# changelog

author: Packit <hello@packit.dev> - 1.2.1-1
changelog:
  - Accept the Clavister OneConnect VPN Android client (#485)
  - No longer require to set device name per vhost (#480)
  - Account the correct number of points when proxyproto is in use (#529)
  - nuttcp tests were replaced with iperf3 that is available
    in more environments
  - occtl: fix duplicate key in `occtl --json show users` output


author: Packit <hello@packit.dev> - 1.2.2-1
changelog:
  - Fix session and accounting data tracking of ocserv. This
    reverts fix for #444 (#541)
  - No longer account ICMP and IGMP data for idle session detection


author: Packit <hello@packit.dev> - 1.2.4-1
changelog:
  - Get connection speed limits (traffic shaping) from RADIUS (#554)
  - Fix logging to stderr: add missing newline.
  - Fixed compatibility with AnyConnect clients on Linux (#544)
  - Detect the new AnyConnect-compatible identifier of OpenConnect clients
  - occtl: Print bit rates as kb/s.


author: Packit <hello@packit.dev> - 1.3.0-1
changelog:
  - Switch to https://github.com/nodejs/llhttp from http-parser.
    http-parser was a liability as an unmaintained project (#598)
  - Bump the number of groups per account from 128 to 512 (#219)
  - Allow connecting users to select an authgroup by appending the
    group name to the URL, as in https://vpn.example.com/groupname;
    this introduces the select-group-by-url config option (#597).
  - Informational messages due to configuration loading are not printed
    during worker initialization.


  - Resolves: rhbz#2279186


author: Packit <hello@packit.dev> - 1.4.1-1
changelog:
  - [SECURITY] Fixed authentication bypass (medium severity) when using
    certificate authentication with cert-user-oid set to SAN(rfc822name):
    a client presenting a valid CA-signed certificate without the expected
    RFC822 SAN field could authenticate using password credentials alone,
    bypassing the intended certificate-to-username binding. Requires the
    attacker to possess both a valid CA-signed certificate and valid user
    credentials (#694)
  - The bundled inih was updated to r62.
  - The bundled protobuf-c was updated to 1.5.2.
  - Fixed a bug where session timeout could be bypassed by reconnecting
    (e.g., closing/opening laptop lid) (#599)
  - occtl: show user command now includes a Session started at: field,
    indicating when the VPN session was established
  - occtl: Fix column misalignment in ban command outputs
  - occtl: Fix show ip bans may produce invalid JSON (#683)
  - Handle dotted client hostnames (e.g., .local) by stripping the domain suffix
  - Renamed `min-reauth-time` configuration option to `ban-time` to better reflect
    its purpose (#676). This option defines the duration (in seconds) for which
    an IP address is banned after exceeding the maximum allowed `max-ban-score`.
    Default is 300 seconds (5 minutes).
  - Fixed ocserv-worker process title
  - Fixed ignored udp-port in vhost (#612)


  - Resolves: rhbz#2443556


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.6.0-2
changelog:
  - Correct naming of helper library libXrdPelicanHttpCore (not a plugin)
  - Fix parallel running of Posc tests


author: Orion Poplawski <orion@nwra.com> - 6.0.29-1
changelog:
  - Update to 6.0.29
  - Hopefully really get the zabbix_run_sudo SELinux boolean working for
    zabbix-agent and allow it to run lvm when enabled


author: Orion Poplawski <orion@nwra.com> - 6.0.33-1
changelog:
  - Update to 6.0.33 (CVE-2024-22114, CVE-2024-22122, CVE-2024-22123,
    CVE-2024-36460, CVE-2024-36461, CVE-2024-36463)


author: Orion Poplawski <orion@nwra.com> - 6.0.38-1
changelog:
  - Update to 6.0.38 (CVE-2024-36469, CVE-2024-42325, CVE-2024-45699)
  - Fix selinux module name in uninstall scriptlet


author: Orion Poplawski <orion@nwra.com> - 7.0.9-2
changelog:
  - Re-install SELinux module in %posttrans to address "upgrade" from zabbixA.B
    to zabbixX.Y in one transaction


