1.04 - The fixing of the silly memleak introduced a bug that could cause crashes on some systems, fixed. Thanks to Jukka Anttonen for reporting it. 1.03 - At least one ftpd can't handle PROT before USER, this is (unfortunately) allowed by the TLS FTP spec so handle it properly. - The debug mode crashed on Linux and probably some other OSes. - It now is possible to build a version for Windows 9x/ME (which does not have the possibility to run as a service). This is the first version ever to work properly on this platform, as the old Cygwin version didn't work on 9x. - Improved the error handling for connection resets in the TLS handshake. - Improved the error handling for connection attempts blocked by software firewalls in Windows. - Fixed a silly memleak. 1.02 - Minor HP-UX fixes (UNIX95 vs UNIX98 vs current). - Fixed detection of recent versions of the Intel compiler on Linux, to prevent a strange compilation error on Itanium systems. - A small fix to work with the recently released OpenSSL 0.9.8. - Since OpenSSL 0.9.8 supports 64-bit Windows (x64 and IA64), TLSWrap also does: I have provided an installer for Windows x64, just like for the normal x86 version. The installer is unfortunately 32-bit for now, but everything else is 64-bit. The included OpenSSL DLLs are compiled with the Intel C++ Compiler 9.0 for EM64T and should in many cases have superior performance compared to the 32-bit versions (I get twice the speed with AES on my EM64T CPU, but the performance will vary with algorithm and CPU type). I found a bug in OpenSSL 0.9.8 that broke DES encryption when using the latest Intel compiler. The included DLL's have this fix applied and the next official version of OpenSSL 0.9.8 will also have this fix. 1.01 - Fixed a bug in the startup code that could randomly prevent it from loading on Windows XP Pro x64 edition (and theoretically on other Windows versions). - The Configuration Manager should not start if the TLSWrap service is not installed, fixed. Improved some error messages. 1.00 - Added support for active FTP (i.e. PORT and EPRT modes). - Added support for user certificates/certificate chains. To use this feature, start TLSWrap with -P (or if using the Windows service, with the configuration manager). After this, TLSWrap will try to use .pem from the user certificate directory. The certificates must be in PEM format and must be sorted starting with the subject's certificate (actual client certificate), followed by intermediate CA certificates if applicable, and ending at the highest level (root) CA. - The TLSWrap Configuration Manager for the Windows service now supports managing user certificates in addition to server certificates. - It is now possible to add and delete certificates using the buttons in the TLSWrap Configuration Manager. It is also possible to rename a certificate by clicking on its file name in the list. Also misc. improvements to the certificate handling. 0.9 - Added a GUI configuration tool and a tray monitor for the Windows version. - Fixed the error handling for DNS errors. TLSWrap now gives a "530 Could not resolve hostname." error and it is possible to start over with a new USER string without reconnecting. - Fixed a bug and a portability issue in the connection routines handling refused connections. - Passive TCP ports below 256 were not handled correcly, reported with patch by Christoph Hackman. It is unlikely that anyone was affected unless they patched their ftpd to use privileged ports to get around their ISPs throttling of higher ports. - It was not possible to change the token defaults anymore, fixed. - Added PKI support and a number of "security modes" to control it: --------------------------------------------------------------------------- 0 - No certificate verification is done. (Default for now.) 1 - Relaxed whitelisting -------------------- On the first connection to a server, its certificates (control and data connections are treated separately, for quite obvious reasons), will will be saved in the certs dir (see below) as -.pem. On subsequent connections, TLSWrap will verify the stored certificates against those presented by the server. If the control connection certificate doesn't match, tlswrap will say "530 TLSWrap certificate verification failed, disconnecting." and disconnect. If the data certificate doesn't match, it will print "425 TLSWrap data certificate verification failed.", the data transfer will be aborted but TLSWrap will stay connected with the server. No other checks (such as expiration dates, CRLs, CAs) will be made on the certificates. 2 - Strict whitelisting ------------------- Identical to mode 1 above, but with the difference that no new certificates will be added. If TLSWrap can't find certificate file(s) for a server, it will just disconnect. 3 - Relaxed PKI path validation --------------------------- This mode requires one or more X.509 CA certificates (or certificate chains) in the form of a PEM file. All certificates must be valid. To specify CA certificates, use -a . Upon connection with a server, an encrypted TLS session is first eshtablished. This yields the server's X.509 certificate which is validated using the previously specified CA certificates. No certificate fields are used. 4 - Strict PKI path validation -------------------------- This works like above mode, but the certificate information is verified as follows: If the X.509v3 subject alternative name extension is present, then the DNS name and IP address fields will be matched against the server's. If there is no subjectAltName extension the commonName (CN) will be compared against the DNS name. If either check fail then the connection will be terminated. ## This is the proper way to use X.509 certificates ## --------------------------------------------------------------------------- Set the default security mode with -s or dynamically with the connection string +user@host:port - All server certificates will be stored and loaded from a certs/ subdirectory from where tlswrap is started. This directory is automatically created the first time tlswrap is started. An alternative directory may be specified with -p , but this directory must already exist. If you make the directory manually, remember to set proper access rights (probably chmod 700). - Added support for building a native Windows NT/2000/XP version, which resulted in a major speed improvement compared to the previous Cygwin versions. The same source now builds the UNIX versions, the Cygwin version and a native Windows version using either "Intel(R) C++ Compiler for 32-bit applications, Version 8.1" or "Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 12.00.8804 for 80x86". It is still possible to build a Cygwin version, but as before, the performance is abysmal. - The native Windows version now supports installing itself as a system service, and thus it can be started automatically at system boot and run in the background. The official TLSWrap Windows installer allows for easy installation and removal of the TLSWrap service, but see below how to do it manually: Use 'tlswrap -I ' to install TLSWrap as a service, to be started with on system boot. If the options contain spaces, enclose them with ", e.g. 'tlswrap -I "-l 6000"'. To install with the default options, use the command 'tlswrap -I ""'. The service is automatically started after installation. Use "tlswrap -R" to stop (if it is running) and remove the TLSWrap service. - Misc TLS changes, including cached SSL sessions for data connections. - Decreased the data buffer size from 8192 bytes to 4096 bytes on the native MS Windows version. - Fixed a nasty bug concering aborted connections versus TLS nonblocking stuff. - Fixed an old but very simple bug that could case the program to loop if the server dropped the connection. - Fixed a bug reported by Markus Jevring that caused TLSWrap to stall in certain cases. - Fixed so that it is possible to combine user string tokens, for example use #% to get "implicit SSL without data encryption" (yes, it's still a horrible non-standard). 0.8 test 2 - Added a Windows installer. - AES 256-bit is the default cipher now (requires OpenSSL 0.9.7), RC4 is the alternative choice. 0.8 test 1 - %user@host:port can now be used to connect with servers using "implicit SSL", a non-standard that immediately expects a SSL/TLS handshake on the control connection, for example "Serv-U FTP server" with "Allow only SSL/TLS sessions". Originated as a patch from Serg Kastelli (thanks) but was bugfixed and changed from beeing a commandline option. - Set TOS types in IP headers, originally from Thomas Habets (thanks) but was changed to work with more than Linux... - misc source cleanups - EPSV wasn't 100% working, fixed. 0.7 final - fixed a possibly unitialized variable. if you got the error: "bind: Permission denied" while using multiple sessions, this is now fixed. - only had RSA ciphers on the default cipherlist, added a few DHE algos. - removed too much from the documentation last spring cleaning, put them back now: -c max Maximum number of client connections to handle. Defaults to 5. -C list Select permitted SSL ciphers each separated by a colon. 0.7 beta4 - reject possible AUTH commands sent before USER. - its possible to change the #, @ and : characters used to separate the username, hostname and port and to disable data encryption, see README for details. 0.7 beta3 - forgot to initialize a flag structure when reusing objects, could probably cause a crash. - added -h argument to specify ip or hostname to bind the listening socket. The default is now 127.0.0.1, so you who used it remotely *MUST* specify another IP to listen to! 0.7 beta2 - changed the buffer size to 8192 bytes. - don't mess with the TCP buffer sizes - oops, had an abort() left in the code, no wonder it coredumped... should fix everyone's "crash" problems! - removed some unnecessary crap from tls.c 0.7 beta1 - added support for EPSV (Extended Passive Mode) - wait to forward the control channel until a \n is found, fixes a bug with badly written ftp servers (hi glftpd-TLS) that send a packet for each character! - don't try to calculate the max fd, just use FD_SETSIZE 0.6 - Use inet_addr() if inet_aton() doesn't exist. - Added support for a entropy gathering daemon. - Lots of changes to make it as portable as possible. 0.6 pre3 - Added a check for RAND_status() to the configure script to work with OpenSSL 0.9.4. Other misc fixes and changes. 0.6 pre2 - If the username starts with #, only encrypt control channel (for "FXP" or "ftp proxy" use).