ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/NEWS
(Generate patch)

Comparing gvpe/NEWS (file contents):
Revision 1.111 by root, Wed Jul 10 01:51:40 2013 UTC vs.
Revision 1.114 by root, Tue Jul 16 16:44:36 2013 UTC

1GVPE NEWS 1GVPE NEWS
2 2
3TODO: bridge mode, finally? 3TODO: bridge mode, finally?
4TODO: gcm mode?
5TODO: replace ripemd160 as the only authentication hash.
6TODO: increase rsa size.
7TODO: replace transport bits by transport endpoint structs?
8TODO: ecdh to avoid session replay attacks
9TODO: http://incog-izick.blogspot.de/2011/08/using-openssl-aes-gcm.html
10TODO: http://stackoverflow.com/questions/12153009/openssl-c-example-of-aes-gcm-using-evp-interfaces
4 11
12proposed: 3 types, req, resreq, res
13
14req (hmac1) rsa(seqno1 hmac1 aes1 seqno2 hmac2 aes2 auth) ecdh1
15res (hmac1) hash(rsa-contents) ecdh2
16
17req hmac0(*) rsa(seqno hmac0 hmac aes auth) hkdf-salt ecdh1
18res hmac0(rsa-contents ecdh2)
19 hmac_key = hkdf(hkdf-salt, hmac | ecdh)
20 aes_key = hkdf(hkdf-salt, aes | ecdh)
21
22 - INCOMPATIBLE CHANGE: core protocol version 1.0.
23 - while individual packets couldn't be replayed, a whole session
24 could be replayed - this has been fixed by an extra key exchange.
25 - in addition to rsa key exchange and authentication, the handshake now
26 adds a diffie-hellman key exchange (using curve25119) for perfect
27 forward secrecy. mac and cipher keys are derived using HKDF.
28 - rsa key sizes are now configurable and larger (default is 3072).
29 correspondingly, the minimum mtu is no longer 296 but 576.
30 - fixed a potential (unverified) buffer overrun on rsa decryption.
31 - RAND_bytes was used when generating session keys, potentially
32 leading to temporary freezes when entropy was low.
33 - gvpectrl no longer generates all missing public keys, but
34 only missing private keys. private keys are also put
35 into the configured location.
36 - the pid-file now accepts %s as nodename as elsewhere.
37
382.25 Sat Jul 13 06:42:33 CEST 2013
5 - INCOMPATIBLE CHANGE: no longer enable udp protocol if no other 39 - INCOMPATIBLE CHANGE: no longer enable udp protocol if no other
6 protocols are enabled - this is necessary when you have nodes with 40 protocols are enabled - this is necessary when you have nodes with
7 completely unknown protocols, to force mediated connection requests. 41 completely unknown protocols, to force mediated connection requests.
8 - INCOMPATIBLE CHANGE: dns transport protocol bumped to version 2. 42 - INCOMPATIBLE CHANGE: dns transport protocol bumped to version 2.
43 - core protocol version 0.1, compatible with older releases.
9 - switch to using RSA_generate_key_ex, which is the badly documented 44 - switch to using RSA_generate_key_ex, which is the badly documented
10 and needlessly more complicated replacement for the RSA_generate_key 45 and needlessly more complicated replacement for the RSA_generate_key
11 function which is now deprecated. 46 function which is now deprecated.
47 - support additional hmac hashes: sha256 and sha512, usually truncated.
12 - change public exponent for rsa keys from 65535 to 65537, for 48 - change public exponent for rsa keys from 65535 to 65537, for
13 efficiency reasons - only affects new keys. 49 efficiency reasons - only affects new keys.
14 - nodes would sometimes declare transport endpoints valid despite 50 - nodes would sometimes declare transport endpoints valid despite
15 the protocol not being configured locally. 51 the protocol not being configured locally.
16 - core protocol version 0.1, compatible with older releases.
17 - new global configuration options: chroot, chuser, chuid, chgid, 52 - new global configuration options: chroot, chuser, chuid, chgid,
18 to chroot to a specified or anonymous new root, and change user id. 53 to chroot to a specified or anonymous new root, and change user id.
54 - new global configuration options seed_device and seed_interval,
55 to configure another device than /dev/urandom for random seeds,
56 and to configure a regular imterval to reseed the rng.
19 - prefer inet_aton over gethostbyname, as the latter is not guaranteed 57 - prefer inet_aton over gethostbyname, as the latter is not guaranteed
20 to "resolve" literal ip addresses. 58 to "resolve" literal ip addresses.
21 - configure didn't detect openssl 1.0 because SHA1_version became private 59 - configure didn't detect openssl 1.0 because SHA1_version became private
22 (patch by TANIGUCHI Takaki). 60 (patch by TANIGUCHI Takaki).
23 - fix a bug where nodes would tell the other side that it supports 61 - fix a bug where nodes would tell the other side that it supports
… …
41 second as opposed to once per 5 seconds). 79 second as opposed to once per 5 seconds).
42 - reduce dns send payload size to allow greater rate of ack 80 - reduce dns send payload size to allow greater rate of ack
43 messages (should help sack and ipv6). 81 messages (should help sack and ipv6).
44 - allow for ip options in rawip/icmp transports, even though gvpe 82 - allow for ip options in rawip/icmp transports, even though gvpe
45 doesn't generate them. 83 doesn't generate them.
84 - upgrade to autoconf 2.69, automake 1.11.
46 - upgrade to libev 4 API. 85 - upgrade to libev 4 API.
86 - replace COPYING file by actual GPLv3 - files were relicensed to GPLv3
87 earlier but COPYING was forgotten.
47 88
482.24 Sat Feb 12 05:15:48 CET 2011 892.24 Sat Feb 12 05:15:48 CET 2011
49 - protocol version 0.1, compatible with older releases. 90 - protocol version 0.1, compatible with older releases.
50 - due to a bug, when packets were lost, a connection could go into a 91 - due to a bug, when packets were lost, a connection could go into a
51 state where a ping/connection request from another node would be 92 state where a ping/connection request from another node would be
… …
96 - work around the horribly inconsistent, ad-hoc, ever-changing 137 - work around the horribly inconsistent, ad-hoc, ever-changing
97 and broken texinfo syntax. YMMV. avoid texinfo. 138 and broken texinfo syntax. YMMV. avoid texinfo.
98 - keepalive is more aggressive now, sensding ping's every 3 seconds 139 - keepalive is more aggressive now, sensding ping's every 3 seconds
99 and killing the conenction after 15 seconds. 140 and killing the conenction after 15 seconds.
100 - bugfixes. 141 - bugfixes.
101 - autoconf 2.69, automake 1.11.
102 142
1032.01 Thu Mar 29 19:26:04 CEST 2007 1432.01 Thu Mar 29 19:26:04 CEST 2007
104 - protocol version 0.1, compatible with older releases. 144 - protocol version 0.1, compatible with older releases.
105 - bugfix of callback.h, might have cause callback return values to 145 - bugfix of callback.h, might have cause callback return values to
106 be corrupted on architectures like sparc before. 146 be corrupted on architectures like sparc before.

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines