1.3.8 Release Notes ------------------------ This file contains a description of the major changes to ProFTPD for the 1.3.8 release cycle, from the 1.3.8rc1 release to the 1.3.8 maintenance releases. More information on these changes can be found in the NEWS and ChangeLog files. 1.3.8rc2 --------- + Fix memory disclosure to RADIUS servers by mod_radius (Issue #1284). + PCRE expressions with capture groups were not being handled properly (Issue #1300). + Add support for the libidn2 library, over libidn, for e.g. mod_rewrite mappings (Issue #1286). + Changed Directives RegexOptions Engine The RegexOptions directive now supports explicitly configuring which regular expression "engine" to use, POSIX or PCRE. Thus ProFTPD installations with PCRE support enabled (via the --enable-pcre configure option) can be told to treat all regular expressions as POSIX expressions at run-time. TLSRenegotiate default behavior The TLSRenegotiate directive configures when the mod_tls module requests TLS renegotations on both control and data connections. TLS renegotiations, as a protocol feature, have a long and sordid history of abuse; many TLS libraries/clients no longer implement them, or disable support for renegotiation by default. Thus mod_tls will no longer request TLS renegotations by default now, either. + Developer Notes The generated Make.rules file will now be installed alongside the installed ProFTPD headers. It contains build rules used by third-party modules that use multiple source files. 1.3.8rc1 --------- + Minimum DH parameter size for TLS has been raised from 1024 to 2048. + Passive transfers fail unexpectedly due to use of SO_REUSEPORT socket option (Issue #1171). + Fixed occasional segfaults with FTPS data transfers using TLSv1.3, when session tickets cannot be decrypted (Issue #1063). + Fixed "Corrupted MAC on inptut" errors when SFTP uses the umac-64@openssh.com digest (Issue #1111). + Fixed memory use-after-free issue in mod_sftp which can cause unexpected login/authentication issues. + Fixed speed regression for logins, directory listings when AuthUserFile is used. + ftpasswd now generates SHA256 password hashes by default, rather than MD5. * Set the `OPENSSL_API_COMPAT` API version compatibility macro. We currently set our OpenSSL API version to 1.0.0 and later; code which uses an OpenSSL API earlier than 1.0.0 will cause the build to fail. Use the new `--disable-openssl-api-compat` configure option to disable use of this macro. + Fixed SQL syntax regression for some generated SQL statements (Issue #1149). + Deprecated Directives MultilineRFC2228 This directive has caused many issues unexpectedly, particularly for responses of the FEAT command, and is not necessary. + New Directives ListStyle This directive is used to emit Windows-style directory listings, for compatibility with certain FTP clients. See doc/modules/mod_ls.html#ListStyle for more information. RedisLogFormatExtra This directive supports adding custom key/values to the JSON logging done by the RedisLogOnCommand, RedisLogOnEvent directives. See doc/modules/mod_redis.html#RedisLogFormatExtra for details. + Changed Directives AuthFileOptions SyntaxCheck Syntax checks of configured AuthUserFile, AuthGroupFile can now be performed, at startup time, via this option. See doc/modules/mod_auth_file.html#AuthFileOptions for more information. BanOnEvent MaxLoginAttemptsFromUser The mod_ban module now supports bans for a given user/IP address combination; see Issue #1170 for details. RedisSentinel Support for using TLS when connecting to Redis Sentinels has been implemented; see doc/modules/mod_redis.html#RedisSentinel for details. RedisServer Redis 6.x changed its AUTH command, due to the Redis ACL system, for supporting multiple users. Thus the `RedisServer` directive now takes a username, as well as a password. The Redis server version is auto- detected; the configured username will be ignored for Redis servers older than Redis 6.x. Support for using TLS when connecting to Redis servers has been implemented; see doc/modules/mod_redis.html#RedisServer for details. TLSCipherSuite TLSv1.3 ciphersuites have different names, and are configured differently in OpenSSL. To support configuration of TLSv1.3 ciphersuites, the `TLSCipherSuite` directive takes an optional protocol specifier; see the documentation for details. TLSOptions Support for the long-deprecated `NoCertRequest` TLSOption has been removed. AllowWeakSecurity TLSOption added, for cases where interacting with "insecure" (by system OpenSSL policy) clients is required; see doc/contrib/mod_tls.html#TLSOptions for more details. Wrap2Tables The mod_wrap2 module now supports including additional files for its allow/deny tables; see Issue #1133. + Developer Notes The new `pr_pool_debug_memory2` function uses a visitor pattern to walk the memory pools, and provides the pool data to the callback via structure, allowing the callback to format/use the memory pool information as needed, including emitting the data as JSON. The "make install" target now will _only_ try to install existing code/binaries, and will no longer attempt to recompile existing binaries. That is, this sequence will no longer work: $ ./configure $ make install Instead, the officially documented and supported sequence is now required: $ ./configure $ make $ make install This ensures that no unexpected recompilation occurs; see Issue #548.