOLVED: no longer catch SIGABRT | |
| PROB: socat printed wrong verbose prefix for "right to left" packets | |
| SOLVED: new parameter for xiotransfer() passes correct prefix | |
| new features: | |
| in debug mode, socat prints its command line arguments | |
| in verbose mode, escape special characters and replace unprintables | |
| with '.'. Patch from Adrian Thurston. | |
| ####################### V 1.0.4.0: | |
| solved problems and bugs: | |
| Debug output for lstat and fstat said "stat" | |
| further corrections: | |
| FreeBSD now includes libutil.h | |
| new features: | |
| option setsid with exec/pty | |
| option setpgid with exec/pty | |
| option ctty with exec/pty | |
| TCP V6 connect test | |
| gettimeofday in sycls.c (no use yet) | |
| porting: | |
| before Gethostbyname, invoke inet_aton for MacOSX | |
| ####################### V 1.0.3.0: | |
| solved problems and bugs: | |
| PROB: test 9 of test.sh (echo via file) failed on some platforms, | |
| socat exited without error message | |
| SOLVED: _xioopen_named_early(): preset statbuf.st_mode with 0 | |
| PROB: test 17 hung forever | |
| REASON: child death before select loop did not result in EOF | |
| SOLVED: check of existence of children before starting select loop | |
| PROB: test 17 failed | |
| REASON: child dead triggered EOF before last data was read | |
| SOLVED: after child death, read last data before setting EOF | |
| PROB: filan showed that exec processes incorrectly had fd3 open | |
| REASON: inherited open fd3 from main process | |
| SOLVED: set CLOEXEC flag on pty fd in main process | |
| PROB: help printed "undef" instead of group "FORK" | |
| SOLVED: added "FORK" to group name array | |
| PROB: fatal messages did not include severity classifier | |
| SOLVED: added "F" to severity classifier array | |
| PROB: IP6 addresses where printed incorrectly | |
| SOLVED: removed type casts to unsigned short * | |
| further corrections: | |
| socat catches illegal -l modes | |
| corrected error message on setsockopt(linger) | |
| option tabdly is of type uint | |
| correction for UDP over IP6 | |
| more cpp conditionals, esp. for IP6 situations | |
| better handling of group NAMED options with listening UNIX sockets | |
| applyopts2 now includes last given phase | |
| corrected option group handling for most address types | |
| introduce dropping of unappliable options (dropopts, dropopts2) | |
| gopen now accepts socket and unix-socket options | |
| exec and system now accept all socket and termios options | |
| child process for exec and system addresses with option pty | |
| improved descriptions and options for EXAMPLES | |
| printf format for file mode changed to "0%03o" with length spec. | |
| added va_end() in branch of msg() | |
| changed phase of lock options from PASTOPEN to FD | |
| support up to four early dying processes | |
| structural changes: | |
| xiosysincludes now includes sysincludes.h for non xio files | |
| new features: | |
| option umask | |
| CHANGES file | |
| TYPE_DOUBLE, u_double | |
| OFUNC_OFFSET | |
| added getsid(), setsid(), send() to sycls | |
| procan prints sid (session id) | |
| mail.sh gets -f (from) option | |
| new EXAMPLEs for file creation | |
| gatherinfo.sh now tells about failures | |
| test.sh can check for much more address/option combinations | |
| porting: | |
| ispeed, ospeed for termios on FreeBSD | |
| getpgid() conditional for MacOS 10 | |
| added ranlib in Makefile.in for MacOS 10 | |
| disable pty option if no pty mechanism is available (MacOS 10) | |
| now compiles and runs on MacOS 10 (still some tests fail) | |
| setgroups() conditional for cygwin | |
| sighandler_t defined conditionally | |
| use gcc option -D_GNU_SOURCE |