| blob | 73037048de4c4ea24085a57ff374d45404681d85 |
1
2 Corrections:
3 Socat 1.7.4.2 did not compile on OmniOS (and probably other OpenSolaris
4 distributions)
5 Thanks to Andy Fiddaman for sending a patch.
7 Socat since 1.7.4.0 did not compile on Solaris and its derivatives
8 because the getprotobynumber_r() function prototype differ from the
9 Linux versino.
10 configure now checks for the variant.
11 Thanks to Robert Zybeck for reporting this issue.
13 ####################### V 1.7.4.2:
15 Corrections:
16 The per address parameters for OpenSSL overlapped in memory with socket
17 parameters. Magically this did not seem to cause problems except on
18 MacOS Catalina that reported errors like:
19 socat[3458] E Select(7, &0x80, NULL, NULL, {140392884396544.000000}):
20 Invalid argument
21 Test: OPENSSL_PARA_OVERLAP
22 Thanks to Ryo Ota for reporting this bug.
24 Fixed a few minor coding issues
26 A VSOCK warning message was generated with all listening addresses
27 instead of only with VSOCK-LISTEN
29 When an OPENSSL-CONNECT client presented a certificate with IPv6
30 subject alternate name and the OPENSSL-LISTEN server had no commonname
31 option, the server crashed with SIGSEGV in xioip6_pton().
32 Test: OPENSSL_CLIENT_IP6_CN
33 Red Hat bug 1981308
34 Thanks to Vlad Slepukhin for reporting this issue and providing a patch
36 Corrected a typo in configure.ac that broke option --enable-openssl-base
37 Thanks to john1doe for reporting this issue.
39 Socat looped endlessly, not responding to SIGTERM, when a service name
40 (for port) could not be resolved.
41 Test: BAD_SERVICE
43 Using options of NAMED group, e.g.chown, with abstract UNIX domain
44 sockets, produced errors because the function was applied with a normal
45 file system related call, e.g.chown(), using file "" (empty name). Instead of
46 chown(), Socat now uses fchown() on the file descriptor. However, such
47 a call usually has no real effect.
48 Test: ABSTRACT_USER
49 Thanks to Andreas Fink for reporting this issue.
51 Option -R did not only dump ("sniff") right-to-left, but also
52 left-to-right traffic to the given file.
53 Test: SNIFF_RIGHT_TO_LEFT
54 Thanks to 1314 gsf for reporting this bug and sending a patch.
56 Options -r and -R, when opening a named pipe that has no actual reader,
57 failed with "No such device or address". To solve this problem, Socat
58 now opens the pipe in rw-Mode.
59 Thanks to Cody J.Soultz for sending a patch.
61 The call "socat -r - PIPE" traced to file ./- instead of issuing a
62 syntax error.
64 Print a message when readbytes option causes EOF
66 The ip-recverr option had no effect. Corrected and improved its
67 handling of ancilliary messages, so it is able to analyze ICMP error
68 packets (Linux only?)
70 Setgui(), Setuid() calls in xio-progcall.c were useless.
72 Testing:
73 Prevent the TIMESTAMP tests from sporadically failing due do seconds
74 overflow
76 Fixed in test.sh a few issues reported by shellcheck
78 Documentation:
79 Added missing docu of OpenSSL options min-proto-version,
80 max-proto-version.
82 Added missing closing parenthesis in socat.yo.
83 Thanks to Emanuele Torre for reporting this issue.
85 Corrected more typos and added missing bug info to CHANGES, performed
86 some non functional corrections.
88 Porting:
89 Corrected building when clock_gettime() not available, with or without
90 gettimeofday().
92 ####################### V 1.7.4.1:
94 Corrections:
95 Socat 1.7.4.0 failed to compile especially on 32 bit systems.
96 Thanks to Wang Mingyu and others for sending a patch or reporting this
97 issue.
99 Under certain conditions OpenSSL stream connections, in particular bulk
100 data transfer in unidirectional mode, failed during transfer or near
101 its with Connection reset by peer on receiver side.
102 This happened with Socat versions 1.7.3.3 to 1.7.4.0. Reasons were
103 lazy SSL shutdown handling on the sender side in combination with
104 SSL_MODE_AUTO_RETRY turned off.
105 Fix: After SSH_shutdown but before socket shutdown call SSL_read()
106 Test: OPENSSL_STREAM_TO_SERVER
107 Fixes Red Hat issue 1870279.
109 ####################### V 1.7.4.0:
111 Security:
112 Buffer size option (-b) is internally doubled for CR-CRLF conversion,
113 but not checked for integer overflow. This could lead to heap based
114 buffer overflow, assuming the attacker could provide this parameter.
115 Test: BLKSIZE_INT_OVERFL
116 Thanks to Lê Hiếu Bùi for reporting this issue and sending an
117 example exploit.
119 Corrections:
120 Socats address parser read over end of string when there were unbalanced
121 quotes
122 Test: UNBALANCED_QUOTE
124 Removed unused usleep() call from sycls.c
126 Unsetenv() was conditional in sysutils.c but not in xio-openssl.c thus
127 building failed on Solaris 9.
128 Thanks to Greg Earle for reporting this issue and providing a patch.
130 Mitigated race condition of quickly terminating SYSTEM or EXEC child
131 processes.
133 Option o-direct might require alignment of read/write buffer to, e.g.,
134 512 bytes, Socat now takes care of this when allocating the buffer.
135 With this fix read() succeeds, however, write() still might fail when
136 not writing complete pages.
137 Test: O_DIRECT
139 There was a race condition in the way Socat UDP-RECVFROM and similar
140 addresses with option fork prevents one packet from triggering
141 multiple processes. The symptom was that Socat master process seemed to
142 hang and did not process further packets. The fix makes use of
143 pselect() system call.
144 Thanks to Fulvio Scapin for reporting this issue.
146 UNIX domain client addresses applied file system entry options (group
147 NAMED) to the server socket instead of the client (bind) socket entry.
148 Tests: UNIX_SENDTO_UNLINK UNIX_CONNECT_UNLINK
149 Thanks to Nico Williams for reporting this major issue.
151 Length of single address options was limited to 511 bytes. This value
152 is now increased to 2047 bytes.
153 Change suggested by Mario Camou.
155 Addresses of type RECVFROM with option fork looped with an error
156 message in case that the second address failed before consuming the
157 packet. The fix makes RECVFROM drop the packet when the second address
158 failed before reading it. Use retry or forever option with the second
159 address if you want to avoid data loss.
160 Fixes Red Hat bug 1907718
161 Thanks to Chunmei Xu for reporting this issue and proving the patch.
163 Socats DTLS implementation has been reworked and appears to work now
164 reasonably over UDP.
165 New addresses: OPENSSL-DTLS-SERVER (DTLS-L),
166 OPENSSL-DTLS-CLIENT (DTLS)
167 Tests: OPENSSL_DTLS_CLIENT OPENSSL_DTLS_SERVER
168 OPENSSL_METHOD_DTLS1 OPENSSL_METHOD_DTLS1.2
169 Thanks to Brandon Carpenter, Qing Wan, and Pavel Nakonechnyi for
170 sending patches.
172 filan did not output the socket protocol.
173 filan -s assumed each stream socket to be TCP and each datagram socket
174 to be UDP. Now it uses SO_PROTOCOL and getprotoent() for correct output.
176 Help text showed two parameters for UDP4-RECVFROM address, but only
177 <port> is allowed.
178 Thanks to John the Scott for reporting this issue.
180 Error messages from SSL_read() and SSL_write() sometimes stated
181 SSL_connect instead of originating function name.
183 Fixed some more non functional minor issues.
185 Porting:
186 In gcc version 10 the default changed from -fcommon to -fno-common.
187 Consequently, linking filan and procan failed with error
188 "multiple definition of `deny_severity'" and `allow_severity'
189 Fixed by removing definitions in filan.c and procan.c
190 Debian issue 957823
191 Thanks to László Böszörményi and others for reporting this issue.
193 Solaris 9 does not provide strndup(); added substitute code.
194 Thanks to Greg Earle for providing a patch.
196 Added configure option --enable-openssl-base to specify the location of
197 a non-OS OpenSSL installation
199 There are systems whose kernel understands SCTP but getaddrinfo does
200 not. As workaround after EIA_SOCKTYPE on name and service resolution
201 fall back to ai_socktype=0; if it fails with EAI_SERVICE, set
202 ai_protocol=0 and try again
203 Test: SCTP_SERVICENAME
205 Per file filesystem options were still named ext2-* and depended on
206 <linux/ext2_fs.h>. Now they are called fs-* and depend on <linux/fs.h>.
207 These fs-* options are also available on old systems with ext2_fs.h
209 New options openssl-min-proto-version (min-version) and
210 openssl-max-proto-version (max-version) give access to the related
211 OpenSSL set-macros and substitute deprecated version-specific methods.
212 Test: OPENSSL_MIN_VERSION
214 With OpenSSL use OPENSSL_init_SSL when available, instead of deprecated
215 SSL_library_init.
217 With OPENSSL_API_COMPAT=0x10000000L the files openssl/dh.h, openssl/bn.h
218 must explicitely be included.
219 Thanks to Rosen Penev for reporting and sending a patch.
221 Testing:
222 test.sh now produces a list of tests that could not be performed for
223 any reason. This helps to analyse these cases.
225 OpenSSL s_server appearently started to neglect TCPs half close feature.
226 Test OPENSSL_TCP4 has been changed to tolerate this.
228 OpenSSL changed its behaviour when connection is rejected. Tests
229 OPENSSLCERTSERVER, OPENSSL_CN_CLIENT_SECURITY, and
230 OPENSSL_CN_SERVER_SECURITY now tolerate this.
232 OpenSSL no longer allows explicit renegotiation with TLSv1.3, thus the
233 appropriate tests failed.
234 Fix: use TLSv1.2 for renegotiation tests
235 Tests: OPENSSLRENEG1 OPENSSLRENEG2
237 Ubuntu 20.04 requires 2048 bit certificates with OpenSSL
239 Archlinux 2020 has not which command; its ip,ss commands have modified
240 version strings
242 More testing issues solved:
243 * ss to pipe might omit column separator
244 * UDP6MULTICAST_UNIDIR fails on newer Linux kernels
245 * do not use sort -V
246 * renamed testaddrs() to testfeats(), and introduced new testaddrs()
248 New features:
249 GOPEN and UNIX-CLIENT addresses now support sockets of type SEQPACKET.
250 Test: GOPENUNIXSEQPACKET
251 Feature suggested by vi0oss.
253 The generic setsockopt-int and related options are, in case of
254 listening/accepting addresses, applied to the connected socket(s). To enable
255 setting options on the listening socket, a new option setsockopt-listen
256 has been implemented. See the documentation for info on data types.
257 Tests: SETSOCKOPT SETSOCKOPT_LISTEN
258 Thanks to Steven Danna and Korian Edeline for reporting this issue.
260 Filan option -S gives short description like -s but with improved
261 format
263 Socat OpenSSL client, when server was specified using IP address, did
264 not verify connection on certificates SubjectAltName IP entries.
265 Tests: OPENSSL_SERVERALTAUTH OPENSSL_SERVERALTIP4AUTH OPENSSL_SERVERALTIP6AUTH
266 Fixes Red Hat bug 1805132
268 Added options -r and -R for raw dump of transferred data to files.
269 Test: OPTION_RAW_DUMP
271 Added option ip-transparent (socket option IP_TRANSPARENT)
272 Thanks to Wang Shanker for sending a patch.
274 OPENSSL-CONNECT now automatically uses the SNI feature, option
275 openssl-no-sni turns it off. Option openssl-snihost overrides the value
276 of option openssl-commonname or the server name.
277 Tests: OPENSSL_SNI OPENSSL_NO_SNI
278 Thanks to Travis Burtrum for providing the initial patch
280 New option accept-timeout (listen-timeout)
281 Test: ACCEPTTIMEOUT
282 Proposed by Roland
284 New option ip-add-source-membership
285 Feature inspired by Brian (b f31415)
287 INCOMPATIBLE CHANGE: Address UDP-DATAGRAM now does not check peerport
288 of replies, as it did up to version 1.7.3.4. Use option sourceport when
289 you need the old behaviour.
290 Test: UDP_DATAGRAM_SOURCEPORT
291 Feature inspired by Hans Bueckler for SSDP inquiry (for UPnP)
293 New option proxy-authorization-file reads PROXY-CONNECT credentials
294 from file and makes it possible to hide this data from the process
295 table.
296 Test: PROXYAUTHFILE
297 Thanks to Charles Stephens for sending an initial patch.
299 Added AF_VSOCK support with VSOCK-CONNECT and VSOCK-LISTEN addresses.
300 Developed by Stefano Garzarella.
302 Coding:
303 Added printf formats for uint16_t etc.
305 Documentation:
306 Address UDP-RECV does not support option fork.
307 Thanks to Fulvio Scapin for reporting that mistake in docu.
309 TUN address documentation showed TCP for backend which may merge
310 consecutive packets which causes data loss.
311 Thanks to Tomasz Lakota for reporting this issue.
313 ####################### V 1.7.3.4:
315 Corrections:
316 Header of xiotermios_speed() declared parameter unsigned int instead of
317 speed_t, thus compiling failed on MacOS
318 Thanks to Joe Strout and others for reporting this bug.
319 Thanks to Andrew Childs and others for sending a patch.
321 Under certain circumstances, termios options of the first address were
322 applied to the second address, resulting in error
323 "Inappropriate ioctl for device"
324 This affected version 1.7.3.3 only.
325 Test: TERMIOS_PH_ALL
326 Thanks to Ivan J. for reporting this issue.
328 Socat failed to compile when no poll() system call was found by
329 configure.
330 Thanks to Jason White for sending a patch.
332 Due to use of SSL_CTX_clear_mode() Socat failed to compile on old
333 systems with, e.g., OpenSSL-0.9.8. Thanks to Simon Matter and Moritz B.
334 for reporting this problem and sending initial patches.
336 getaddrinfo() in IP4-SENDTO and IP6-SENDTO addresses failed with
337 "ai_socktype not supported" when protocol 6 was addressed.
338 The fix removes the possibility to use service names with SCTP.
339 Test: IP_SENDTO_6
340 Thanks to Sören for sending an initial patch.
342 Under certain circumstances, Socat printed the "socket ... is at EOF"
343 multiple times.
344 Test: MULTIPLE_EOF
346 Newer parts of test.sh used substitutions ${x,,*} or ${x^^*} that are
347 not implemented in older bash versions.
349 ####################### V 1.7.3.3:
351 Corrections:
352 Makefile.in did not specify dependencies of filan on vsnprintf_r.o
353 and snprinterr.o
354 Added definition of FILAN_OBJS
355 Thanks to Craig Leres, Clayton Shotwell, and Chris Packham for
356 providing patches.
358 configure option --enable-msglevel did not work with numbers
360 The autoconf mechanism for determining SHIFT_OFFSET did not work when
361 cross compiling.
362 Thanks to Max Freisinger from Gentoo for sending a patch.
364 Socat still depended on obsolete gethostbyname() function, thus
365 compiling with MUSL libc failed.
366 Problem reported by Kennedy33.
368 The async signal safe diagnostic system used FDs 3 and 4 internally, so
369 use of appropriate fdin or fdout led to failures.
370 Test: DIAG_FDIN
371 Problem reported by Onur Sentürk.
373 The socket based mechanism for passing messages and signal information
374 from signal handler to process could reach and kill the wrong process.
375 Introduces functions diag_sock_pair(), diag_fork()
376 Thanks to Darren Zhao for analysing and reporting this problem.
378 Option ipv6-join-group did not work because it was applied in the wrong
379 phase
380 Test: UDP6MULTICAST_UNIDIR
381 Thanks to Angus Gratton for sending a patch.
383 Setting ispeed and ospeed failed for some serial devices because the
384 two settings were applied with two different get/set cycles, Thanks to
385 Alexandre Fenyo for providing an initial patch.
386 However, the actual fix is part of a conceptual change of the termios
387 module that aims for applying all changes in a single tcsetaddr call.
388 Fixes FreeBSD Bug 198441
390 Termios options TAB0,TAB1,TAB2,TAB3, and XTABS did not have an effect.
391 Thanks to Alan Walters for reporting this bug.
393 Substituted cumbersom ISPEED_OFFSET mechanism for cfsetispeed() calls
395 With TCP6-LISTEN and the other passive IPv6 addresses the range option
396 just failed: due to a bug in the syntax parser and two more bugs in
397 the xiocheckrange_ip6() function.
398 The syntax has now been changed from "[::1/128]" to "[::1]/128"!
399 Thanks Leah Neukirchen for sending an initial fix.
401 For name resolution Socat only checked the first character of the host
402 name to decide if it is an IPv4 address. This was not RFC conform. This
403 fix removes the possibility for use of IPv4 addresses with IPv6, e.g.
404 TCP6:127.0.0.1:80
405 Debian issue 695885
406 Thanks to Nicolas Fournil for reporting this issue.
408 Print a useful error message when single character options appear to be
409 merged in Socat invocation
410 Test: SOCAT_OPT_HINT
412 Fixed some docu typos.
413 Thanks to Travis Wellman, Thomas <tjps636>, Dan Kenigsberg,
414 Julian Zinn, and Simon Matter
416 Porting:
417 OpenSSL functions TLS1_client_method() and similar are
418 deprecated. Socat now uses recommended TLS_client_method(). The old
419 functions and dependend option openssl-method can still be
420 used when configuring socat with --enable-openssl-method
422 Shell scripts in socat distribution are now headed with:
423 #! /usr/bin/env bash
424 to make them better portable to systems without /bin/bash
425 Thanks to Maya Rashish for sending a patch
427 RES_AAONLY, RES_PRIMARY are deprecated. You can still enable them with
428 configure option --enable-res-deprecated.
430 New versions of OpenSSL preset SSL_MODE_AUTO_RETRY which may hang socat.
431 Solution: clear SSL_MODE_AUTO_RETRY when it is set.
433 Renamed configure.in to configure.ac and set an appropriate symlink for
434 older environments.
435 Related Gentoo bug 426262: Warning on configure.in
436 Thanks to Francesco Turco for reporting that warning.
438 Fixed new IPv6 range code for platforms without s6_addr32 component.
440 Testing:
441 test.sh: Show a warning when phase-1 (insecure phase) of a security
442 test fails
444 OpenSSL tests failed on actual Linux distributions. Measures:
445 Increased key lengths from 768 to 1024 bits
446 Added test.sh option -C to delete temp certs from prevsious runs
447 Provide DH-parameter in certificate in PEM
448 OpenSSL s_server option -verify 0 must be omitted
449 OpenSSL authentication method aNULL no longer works
450 Failure of cipher aNULL is not a failure
451 Failure of methods SSL3 and SSL23 is desired
453 test.sh depended on ifconfig and netstat utilities which are no longer
454 availabie in some distributions. test.sh now checks for and prefers
455 ip and ss.
456 Thanks to Ruediger Meier for reporting this problem.
458 More corrections to test.sh:
459 Language settings could still influence test results
460 netstat was still required
461 Suppress usleep deprecated messag
462 Force use of IPv4 with some certificates
463 Set timeout for UDPxMAXCHILDREN tests
465 Git:
466 Added missing Config/Makefile.DragonFly-2-8-2,
467 Config/config.DragonFly-2-8-2.h
468 Removed testcert.conf (to be generated by test.sh)
470 Cosmetics:
471 Simplified handling of missing termios defines.
473 New features:
474 Permit combined -d options as -dd etc.
476 porting:
477 ext2 options are now fs options.
479 ####################### V 1.7.3.2:
481 corrections:
482 SIGSEGV and other signals could lead to a 100% CPU loop
484 Failing name resolution could lead to SIGSEGV
485 Thanks to Max for reporting this issue.
487 Include <stddef.h> for ptrdiff_t
488 Thanks to Jeroen Roovers for reporting this issue.
490 Building with --disable-sycls failed due to missing sslcls.h defines
492 Socat hung when configured with --disable-sycls.
494 Some minor corrections with includes etc.
496 Option so-reuseport did not work. Thanks to Some Raghavendra Prabhu
497 for sending a patch.
499 Programs invoked with EXEC, nofork, and -u or -U had stdin and stdout
500 incorrectly assigned
501 Test: EXEC_NOFORK_UNIDIR
502 Thanks to David Reiss for reporting this problem.
504 Socat exited with status 0 even when a program invoked with SYSTEM or
505 EXEC failed.
506 Tests: SYSTEM_RC EXEC_RC
507 Issue reported by Felix Winkelmann.
509 AddressSanitizer reported a few buffer overflows (false positives).
510 Nevertheless fixed Socat source.
511 Issue reported by Hanno Böck.
513 Socat did not use option ipv6-join-group.
514 Test: USE_IPV6_JOIN_GROUP
515 Thanks to Linus Lüssing for sending a patch.
517 UDP-LISTEN did not honor the max-children option.
518 Test: UDP4MAXCHILDREN UDP6MAXCHILDREN
519 Thanks to Leander Berwers for reporting this issue.
521 Options so-rcvtimeo and so-sndtimeo do not work with poll()/select()
522 and therefore were useless.
523 Thanks to Steve Borenstein for reporting this issue.
525 Option dhparam was documented as dhparams. Added the alias name
526 dhparams to fix this.
527 Thanks to Alexander Neumann for sending a patch.
529 Options shut-down and shut-close did not work.
530 Thanks to Stefan Schimanski for providing a patch.
532 There was a bug in printing readline log message caused by a misleading
533 indentation.
534 Thanks to Paul Wouters for reporting.
536 The internal vsnprintf_r function looped or crashed on size parameter
537 with hexadecimal output.
539 Ignore exit code of child process when it was killed by master due to
540 EOF
542 Corrected byte order on read of IPV6_TCLASS value from ancillary
543 message
545 Fixed type of the bool element in options. This had bug caused failures
546 e.g. of ignoreeof on big-endian systems when bool was not based on int.
548 On systems with predefined bool type whose size differs from int some
549 IPv6 and TCP options (per setsockopt()) failed.
551 Length of integral data in ancillary messages varies (TOS: 1 byte,
552 TTL: 4 bytes), the old implementation failed for TTL on big-endian
553 hosts.
555 Fixed an issue in options processing: TUN and DNS flags had failed on
556 big-endian systems and the NO- forms had probable never worked.
558 porting:
559 Type conflict between int and sig_atomic_t between declaration and
560 definition of diag_immediate_type and diag_immediate_exit broke
561 compilation on FreeBSD 10.1 with clang. Thanks to Emanuel Haupt for
562 reporting this bug.
564 Socat failed to compile on platforms with OpenSSL without
565 DTLSv1_client_method or DTLSv1_server_method.
566 Thanks to Simon Matter for sending a patch.
568 NuttX OS headers do not provide struct ip, thus socat did not compile.
569 Made struct ip subject to configure.
570 Thanks to SP for reporting this issue.
572 Socat failed to compile with OpenSSL version 1.0.2d where
573 SSLv3_server_method and SSLv3_client_method are no longer defined.
574 Thanks to Mischa ter Smitten for reporting this issue and providing
575 a patch.
577 configure checked for OpenSSL EC_KEY assuming it is a define but it
578 is a type, thus OpenSSL ECDHE ciphers failed even on Linux.
579 Thanks to Andrey Arapov for reporting this bug.
581 Changes to make socat compile with OpenSSL 1.1.
582 Thanks to Sebastian Andrzej Siewior e.a. from the Debian team for
583 providing the base patch.
584 Debian Bug#828550
586 Make Socat compatible with BoringSSL.
587 Thanks to Matt Braithwaite for providing a patch.
589 OpenSSL: Use RAND_status to determine PRNG state
590 Thanks to Adam Langley for providing a patch
592 AIX-7 uses an extended O_ACCMODE that does not fit socat's internal
593 requirements. Thanks to Garrick Trowsdale for providing a patch
595 LibreSSL support: check for OPENSSL_NO_COMP
596 Thanks to Bernard Spil for providing a patch
598 testing:
599 socks4echo.sh and socks4a-echo.sh hung with new bash with read -n
601 test.sh: stderr; option -v (verbose); FDOUT_ERROR description
603 improved proxy.sh - it now also takes hostnames
605 A few corrections in test.sh
607 DTLS1 test hangs on some distributions. Test is now only performed
608 with OpenSSL 1.0.2 or higher.
610 More corrections to test.sh that reveal a mistake with IPV6_TCLASS
612 docu:
613 Corrected source of socat man page to correctly show man references
614 like socket(2); removed obseolete entries from See Also
616 Docu and some comments mentioned addresses SSL-LISTEN and SSL-CONNECT
617 that do not exist (OPENSSL-LISTEN, SSL-L; and OPENNSSL-CONNECT, SSL
618 are correct).
619 Thanks to Zhigang Wang for reporting this issue.
621 Fixed a couple of English spelling and grammar mistakes.
622 Thanks to Jakub Wild for sending the patches.
624 NOEXPAND() was not resolved 2 times.
626 More minor docu corrections
628 legal:
629 Added contributors to copyright notices. Suggested by Matt Braithwaite.
631 ####################### V 1.7.3.1:
633 security:
634 Socat security advisory 8
635 A stack overflow in vulnerability was found that can be triggered when
636 command line arguments (complete address specifications, host names,
637 file names) are longer than 512 bytes.
638 Successful exploitation might allow an attacker to execute arbitrary
639 code with the privileges of the socat process.
640 This vulnerability can only be exploited when an attacker is able to
641 inject data into socat's command line.
642 A vulnerable scenario would be a CGI script that reads data from clients
643 and uses (parts of) this data as hostname for a Socat invocation.
644 Test: NESTEDOVFL
645 Credits to Takumi Akiyama for finding and reporting this issue.
647 Socat security advisory 7
648 MSVR-1499
649 In the OpenSSL address implementation the hard coded 1024 bit DH p
650 parameter was not prime. The effective cryptographic strength of a key
651 exchange using these parameters was weaker than the one one could get by
652 using a prime p. Moreover, since there is no indication of how these
653 parameters were chosen, the existence of a trapdoor that makes possible
654 for an eavesdropper to recover the shared secret from a key exchange
655 that uses them cannot be ruled out.
656 Futhermore, 1024bit is not considered sufficiently secure.
657 Fix: generated a new 2048bit prime.
658 Thanks to Santiago Zanella-Beguelin and Microsoft Vulnerability
659 Research (MSVR) for finding and reporting this issue.
661 ####################### V 1.7.3.0:
663 security:
664 Socat security advisory 6
665 CVE-2015-1379: Possible DoS with fork
666 Fixed problems with signal handling caused by use of not async signal
667 safe functions in signal handlers that could freeze socat, allowing
668 denial of service attacks.
669 Many changes in signal handling and the diagnostic messages system were
670 applied to make the code async signal safe but still provide detailled
671 logging from signal handlers:
672 Coded function vsnprintf_r() as async signal safe incomplete substitute
673 of libc vsnprintf()
674 Coded function snprinterr() to replace %m in strings with a system error
675 message
676 Instead of gettimeofday() use clock_gettime() when available
677 Pass Diagnostic messages from signal handler per unix socket to the main
678 program flow
679 Use sigaction() instead of signal() for better control
680 Turn off nested signal handler invocations
681 Thanks to Peter Lobsinger for reporting and explaining this issue.
683 Red Hat issue 1019975: add TLS host name checks
684 OpenSSL client checks if the server certificates names in
685 extensions/subjectAltName/DNS or in subject/commonName match the name
686 used to connect or the value of the openssl-commonname option.
687 Test: OPENSSL_CN_CLIENT_SECURITY
689 OpenSSL server checks if the client certificates names in
690 extensions/subjectAltNames/DNS or subject/commonName match the value of
691 the openssl-commonname option when it is used.
692 Test: OPENSSL_CN_SERVER_SECURITY
694 Red Hat issue 1019964: socat now uses the system certificate store with
695 OPENSSL when neither options cafile nor capath are used
697 Red Hat issue 1019972: needs to specify OpenSSL cipher suites
698 Default cipherlist is now "HIGH:-NULL:-PSK:-aNULL" instead of empty to
699 prevent downgrade attacks
701 new features:
702 OpenSSL addresses set couple of environment variables from values in
703 peer certificate, e.g.:
704 SOCAT_OPENSSL_X509_SUBJECT, SOCAT_OPENSSL_X509_ISSUER,
705 SOCAT_OPENSSL_X509_COMMONNAME,
706 SOCAT_OPENSSL_X509V3_SUBJECTALTNAME_DNS
707 Tests: ENV_OPENSSL_{CLIENT,SERVER}_X509_*
709 Added support for methods TLSv1, TLSv1.1, TLSv1.2, and DTLS1
710 Tests: OPENSSL_METHOD_*
712 Enabled OpenSSL server side use of ECDHE ciphers. Feature suggested
713 by Andrey Arapov.
715 Added a new option termios-rawer for ptys.
716 Thanks to Christian Vogelgsang for pointing me to this requirement
718 corrections:
719 Bind with ABSTRACT commands used non-abstract namespace (Linux).
720 Test: ABSTRACT_BIND
721 Thanks to Denis Shatov for reporting this bug.
723 Fixed return value of nestlex()
725 Option ignoreeof on the right address hung.
726 Test: IGNOREEOF_REV
727 Thanks to Franz Fasching for reporting this bug.
729 Address SYSTEM, when terminating, shut down its parent addresses,
730 e.g. an SSL connection which the parent assumed to still be active.
731 Test: SYSTEM_SHUTDOWN
733 Passive (listening or receiving) addresses with empty port field bound
734 to a random port instead of terminating with error.
735 Test: TCP4_NOPORT
737 configure with some combination of disable options produced config
738 files that failed to compile due to missing IPPROTO_TCP.
739 Thanks to Thierry Fournier for report and patch.
741 fixed a few minor bugs with OpenSSL in configure and with messages
743 Socat did not work in FIPS mode because 1024 instead of 512 bit DH prime
744 is required. Thanks to Zhigang Wang for reporting and sending a patch.
746 Christophe Leroy provided a patch that fixes memory leaks reported by
747 valgrind
749 Help for filan -L was bad, is now corrected to:
750 "follow symbolic links instead of showing their properties"
752 Address options fdin and fdout were silently ignored when not applicable
753 due to -u or -U option. Now these combinations are caught as errors.
754 Test: FDOUT_ERROR
755 Issue reported by Hendrik.
757 Added option termios-cfmakeraw that calls cfmakeraw() and is preferred
758 over option raw which is now obsolote. On SysV systems this call is
759 simulated by appropriate setting.
760 Thanks to Youfu Zhang for reporting issue with option raw.
762 porting:
763 Socat included <sys/poll.h> instead of POSIX <poll.h>
764 Thanks to John Spencer for reporting this issue.
766 Version 1.7.2.4 changed the check for gcc in configure.ac; this
767 broke cross compiling. The particular check gets reverted.
768 Thanks to Ross Burton and Danomi Manchego for reporting this issue.
770 Debian Bug#764251: Set the build timestamp to a deterministic time:
771 support external BUILD_DATE env var to allow to build reproducable
772 binaries
774 Joachim Fenkes provided an new adapted spec file.
776 Type bool and macros Min and Max are defined by socat which led to
777 compile errors when they were already provided by build framework.
778 Thanks to Liyu Liu for providing a patch.
780 David Arnstein contributed a patch for NetBSD 5.1 including stdbool.h
781 support and appropriate files in Config/
783 Lauri Tirkkonen contributed a patch regarding netinet/if_ether.h
784 on Illumos
786 Changes for Openindiana: define _XPG4_2, __EXTENSIONS__,
787 _POSIX_PTHREAD_SEMANTICS; and minor changes
789 Red Hat issue 1182005: socat 1.7.2.4 build failure missing
790 linux/errqueue.h
791 Socat failed to compile on on PPC due to new requirements for
792 including <linux/errqueue.h> and a weakness in the conditional code.
793 Thanks to Michel Normand for reporting this issue.
795 doc:
796 In the man page the PTY example was badly formatted. Thanks to
797 J.F.Sebastian for sending a patch.
799 Added missing CVE ids to security issues in CHANGES
801 testing:
802 Do not distribute testcert.conf with socat source but generate it
803 (and new testcert6.conf) during test.sh run.
805 ####################### V 1.7.2.4:
807 corrections:
808 LISTEN based addresses applied some address options, e.g. so-keepalive,
809 to the listening file descriptor instead of the connected file
810 descriptor
811 Thanks to Ulises Alonso for reporting this bug
813 make failed after configure with non gcc compiler due to missing
814 include. Thanks to Horacio Mijail for reporting this problem
816 configure checked for --disable-rawsocket but printed
817 --disable-genericsocket in the help text. Thanks to Ben Gardiner for
818 reporting and patching this bug
820 In xioshutdown() a wrong branch was chosen after RECVFROM type addresses.
821 Probably no impact.
822 Thanks to David Binderman for reporting this issue.
824 procan could not cleanly format ulimit values longer than 16 decimal
825 digits. Thanks to Frank Dana for providing a patch that increases field
826 width to 24 digits.
828 OPENSSL-CONNECT with bind option failed on some systems, eg.FreeBSD, with
829 "Invalid argument"
830 Thanks to Emile den Tex for reporting this bug.
832 Changed some variable definitions to make gcc -O2 aliasing checker happy
833 Thanks to Ilya Gordeev for reporting these warnings
835 On big endian platforms with type long >32bit the range option applied a
836 bad base address. Thanks to hejia hejia for reporting and fixing this bug.
838 Red Hat issue 1022070: missing length check in xiolog_ancillary_socket()
840 Red Hat issue 1022063: out-of-range shifts on net mask bits
842 Red Hat issue 1022062: strcpy misuse in xiosetsockaddrenv_ip4()
844 Red Hat issue 1022048: strncpy hardening: corrected suspicious strncpy()
845 uses
847 Red Hat issue 1021958: fixed a bug with faulty buffer/data length
848 calculation in xio-ascii.c:_xiodump()
850 Red Hat issue 1021972: fixed a missing NUL termination in return string
851 of sysutils.c:sockaddr_info() for the AF_UNIX case
853 fixed some typos and minor issues, including:
854 Red Hat issue 1021967: formatting error in manual page
856 UNIX-LISTEN with fork option did not remove the socket file system entry
857 when exiting. Other file system based passive address types had similar
858 issues or failed to apply options umask, user e.a.
859 Thanks to Lorenzo Monti for pointing me to this issue
861 porting:
862 Red Hat issue 1020203: configure checks fail with some compilers.
863 Use case: clang
865 Performed changes for Fedora release 19
867 Adapted, improved test.sh script
869 Red Hat issue 1021429: getgroupent fails with large number of groups;
870 use getgrouplist() when available instead of sequence of calls to
871 getgrent()
873 Red Hat issue 1021948: snprintf API change;
874 Implemented xio_snprintf() function as wrapper that tries to emulate C99
875 behaviour on old glibc systems, and adapted all affected calls
876 appropriately
878 Mike Frysinger provided a patch that supports long long for time_t,
879 socklen_t and a few other libc types.
881 Artem Mygaiev extended Cedril Priscals Android build script with pty code
883 The check for fips.h required stddef.h
884 Thanks to Matt Hilt for reporting this issue and sending a patch
886 Check for linux/errqueue.h failed on some systems due to lack of
887 linux/types.h inclusion. Thanks to Michael Vastola for sending a patch.
889 autoconf now prefers configure.ac over configure.in
890 Thanks to Michael Vastola for sending a patch.
892 type of struct cmsghdr.cmsg is system dependend, determine it with
893 configure; some more print format corrections
895 docu:
896 libwrap always logs to syslog
898 added actual text version of GPLv2
900 ####################### V 1.7.2.3:
902 security:
903 Socat security advisory 5
904 CVE-2014-0019: socats PROXY-CONNECT address was vulnerable to a buffer
905 overflow with data from command line (see socat-secadv5.txt)
906 Credits to Florian Weimer of the Red Hat Product Security Team
908 ####################### V 1.7.2.2:
910 security:
911 Socat security advisory 4
912 CVE-2013-3571:
913 after refusing a client connection due to bad source address or source
914 port socat shutdown() the socket but did not close() it, resulting in
915 a file descriptor leak in the listening process, visible with lsof and
916 possibly resulting in EMFILE Too many open files. This issue could be
917 misused for a denial of service attack.
918 Full credits to Catalin Mitrofan for finding and reporting this issue.
920 ####################### V 1.7.2.1:
922 security:
923 Socat security advisory 3
924 CVE-2012-0219:
925 fixed a possible heap buffer overflow in the readline address. This bug
926 could be exploited when all of the following conditions were met:
927 1) one of the addresses is READLINE without the noprompt and without the
928 prompt options.
929 2) the other (almost arbitrary address) reads malicious data (which is
930 then transferred by socat to READLINE).
931 Workaround: when using the READLINE address apply option prompt or
932 noprompt.
933 Full credits to Johan Thillemann for finding and reporting this issue.
935 ####################### V 1.7.2.0:
937 corrections:
938 when UNIX-LISTEN was applied to an existing file it failed as expected
939 but removed the file. Thanks to Bjoern Bosselmann for reporting this
940 problem
942 fixed a bug where socat might crash when connecting to a unix domain
943 socket using address GOPEN. Thanks to Martin Forssen for bug report and
944 patch.
946 UDP-LISTEN would alway set SO_REUSEADDR even without fork option and
947 when user set it to 0. Thanks to Michal Svoboda for reporting this bug.
949 UNIX-CONNECT did not support half-close. Thanks to Greg Hughes who
950 pointed me to that bug
952 TCP-CONNECT with option nonblock reported successful connect even when
953 it was still pending
955 address option ioctl-intp failed with "unimplemented type 26". Thanks
956 to Jeremy W. Sherman for reporting and fixing that bug
958 socat option -x did not print packet direction, timestamp etc; thanks
959 to Anthony Sharobaiko for sending a patch
961 address PTY does not take any parameters but did not report an error
962 when some were given
964 Marcus Meissner provided a patch that fixes invalid output and possible
965 process crash when socat prints info about an unnamed unix domain
966 socket
968 Michal Soltys reported the following problem and provided an initial
969 patch: when socat was interrupted, e.g. by SIGSTOP, and resumed during
970 data transfer only parts of the data might have been written.
972 Option o-nonblock in combination with large transfer block sizes
973 may result in partial writes and/or EAGAIN errors that were not handled
974 properly but resulted in data loss or process termination.
976 Fixed a bug that could freeze socat when during assembly of a log
977 message a signal was handled that also printed a log message. socat
978 development had been aware that localtime() is not thread safe but had
979 only expected broken messages, not corrupted stack (glibc 2.11.1,
980 Ubuntu 10.4)
982 an internal store for child pids was susceptible to pid reuse which
983 could lead to sporadic data loss when both fork option and exec address
984 were used. Thanks to Tetsuya Sodo for reporting this problem and
985 sending a patch
987 OpenSSL server failed with "no shared cipher" when using cipher aNULL.
988 Fixed by providing temporary DH parameters. Thanks to Philip Rowlands
989 for drawing my attention to this issue.
991 UDP-LISTEN slept 1s after accepting a connection. This is not required.
992 Thanks to Peter Valdemar Morch for reporting this issue
994 fixed a bug that could lead to error or socat crash after a client
995 connection with option retry had been established
997 fixed configure.in bug on net/if.h check that caused IF_NAMESIZE to be
998 undefined
1000 improved dev_t print format definition
1002 porting:
1003 Cedril Priscal ported socat to Android (using Googles cross compiler).
1004 The port includes the socat_buildscript_for_android.sh script
1006 added check for component ipi_spec_dst in struct in_pktinfo so
1007 compilation does not fail on Cygwin (thanks to Peter Wagemans for
1008 reporting this problem)
1010 build failed on RHEL6 due to presence of fips.h; configure now checks
1011 for fipsld too. Thanks to Andreas Gruenbacher for reporting this
1012 problem
1014 check for netinet6/in6.h only when IPv6 is available and enabled
1016 don't fail to compile when the following defines are missing:
1017 IPV6_PKTINFO IPV6_RTHDR IPV6_DSTOPTS IPV6_HOPOPTS IPV6_HOPLIMIT
1018 Thanks to Jerry Jacobs for reporting this problem (Mac OS X Lion 10.7)
1020 check if define __APPLE_USE_RFC_2292 helps to enable IPV6_* (MacOSX
1021 Lion 7.1); thanks to Jerry Jacobs to reporting this problem and
1022 proposing a solution
1024 fixed compiler warnings on Mac OS X 64bit. Thanks to Guy Harris for
1025 providing the patch.
1027 corrections for OpenEmbedded, especially termios SHIFT values and
1028 ISPEED/OSPEED. Thanks to John Faith for providing the patch
1030 minor corrections to docu and test.sh resulting from local compilation
1031 on Openmoko SHR
1033 fixed sa_family_t compile error on DragonFly. Thanks to Tony Young for
1034 reporting this issue and sending a patch.
1036 Ubuntu Oneiric: OpenSSL no longer provides SSLv2 functions; libutil.sh
1037 is now bsd/libutil.h; compiler warns on vars that is only written to
1039 new features:
1040 added option max-children that limits the number of concurrent child
1041 processes. Thanks to Sam Liddicott for providing the patch.
1043 Till Maas added support for tun/tap addresses without IP address
1045 added an option openssl-compress that allows to disable the compression
1046 feature of newer OpenSSL versions. Thanks to Michael Hanselmann for
1047 providing this contribution (sponsored by Google Inc.)
1049 docu:
1050 minor corrections in docu (thanks to Paggas)
1052 client process -> child process
1054 ####################### V 1.7.1.3:
1056 security:
1057 Socat security advisory 2
1058 CVE-2010-2799:
1059 fixed a stack overflow vulnerability that occurred when command
1060 line arguments (whole addresses, host names, file names) were longer
1061 than 512 bytes.
1062 Note that this could only be exploited when an attacker was able to
1063 inject data into socat's command line.
1064 Full credits to Felix Gröbert, Google Security Team, for finding and
1065 reporting this issue
1067 ####################### V 1.7.1.2:
1069 corrections:
1070 user-late and group-late, when applied to a pty, affected the system
1071 device /dev/ptmx instead of the pty (thanks to Matthew Cloke for
1072 pointing me to this bug)
1074 socats openssl addresses failed with "nonblocking operation did not
1075 complete" when the peer performed a renegotiation. Thanks to Benjamin
1076 Delpy for reporting this bug.
1078 info message during socks connect showed bad port number on little
1079 endian systems due to wrong byte order (thanks to Peter M. Galbavy for
1080 bug report and patch)
1082 Debian bug 531078: socat execs children with SIGCHLD ignored; corrected
1083 to default. Thanks to Martin Dorey for reporting this bug.
1085 porting:
1086 building socat on systems that predefined the CFLAGS environment to
1087 contain -Wall failed (esp.RedHat). Thanks to Paul Wouters for reporting
1088 this problem and to Simon Matter for providing the patch
1090 support for Solaris 8 and Sun Studio support (thanks to Sebastian
1091 Kayser for providing the patches)
1093 on some 64bit systems a compiler warning "cast from pointer to integer
1094 of different size" was issued on some option definitions
1096 added struct sockaddr_ll to union sockaddr_union to avoid "strict
1097 aliasing" warnings (problem reported by Paul Wouters)
1099 docu:
1100 minor corrections in docu
1102 ####################### V 1.7.1.1:
1104 corrections:
1105 corrected the "fixed possible SIGSEGV" fix because SIGSEGV still might
1106 occur under those conditions. Thanks to Toni Mattila for first
1107 reporting this problem.
1109 ftruncate64 cut its argument to 32 bits on systems with 32 bit long type
1111 socat crashed on systems without setenv() (esp. SunOS up to Solaris 9);
1112 thanks to Todd Stansell for reporting this bug
1114 with unidirectional EXEC and SYSTEM a close() operation was performed
1115 on a random number which could result in hanging e.a.
1117 fixed a compile problem caused by size_t/socklen_t mismatch on 64bit
1118 systems
1120 docu mentioned option so-bindtodev but correct name is so-bindtodevice.
1121 Thanks to Jim Zimmerman for reporting.
1123 docu changes:
1124 added environment variables example to doc/socat-multicast.html
1126 ####################### V 1.7.1.0:
1128 new features:
1129 address options shut-none, shut-down, and shut-close allow to control
1130 socat's half close behaviour
1132 with address option shut-null socat sends an empty packet to the peer
1133 to indicate EOF
1135 option null-eof changes the behaviour of sockets that receive an empty
1136 packet to see EOF instead of ignoring it
1138 introduced option names substuser-early and su-e, currently equivalent
1139 to option substuser (thanks to Mike Perry for providing the patch)
1141 corrections:
1142 fixed some typos and improved some comments
1144 ####################### V 1.7.0.1:
1146 corrections:
1147 fixed possible SIGSEGV in listening addresses when a new connection was
1148 reset by peer before the socket addresses could be retrieved. Thanks to
1149 Mike Perry for sending a patch.
1151 fixed a bug, introduced with version 1.7.0.0, that let client
1152 connections with option connect-timeout fail when the connections
1153 succeeded. Thanks to Bruno De Fraine for reporting this bug.
1155 option end-close "did not apply" to addresses PTY, SOCKET-CONNECT,
1156 and most UNIX-* and ABSTRACT-*
1158 half close of EXEC and SYSTEM addresses did not work for pipes and
1159 sometimes socketpair
1161 help displayed for some option a wrong type
1163 under some circumstances shutdown was called multiple times for the
1164 same fd
1166 ####################### V 1.7.0.0:
1168 new features:
1169 new address types SCTP-CONNECT and SCTP-LISTEN implement SCTP stream
1170 mode for IPv4 and IPv6; new address options sctp-maxseg and
1171 sctp-nodelay (suggested by David A. Madore; thanks to Jonathan Brannan
1172 for providing an initial patch)
1174 new address "INTERFACE" for transparent network interface handling
1175 (suggested by Stuart Nicholson)
1177 added generic socket addresses: SOCKET-CONNECT, SOCKET-LISTEN,
1178 SOCKET-SENDTO, SOCKET-RECVFROM, SOCKET-RECV, SOCKET-DATAGRAM allow
1179 protocol independent socket handling; all parameters are explicitely
1180 specified as numbers or hex data
1182 added address options ioctl-void, ioctl-int, ioctl-intp, ioctl-string,
1183 ioctl-bin for generic ioctl() calls.
1185 added address options setsockopt-int, setsockopt-bin, and
1186 setsockopt-string for generic setsockopt() calls
1188 option so-type now only affects the socket() and socketpair() calls,
1189 not the name resolution. so-type and so-prototype can now be applied to
1190 all socket based addresses.
1192 new address option "escape" allows to break a socat instance even when
1193 raw terminal mode prevents ^C etc. (feature suggested by Guido Trotter)
1195 socat sets environment variables SOCAT_VERSION, SOCAT_PID, SOCAT_PPID
1196 for use in executed scripts
1198 socat sets environment variables SOCAT_SOCKADDR, SOCAT_SOCKPORT,
1199 SOCAT_PEERADDR, SOCAT_PEERPORT in LISTEN type addresses (feature
1200 suggested by Ed Sawicki)
1202 socat receives all ancillary messages with each received packet on
1203 datagram related addresses. The messages are logged in raw form with
1204 debug level, and broken down with info level. note: each type of
1205 ancillary message must be enabled by appropriate address options.
1207 socat provides the contents of ancillary messages received on RECVFROM
1208 addresses in appropriate environment variables:
1209 SOCAT_TIMESTAMP, SOCAT_IP_DSTADDR, SOCAT_IP_IF, SOCAT_IP_LOCADDR,
1210 SOCAT_IP_OPTIONS, SOCAT_IP_TOS, SOCAT_IP_TTL, SOCAT_IPV6_DSTADDR,
1211 SOCAT_IPV6_HOPLIMIT, SOCAT_IPV6_TCLASS
1213 the following address options were added to enable ancillary messages:
1214 so-timestamp, ip-pktinfo (not BSD), ip-recvdstaddr (BSD), ip-recverr,
1215 ip-recvif (BSD), ip-recvopts, ip-recvtos, ip-recvttl, ipv6-recvdstopts,
1216 ipv6-recverr, ipv6-recvhoplimit, ipv6-recvhopopts, ipv6-recvpathmtu,
1217 ipv6-recvpktinfo, ipv6-recvrthdr, ipv6-recvtclass
1219 new address options ipv6-tclass and ipv6-unicast-hops set the related
1220 socket options.
1222 STREAMS (UNIX System V STREAMS) can be configured with the new address
1223 options i-pop-all and i-push (thanks to Michal Rysavy for providing a
1224 patch)
1226 corrections:
1227 some raw IP and UNIX datagram modes failed on BSD systems
1229 when UDP-LISTEN continued to listen after packet dropped by, e.g.,
1230 range option, the old listen socket would not be closed but a new one
1231 created. open sockets could accumulate.
1233 there was a bug in ip*-recv with bind option: it did not bind, and
1234 with the first received packet an error occurred:
1235 socket_init(): unknown address family 0
1236 test: RAWIP4RECVBIND
1238 RECVFROM addresses with FORK option hung after processing the first
1239 packet. test: UDP4RECVFROM_FORK
1241 corrected a few mistakes that caused compiler warnings on 64bit hosts
1242 (thanks to Jonathan Brannan e.a. for providing a patch)
1244 EXEC and SYSTEM with stderr injected socat messages into the data
1245 stream. test: EXECSTDERRLOG
1247 when the EXEC address got a string with consecutive spaces it created
1248 additional empty arguments (thanks to Olivier Hervieu for reporting
1249 this bug). test: EXECSPACES
1251 in ignoreeof polling mode socat also blocked data transfer in the other
1252 direction during the 1s wait intervalls (thanks to Jorgen Cederlof for
1253 reporting this bug)
1255 corrected alphabetical order of options (proxy-auth)
1257 some minor corrections
1259 improved test.sh script: more stable timing, corrections for BSD
1261 replaced the select() calls by poll() to cleanly fix the problems with
1262 many file descriptors already open
1264 socat option -lf did not log to file but to stderr
1266 socat did not compile on Solaris when configured without termios
1267 feature (thanks to Pavan Gadi for reporting this bug)
1269 porting:
1270 socat compiles and runs on AIX with gcc (thanks to Andi Mather for his
1271 help)
1273 socat compiles and runs on Cygwin (thanks to Jan Just Keijser for his
1274 help)
1276 socat compiles and runs on HP-UX with gcc (thanks to Michal Rysavy for
1277 his help)
1279 socat compiles and runs on MacOS X (thanks to Camillo Lugaresi for his
1280 help)
1282 further changes:
1283 filan -s prefixes output with FD number if more than one FD
1285 Makefile now supports datarootdir (thanks to Camillo Lugaresi for
1286 providing the patch)
1288 cleanup in xio-unix.c
1290 ####################### V 1.6.0.1:
1292 new features:
1293 new make target "gitclean"
1295 docu source doc/socat.yo released
1297 corrections:
1298 exec:...,pty did not kill child process under some circumstances; fixed
1299 by correcting typo in xio-progcall.c (thanks to Ralph Forsythe for
1300 reporting this problem)
1302 service name resolution failed due to byte order mistake
1303 (thanks to James Sainsbury for reporting this problem)
1305 socat would hang when invoked with many file descriptors already opened
1306 fix: replaced FOPEN_MAX with FD_SETSIZE
1307 thanks to Daniel Lucq for reporting this problem.
1309 fixed bugs where sub processes would become zombies because the master
1310 process did not catch SIGCHLD. this affected addresses UDP-LISTEN,
1311 UDP-CONNECT, TCP-CONNECT, OPENSSL, PROXY, UNIX-CONNECT, UNIX-CLIENT,
1312 ABSTRACT-CONNECT, ABSTRACT-CLIENT, SOCKSA, SOCKS4A
1313 (thanks to Fernanda G Weiden for reporting this problem)
1315 fixed a bug where sub processes would become zombies because the master
1316 process caught SIGCHLD but did not wait(). this affected addresses
1317 UDP-RECVFROM, IP-RECVFROM, UNIX-RECVFROM, ABSTRACT-RECVFROM
1318 (thanks to Evan Borgstrom for reporting this problem)
1320 corrected option handling with STDIO; usecase: cool-write
1322 configure --disable-pty also disabled option waitlock
1324 fixed small bugs on systems with struct ip_mreq without struct ip_mreqn
1325 (thanks to Roland Illig for sending a patch)
1327 corrected name of option intervall to interval (old form still valid
1328 for us German speaking guys)
1330 corrected some print statements and variable names
1332 make uninstall did not uninstall procan
1334 fixed lots of weaknesses in test.sh
1336 corrected some bugs and typos in doc/socat.yo, EXAMPLES, C comments
1338 further changes:
1339 procan -c prints C defines important for socat
1341 added test OPENSSLEOF for OpenSSL half close
1343 ####################### V 1.6.0.0:
1345 new features:
1346 new addresses IP-DATAGRAM and UDP-DATAGRAM allow versatile broadcast
1347 and multicast modes
1349 new option ip-add-membership for control of multicast group membership
1351 new address TUN for generation of Linux TUN/TAP pseudo network
1352 interfaces (suggested by Mat Caughron); associated options tun-device,
1353 tun-name, tun-type; iff-up, iff-promisc, iff-noarp, iff-no-pi etc.
1355 new addresses ABSTRACT-CONNECT, ABSTRACT-LISTEN, ABSTRACT-SENDTO,
1356 ABSTRACT-RECV, and ABSTRACT-RECVFROM for abstract UNIX domain addresses
1357 on Linux (requested by Zeeshan Ali); option unix-tightsocklen controls
1358 socklen parameter on system calls.
1360 option end-close for control of connection closing allows FD sharing
1361 by sub processes
1363 range option supports form address:mask with IPv4
1365 changed behaviour of OPENSSL-LISTEN to require and verify client
1366 certificate per default
1368 options f-setlkw-rd, f-setlkw-wr, f-setlk-rd, f-setlk-wr allow finer
1369 grained locking on regular files
1371 uninstall target in Makefile (lack reported by Zeeshan Ali)
1373 corrections:
1374 fixed bug where only first tcpwrap option was applied; fixed bug where
1375 tcpwrap IPv6 check always failed (thanks to Rudolf Cejka for reporting
1376 and fixing this bug)
1378 filan (and socat -D) could hang when a socket was involved
1380 corrected PTYs on HP-UX (and maybe others) using STREAMS (inspired by
1381 Roberto Mackun)
1383 correct bind with udp6-listen (thanks to Jan Horak for reporting this
1384 bug)
1386 corrected filan.c peekbuff[0] which did not compile with Sun Studio Pro
1387 (thanks to Leo Zhadanovsky for reporting this problem)
1389 corrected problem with read data buffered in OpenSSL layer (thanks to
1390 Jon Nelson for reporting this bug)
1392 corrected problem with option readbytes when input stream stayed idle
1393 after so many bytes
1395 fixed a bug where a datagram receiver with option fork could fork two
1396 sub processes per packet
1398 further changes:
1399 moved documentation to new doc/ subdir
1401 new documents (kind of mini tutorials) are provided in doc/
1403 ####################### V 1.5.0.0:
1405 new features:
1406 new datagram modes for udp, rawip, unix domain sockets
1408 socat option -T specifies inactivity timeout
1410 rewrote lexical analysis to allow nested socat calls
1412 addresses tcp, udp, tcp-l, udp-l, and rawip now support IPv4 and IPv6
1414 socat options -4, -6 and environment variables SOCAT_DEFAULT_LISTEN_IP,
1415 SOCAT_PREFERRED_RESOLVE_IP for control of protocol selection
1417 addresses ssl, ssl-l, socks, proxy now support IPv4 and IPv6
1419 option protocol-family (pf), esp. for openssl-listen
1421 range option supports IPv6 - syntax: range=[::1/128]
1423 option ipv6-v6only (ipv6only)
1425 new tcp-wrappers options allow-table, deny-table, tcpwrap-etc
1427 FIPS version of OpenSSL can be integrated - initial patch provided by
1428 David Acker. See README.FIPS
1430 support for resolver options res-debug, aaonly, usevc, primary, igntc,
1431 recurse, defnames, stayopen, dnsrch
1433 options for file attributes on advanced filesystems (ext2, ext3,
1434 reiser): secrm, unrm, compr, ext2-sync, immutable, ext2-append, nodump,
1435 ext2-noatime, journal-data etc.
1437 option cool-write controls severeness of write failure (EPIPE,
1438 ECONNRESET)
1440 option o-noatime
1442 socat option -lh for hostname in log output
1444 traffic dumping provides packet headers
1446 configure.in became part of distribution
1448 socats unpack directory now has full version, e.g. socat-1.5.0.0/
1450 corrected docu of option verify
1452 corrections:
1453 fixed tcpwrappers integration - initial fix provided by Rudolf Cejka
1455 exec with pipes,stderr produced error
1457 setuid-early was ignored with many address types
1459 some minor corrections
1461 ####################### V 1.4.3.1:
1463 corrections:
1464 PROBLEM: UNIX socket listen accepted only one (or a few) connections.
1465 FIX: do not remove listening UNIX socket in child process
1467 PROBLEM: SIGSEGV when TCP part of SSL connect failed
1468 FIX: check ssl pointer before calling SSL_shutdown
1470 In debug mode, show connect client port even when connect fails
1472 ####################### V 1.4.3.0:
1474 new features:
1475 socat options -L, -W for application level locking
1477 options "lockfile", "waitlock" for address level locking
1478 (Stefan Luethje)
1480 option "readbytes" limits read length (Adam Osuchowski)
1482 option "retry" for unix-connect, unix-listen, tcp6-listen (Dale Dude)
1484 pty symlink, unix listen socket, and named pipe are per default removed
1485 after use; option unlink-close overrides this new behaviour and also
1486 controls removal of other socat generated files (Stefan Luethje)
1488 corrections:
1489 option "retry" did not work with tcp-listen
1491 EPIPE condition could result in a 100% CPU loop
1493 further changes:
1494 support systems without SHUT_RD etc.
1495 handle more size_t types
1496 try to find makedepend options with gcc 3 (richard/OpenMacNews)
1498 ####################### V 1.4.2.0:
1500 new features:
1501 option "connect-timeout" limits wait time for connect operations
1502 (requested by Giulio Orsero)
1504 option "dhparam" for explicit Diffie-Hellman parameter file
1506 corrections:
1507 support for OpenSSL DSA certificates (Miika Komu)
1509 create install directories before copying files (Miika Komu)
1511 when exiting on signal, return status 128+signum instead of 1
1513 on EPIPE and ECONNRESET, only issue a warning (Santiago Garcia
1514 Mantinan)
1516 -lu could cause a core dump on long messages
1518 further changes:
1519 modifications to simplify using socats features in applications
1521 ####################### V 1.4.1.0:
1523 new features:
1524 option "wait-slave" blocks open of pty master side until a client
1525 connects, "pty-intervall" controls polling
1527 option -h as synonym to -? for help (contributed by Christian
1528 Lademann)
1530 filan prints formatted time stamps and rdev (disable with -r)
1532 redirect filan's output, so stdout is not affected (contributed by
1533 Luigi Iotti)
1535 filan option -L to follow symbolic links
1537 filan shows termios control characters
1539 corrections:
1540 proxy address no longer performs unsolicited retries
1542 filan -f no longer needs read permission to analyze a file (but still
1543 needs access permission to directory, of course)
1545 porting:
1546 Option dsusp
1547 FreeBSD options noopt, nopush, md5sig
1548 OpenBSD options sack-disable, signature-enable
1549 HP-UX, Solaris options abort-threshold, conn-abort-threshold
1550 HP-UX options b900, b3600, b7200
1551 Tru64/OSF1 options keepinit, paws, sackena, tsoptena
1553 further corrections:
1554 address pty now uses ptmx as default if openpty is also available
1556 ####################### V 1.4.0.3:
1558 security:
1559 Socat security advisory 1
1560 CVE-2004-1484:
1561 fix to a syslog() based format string vulnerability that can lead to
1562 remote code execution. See advisory socat-adv-1.txt
1564 ####################### V 1.4.0.2:
1566 corrections:
1567 exec'd write-only addresses get a chance to flush before being killed
1569 error handler: print notice on error-exit
1571 filan printed wrong file type information
1573 ####################### V 1.4.0.1:
1575 corrections:
1576 socks4a constructed invalid header. Problem found, reported, and fixed
1577 by Thomas Themel, by Peter Palfrader, and by rik
1579 with nofork, don't forget to apply some process related options
1580 (chroot, setsid, setpgid, ...)
1582 ####################### V 1.4.0.0:
1584 new features:
1585 simple openssl server (ssl-l), experimental openssl trust
1587 new options "cafile", "capath", "key", "cert", "egd", and "pseudo" for
1588 openssl
1590 new options "retry", "forever", and "intervall"
1592 option "fork" for address TCP improves `gender changer´
1594 options "sigint", "sigquit", and "sighup" control passing of signals to
1595 sub process (thanks to David Shea who contributed to this issue)
1597 readline takes respect to the prompt issued by the peer address
1599 options "prompt" and "noprompt" allow to override readline's new
1600 default behaviour
1602 readline supports invisible password with option "noecho"
1604 socat option -lp allows to set hostname in log output
1606 socat option -lu turns on microsecond resolution in log output
1609 corrections:
1610 before reading available data, check if writing on other channel is
1611 possible
1613 tcp6, udp6: support hostname specification (not only IP address), and
1614 map IP4 names to IP6 addresses
1616 openssl client checks server certificate per default
1618 support unidirectional communication with exec/system subprocess
1620 try to restore original terminal settings when terminating
1622 test.sh uses tmp dir /tmp/$USER/$$ instead of /tmp/$$
1624 socks4 failed on platforms where long does not have 32 bits
1625 (thanks to Peter Palfrader and Thomas Seyrat)
1627 hstrerror substitute wrote wrong messages (HP-UX, Solaris)
1629 proxy error message was truncated when answer contained multiple spaces
1632 porting:
1633 compiles with AIX xlc, HP-UX cc, Tru64 cc (but might not link)
1635 ####################### V 1.3.2.2:
1637 corrections:
1638 PROXY CONNECT failed when the status reply from the proxy server
1639 contained more than one consecutive spaces. Problem reported by
1640 Alexandre Bezroutchko
1642 do not SIGSEGV when proxy address fails to resolve server name
1644 udp-listen failed on systems where AF_INET != SOCK_DGRAM (e.g. SunOS).
1645 Problem reported by Christoph Schittel
1647 test.sh only tests available features
1649 added missing IP and TCP options in filan analyzer
1651 do not apply stdio address options to both directions when in
1652 unidirectional mode
1654 on systems lacking /dev/*random and egd, provide (weak) entropy from
1655 libc random()
1658 porting:
1659 changes for HP-UX (VREPRINT, h_NETDB_INTERNAL)
1661 compiles on True64, FreeBSD (again), NetBSD, OpenBSD
1663 support for long long as st_ino type (Cygwin 1.5)
1665 compile on systems where pty can not be featured
1667 ####################### V 1.3.2.1:
1669 corrections:
1670 "final" solution for the ENOCHLD problem
1672 corrected "make strip"
1674 default gcc debug/opt is "-O" again
1676 check for /proc at runtime, even if configure found it
1678 src.rpm accidently supported SuSE instead of RedHat
1680 ####################### V 1.3.2.0:
1682 new features:
1683 option "nofork" connects an exec'd script or program directly
1684 to the file descriptors of the other address, circumventing the socat
1685 transfer engine
1687 support for files >2GB, using ftruncate64(), lseek64(), stat64()
1689 filan has new "simple" output style (filan -s)
1692 porting:
1693 options "binary" and "text" for controlling line termination on Cygwin
1694 file system access (hint from Yang Wu-Zhou)
1696 fix by Yang Wu-Zhou for the Cygwin "No Children" problem
1698 improved support for OSR: _SVID3; no IS_SOCK, no F_GETOWN (thanks to
1699 John DuBois)
1701 minor corrections to avoid warnings with gcc 3
1704 further corrections and minor improvements:
1705 configure script is generated with autoconf 2.57 (no longer 2.52)
1707 configure passes CFLAGS to Makefile
1709 option -??? for complete list of address options and their short forms
1711 program name in syslog messages is derived from argv[0]
1713 SIGHUP now prints notice instead of error
1715 EIO during read of pty now gives Notice instead of Error, and
1716 triggers EOF
1718 use of hstrerror() for printing resolver error messages
1720 setgrent() got required endgrent()
1722 ####################### V 1.3.1.0:
1724 new features:
1725 integration of Wietse Venema's tcpwrapper library (libwrap)
1727 with "proxy" address, option "resolve" controls if hostname or IP
1728 address is sent in request
1730 option "lowport" establishes limited authorization for TCP and UDP
1731 connections
1733 improvement of .spec file for RPM creation (thanks to Gerd v. Egidy)
1734 An accompanying change in the numbering scheme results in an
1735 incompatibility with earlier socat RPMs!
1738 solved problems and bugs:
1739 PROBLEM: socat daemon terminated when the address of a connecting
1740 client did not match range option value instead of continue listening
1741 SOLVED: in this case, print warning instead of error to keep daemon
1742 active
1744 PROBLEM: tcp-listen with fork sometimes left excessive number of zombie
1745 processes
1746 SOLVED: dont assume that each exiting child process generates SIGCHLD
1748 when converting CRNL to CR, socat converted to NL
1751 further corrections:
1752 configure script now disables features that depend on missing files
1753 making it more robust in "unsupported" environments
1755 server.pem permissions corrected to 600
1757 "make install" now does not strip; use "make strip; make install"
1758 if you like strip (suggested by Peter Bray)
1760 ####################### V 1.3.0.1:
1762 solved problems and bugs:
1763 PROBLEM: OPENSSL did not apply tcp, ip, and socket options
1764 SOLVED: OPENSSL now correctly handles the options list
1766 PROBLEM: CRNL to NL and CRNL to CR conversions failed when CRNL crossed
1767 block boundary
1768 SOLVED: these conversions now simply strip all CR's or NL's from input
1769 stream
1772 porting:
1773 SunOS ptys now work on x86, too (thanks to Peter Bray)
1775 configure looks for freeware libs in /pkgs/lib/ (thanks to Peter Bray)
1778 further corrections:
1779 added WITH_PROXY value to -V output
1781 added compile dependencies of WITH_PTY and WITH_PROXY
1783 -?? did not print option group of proxy options
1785 corrected syntax for bind option in docu
1787 corrected an issue with stdio in unidirectional mode
1789 options socksport and proxyport support service names
1791 ftp.sh script supports proxy address
1793 man page no longer installed with execute permissions (thanks to Peter
1794 Bray)
1796 fixed a malloc call bug that could cause SIGSEGV or false "out of
1797 memory" errors on EXEC and SYSTEM, depending on program name length and
1798 libc.
1800 ####################### V 1.3.0.0:
1802 new features:
1803 proxy connect with optional proxy authentication
1805 combined hex and text dump mode, credits to Gregory Margo
1807 address pty applies options user, group, and perm to device
1810 solved problems and bugs:
1811 PROBLEM: option reuseport was not applied (BSD, AIX)
1812 SOLVED: option reuseport now in phase PASTSOCKET instead of PREBIND,
1813 credits to Jean-Baptiste Marchand
1815 PROBLEM: ignoreeof with stdio was ignored
1816 SOLVED: ignoreeof now works correctly with address stdio
1818 PROBLEM: ftp.sh did not use user supplied password
1819 SOLVED: ftp.sh now correctly passes password from command line
1821 PROBLEM: server.pem had expired
1822 SOLVED: new server.pem valid for ten years
1824 PROBLEM: socks notice printed wrong port on some platforms
1825 SOLVED: socks now uses correct byte-order for port number in notice
1828 further corrections:
1829 option name o_trunc corrected to o-trunc
1831 combined use of -u and -U is now detected and prevented
1833 made message system a little more robust against format string attacks
1836 ####################### V 1.2.0.0:
1838 new features:
1839 address pty for putting socat behind a new pseudo terminal that may
1840 fake a serial line, modem etc.
1842 experimental openssl integration
1843 (it does not provide any trust between the peers because is does not
1844 check certificates!)
1846 options flock-ex, flock-ex-nb, flock-sh, flock-sh-nb to control all
1847 locking mechanism provided by flock()
1849 options setsid and setpgid now available with all address types
1851 option ctty (controlling terminal) now available for all TERMIOS
1852 addresses
1854 option truncate (a hybrid of open(.., O_TRUNC) and ftruncate()) is
1855 replaced by options o-trunc and ftruncate=offset
1857 option sourceport now available with TCP and UDP listen addresses to
1858 restrict incoming client connections
1860 unidirectional mode right-to-left (-U)
1863 solved problems and bugs:
1864 PROBLEM: addresses without required parameters but an option containing
1865 a '/' were incorrectly interpreted as implicit GOPEN address
1866 SOLVED: if an address does not have ':' separator but contains '/',
1867 check if the slash is before the first ',' before assuming
1868 implicit GOPEN.
1871 porting:
1872 ptys under SunOS work now due to use of stream options
1875 further corrections:
1876 with -d -d -d -d -D, don't print debug info during file analysis
1879 ####################### V 1.1.0.1:
1881 new features:
1882 .spec file for RPM generation
1885 solved problems and bugs:
1886 PROBLEM: GOPEN on socket did not apply option unlink-late
1887 SOLUTION: GOPEN for socket now applies group NAMED, phase PASTOPEN
1888 options
1890 PROBLEM: with unidirectional mode, an unnecessary close timeout was
1891 applied
1892 SOLUTION: in unidirectional mode, terminate without wait time
1894 PROBLEM: using GOPEN on a unix domain socket failed for datagram
1895 sockets
1896 SOLUTION: when connect() fails with EPROTOTYPE, use a datagram socket
1899 further corrections:
1901 open() flag options had names starting with "o_", now corrected to "o-"
1903 in docu, *-listen addresses were called *_listen
1905 address unix now called unix-connect because it does not handle unix
1906 datagram sockets
1908 in test.sh, apply global command line options with all tests
1911 ####################### V 1.1.0.0:
1913 new features:
1914 regular man page and html doc - thanks to kromJx for prototype
1916 new address type "readline", utilizing GNU readline and history libs
1918 address option "history-file" for readline
1920 new option "dash" to "exec" address that allows to start login shells
1922 syslog facility can be set per command line option
1924 new address option "tcp-quickack", found in Linux 2.4
1926 option -g prevents option group checking
1928 filan and procan can print usage
1930 procan prints rlimit infos
1933 solved problems and bugs:
1934 PROBLEM: raw IP socket SIGSEGV'ed when it had been shut down.
1935 SOLVED: set eof flag of channel on shutdown.
1937 PROBLEM: if channel 2 uses a single non-socket FD in bidirectional mode
1938 and has data available while channel 1 reaches EOF, the data is
1939 lost.
1940 SOLVED: during one loop run, first handle all data transfers and
1941 _afterwards_ handle EOF.
1943 PROBLEM: despite to option NONBLOCK, the connect() call blocked
1944 SOLVED: option NONBLOCK is now applied in phase FD instead of LATE
1946 PROBLEM: UNLINK options issued error when file did not exist,
1947 terminating socat
1948 SOLVED: failure of unlink() is only warning if errno==ENOENT
1950 PROBLEM: TCP6-LISTEN required numeric port specification
1951 SOLVED: now uses common TCP service resolver
1953 PROBLEM: with PIPE, wrong FDs were shown for data transfer loop
1954 SOLVED: retrieval of FDs now pays respect to PIPE pecularities
1956 PROBLEM: using address EXEC against an address with IGNOREEOF, socat
1957 never terminated
1958 SOLVED: corrected EOF handling of sigchld
1961 porting:
1962 MacOS and old AIX versions now have pty
1964 flock() now available on Linux (configure check was wrong)
1966 named pipe were generated using mknod(), which requires root under BSD
1967 now they are generated using mkfifo
1970 further corrections:
1971 lots of address options that were "forgotten" at runtime are now
1972 available
1974 option BINDTODEVICE now also called SO-BINDTODEVICE, IF
1976 "make install" now installs binaries with ownership 0:0
1979 ####################### V 1.0.4.2:
1981 solved problems and bugs:
1982 PROBLEM: EOF of one stream caused close of other stream, giving it no
1983 chance to go down regularly
1984 SOLVED: EOF of one stream now causes shutdown of write part of other
1985 stream
1987 PROBLEM: sending mail via socks address to qmail showed that crlf
1988 option does not work
1989 SOLVED: socks address applies PH_LATE options
1991 PROBLEM: in debug mode, no info about socat and platform was issued
1992 SOLVED: print socat version and uname output in debug mode
1994 PROBLEM: invoking socat with -t and no following parameters caused
1995 SIGSEGV
1996 SOLVED: -t and -b now check next argv entry
1998 PROBLEM: when opening of logfile (-lf) failed, no error was reported
1999 and no further messages were printed
2000 SOLVED: check result of fopen and print error message if it failed
2002 new features:
2003 address type UDP-LISTEN now supports option fork: it internally applies
2004 socket option SO_REUSEADDR so a new UDP socket can bind to port after
2005 `accepting´ a connection (child processes might live forever though)
2006 (suggestion from Damjan Lango)
2009 ####################### V 1.0.4.1:
2011 solved problems and bugs:
2012 PROB: assert in libc caused an endless recursion
2013 SOLVED: no longer catch SIGABRT
2015 PROB: socat printed wrong verbose prefix for "right to left" packets
2016 SOLVED: new parameter for xiotransfer() passes correct prefix
2018 new features:
2019 in debug mode, socat prints its command line arguments
2020 in verbose mode, escape special characters and replace unprintables
2021 with '.'. Patch from Adrian Thurston.
2024 ####################### V 1.0.4.0:
2026 solved problems and bugs:
2027 Debug output for lstat and fstat said "stat"
2029 further corrections:
2030 FreeBSD now includes libutil.h
2032 new features:
2033 option setsid with exec/pty
2034 option setpgid with exec/pty
2035 option ctty with exec/pty
2036 TCP V6 connect test
2037 gettimeofday in sycls.c (no use yet)
2039 porting:
2040 before Gethostbyname, invoke inet_aton for MacOSX
2043 ####################### V 1.0.3.0:
2045 solved problems and bugs:
2047 PROB: test 9 of test.sh (echo via file) failed on some platforms,
2048 socat exited without error message
2049 SOLVED: _xioopen_named_early(): preset statbuf.st_mode with 0
2051 PROB: test 17 hung forever
2052 REASON: child death before select loop did not result in EOF
2053 SOLVED: check of existence of children before starting select loop
2055 PROB: test 17 failed
2056 REASON: child dead triggered EOF before last data was read
2057 SOLVED: after child death, read last data before setting EOF
2059 PROB: filan showed that exec processes incorrectly had fd3 open
2060 REASON: inherited open fd3 from main process
2061 SOLVED: set CLOEXEC flag on pty fd in main process
2063 PROB: help printed "undef" instead of group "FORK"
2064 SOLVED: added "FORK" to group name array
2066 PROB: fatal messages did not include severity classifier
2067 SOLVED: added "F" to severity classifier array
2069 PROB: IP6 addresses where printed incorrectly
2070 SOLVED: removed type casts to unsigned short *
2072 further corrections:
2073 socat catches illegal -l modes
2074 corrected error message on setsockopt(linger)
2075 option tabdly is of type uint
2076 correction for UDP over IP6
2077 more cpp conditionals, esp. for IP6 situations
2078 better handling of group NAMED options with listening UNIX sockets
2079 applyopts2 now includes last given phase
2080 corrected option group handling for most address types
2081 introduce dropping of unappliable options (dropopts, dropopts2)
2082 gopen now accepts socket and unix-socket options
2083 exec and system now accept all socket and termios options
2084 child process for exec and system addresses with option pty
2085 improved descriptions and options for EXAMPLES
2086 printf format for file mode changed to "0%03o" with length spec.
2087 added va_end() in branch of msg()
2088 changed phase of lock options from PASTOPEN to FD
2089 support up to four early dying processes
2091 structural changes:
2092 xiosysincludes now includes sysincludes.h for non xio files
2094 new features:
2095 option umask
2096 CHANGES file
2097 TYPE_DOUBLE, u_double
2098 OFUNC_OFFSET
2099 added getsid(), setsid(), send() to sycls
2100 procan prints sid (session id)
2101 mail.sh gets -f (from) option
2102 new EXAMPLEs for file creation
2103 gatherinfo.sh now tells about failures
2104 test.sh can check for much more address/option combinations
2106 porting:
2107 ispeed, ospeed for termios on FreeBSD
2108 getpgid() conditional for MacOS 10
2109 added ranlib in Makefile.in for MacOS 10
2110 disable pty option if no pty mechanism is available (MacOS 10)
2111 now compiles and runs on MacOS 10 (still some tests fail)
2112 setgroups() conditional for cygwin
2113 sighandler_t defined conditionally
2114 use gcc option -D_GNU_SOURCE