




                                                                  [OpenConnect]
 Home   Features   Getting_Started   Mailing_List_/_Help   Contribute
Technical_stuff
OpenConnect VPN client
 About   Supported_Platforms   Download   Packages   Changelog
****** Changelog ******
For full changelog entries including the latest development, see gitweb.
    * OpenConnect HEAD
          o No changelog entries yet

    * OpenConnect_v3.20 (PGP_signature) — 2012-05-18
          o Cope with non-keepalive HTTP response on authentication success.
          o Fix progress callback with incorrect cbdata which caused KDE crash.

    * OpenConnect_v3.19 (PGP_signature) — 2012-05-17
          o Add --config option for reading options from file.
          o Improve OpenSSL DTLS compatibility to work on Ubuntu 10.04.
          o Flush progress logging output promptly after each message.
          o Add symbol versioning for shared library (on sane platforms).
          o Add openconnect_set_cancel_fd() function to allow clean
            cancellation.
          o Fix corruption of URL in openconnect_parse_url() if it specifies a
            port number.
          o Fix inappropriate exit() calls from library code.
          o Library namespace cleanup — all symbols now have the prefix
            openconnect_ on platforms where symbol versioning works.
          o Fix --non-inter option so it still uses login information from
            command line.

    * OpenConnect_v3.18 (PGP_signature) — 2012-04-25
          o Fix autohate breakage with --disable-nls... hopefully.
          o Fix buffer overflow in banner handling.

    * OpenConnect_v3.17 (PGP_signature) — 2012-04-20
          o Work around time() brokenness on Solaris.
          o Fix interface plumbing on Solaris 10.
          o Provide asprintf() function for (unpatched) Solaris 10.
          o Make vpnc-script mandatory, like it is for vpnc
          o Don't set Legacy IP address on tun device; let vpnc-script do it.
          o Detect OpenSSL even without pkg-config.
          o Stop building static library by default.
          o Invoke vpnc-script with "pre-init" reason to load tun module if
            necessary.

    * OpenConnect_v3.16 (PGP_signature) — 2012-04-08
          o Fix build failure on Debian/kFreeBSD and Hurd.
          o Fix memory leak of deflated packets.
          o Fix memory leak of zlib state on CSTP reconnect.
          o Eliminate memcpy() calls on packets from DTLS and tunnel device.
          o Use I_LINK instead of I_PLINK on Solaris to plumb interface for
            Legacy IP.
          o Plumb interface for IPv6 on Solaris, instead of expecting vpnc-
            script to do it.
          o Refer to vpnc-script and help web pages in openconnect output.
          o Fix potential crash when processing libproxy results.
          o Be more conservative in detecting libproxy without pkg-config.

    * OpenConnect_v3.15 (PGP_signature) — 2011-11-25
          o Fix for reading multiple packets from Solaris tun device.
          o Call bindtextdomain() to ensure that translations are found in
            install path.

    * OpenConnect_v3.14 (PGP_signature) — 2011-11-08
          o Move executable to $prefix/sbin.
          o Fix build issues on OSX, OpenIndiana, DragonFlyBSD, OpenBSD,
            FreeBSD &amp; NetBSD.
          o Fix non-portable (void *) arithmetic.
          o Make more messages translatable.
          o Attempt to make NLS support more portable (with fewer
            dependencies).

    * OpenConnect_v3.13 (PGP_signature) — 2011-09-30
          o Add --cert-expire-warning option.
          o Give visible warning when server dislikes client SSL certificate.
          o Add localisation support.
          o Fix build on Debian systems where dtls1_stop_timer() is not
            available.
          o Fix libproxy detection.
          o Enable a useful set of compiler warnings by default.
          o Fix various minor compiler warnings.

    * OpenConnect_v3.12 — 2011-09-12
          o Fix DTLS compatibility with ASA firmware 8.4.1(11) and above.
          o Fix build failures on GNU Hurd, on systems with ancient OpenSSL,
            and on Debian.
          o Add --pid-file option.
          o Print SHA1 fingerprint with server certificate details.

    * OpenConnect_v3.11 — 2011-07-20
          o Add Android.mk file for Android build support
          o Add logging support for Android, in place of standard syslog().
          o Switch back to using TLSv1, but without extensions.
          o Make TPM support optional, dependent on OpenSSL ENGINE support.

    * OpenConnect_v3.10 — 2011-06-30
          o Switch to using GNU autoconf/automake/libtool.
          o Produce shared library for authentication.
          o Improve library API to make life easier for C++ users.
          o Be more explicit about requiring pkg-config.
          o Invoke script with reason=reconnect on CSTP reconnect.
          o Add --non-inter option to avoid all user input.

    * OpenConnect_v3.02 — 2011-04-19
          o Install man page in make install target.
          o Add openconnect_vpninfo_free() to libopenconnect.
          o Clear cached peer_addr to avoid reconnecting to wrong host.

    * OpenConnect_v3.01 — 2011-03-09
          o Add libxml2 to pkg-config requirements.

    * OpenConnect_v3.00 — 2011-03-09
          o Create libopenconnect.a for GUI authentication dialog to use.
          o Remove auth-dialog, which now lives in the network-manager-
            openconnect package.
          o Cope with more entries in authentication forms.
          o Add --csd-wrapper option to wrap CSD trojan.
          o Report error and abort if CA file cannot be opened.

    * OpenConnect_v2.26 — 2010-09-22
          o Fix potential crash on relative HTTP redirect.
          o Use correct TUN/TAP device node on Android.
          o Check client certificate expiry date.
          o Implement CSTP and DTLS rekeying (both by reconnecting CSTP).
          o Add --force-dpd option to set minimum DPD interval.
          o Don't print webvpn cookie in debug output.
          o Fix host selection in NetworkManager auth dialog.
          o Use SSLv3 instead of TLSv1; some servers (or their firewalls) don't
            accept any ClientHello options.
          o Never include address family prefix on script-tun connections.

    * OpenConnect_v2.25 — 2010-05-15
          o Always validate server certificate, even when no extra --cafile is
            provided.
          o Add --no-cert-check option to avoid certificate validation.
          o Check server hostname against its certificate.
          o Provide text-mode function for reviewing and accepting "invalid"
            certificates.
          o Fix libproxy detection on NetBSD.

    * OpenConnect_v2.24 — 2010-05-07
          o Forget preconfigured password after a single attempt; don't retry
            infinitely if it's failing.
          o Set $CISCO_BANNER environment variable when running script.
          o Better handling of passphrase failure on certificate files.
          o Fix NetBSD build (thanks to Pouya D. Tafti).
          o Fix DragonFly BSD build.

    * OpenConnect_v2.23 — 2010-04-09
          o Support "Cisco Secure Desktop" trojan in NetworkManager auth-
            dialog.
          o Support proxy in NetworkManager auth-dialog.
          o Add --no-http-keepalive option to work around Cisco's incompetence.
          o Fix build on Debian/kFreeBSD.
          o Fix crash on receiving HTTP 404 error.
          o Improve workaround for server certificates lacking SSL_SERVER
            purpose, so that it also works with OpenSSL older than 0.9.8k.

    * OpenConnect_v2.22 — 2010-03-07
          o Fix bug handling port numbers above 9999.
          o Ignore "Connection: Keep-Alive" in HTTP/1.0 to work around server
            bug with certificate authentication.
          o Handle non-standard port (and full URLs) when used with
            NetworkManager.
          o Cope with relative redirect and form URLs.
          o Allocate HTTP receive buffer dynamically, to cope with arbitrary
            size of content.
          o Fix server cert SHA1 comparison to be case-insensitive.
          o Fix build on Solaris and OSX (strndup(), AI_NUMERICSERV).
          o Fix exit code with --background option.

    * OpenConnect_v2.21 — 2010-01-10
          o Fix handling of HTTP 1.0 responses with keepalive (RH#553817).
          o Fix case sensitivity in HTTP headers and hostname comparison on
            redirect.

    * OpenConnect_v2.20 — 2010-01-04
          o Fix use-after-free bug in NetworkManager authentication dialog
            (RH#551665).
          o Allow server to be specified with https:// URL, including port and
            pathname (which Cisco calls 'UserGroup')
          o Support connection through HTTP and SOCKS proxies.
          o Handle HTTP redirection with port numbers.
          o Handle HTTP redirection with IPv6 literal addresses.

    * OpenConnect_v2.12 — 2009-12-07
          o Fix buffer overflow when generating useragent string.
          o Cope with idiotic schizoDNS configurations by not repeating DNS
            lookup for VPN server on reconnects.
          o Support DragonFlyBSD. Probably.

    * OpenConnect_v2.11 — 2009-11-17
          o Add IPv6 support for FreeBSD.
          o Support "split tunnel" mode for IPv6 routing.
          o Fix bug where client certificate's MD5 was only given to the CSD
            trojan if a PKCS#12 certificate was used.

    * OpenConnect_v2.10 — 2009-11-04
          o OpenSolaris support.
          o Preliminary support for IPv6 connectivity.
          o Fix session shutdown on exit.
          o Fix reconnection when TCP connection is closed.
          o Support for "Cisco Secure Desktop" idiocy.
          o Allow User-Agent: to be specified on command line.
          o Fix session termination on disconnect.
          o Fix recognition of certificates from OpenSSL 1.0.0.

    * OpenConnect_v2.01 — 2009-06-24
          o Fix bug causing loss of DTLS (and lots of syslog spam about it)
            after a CSTP reconnection.
          o Don't apply OpenSSL certificate chain workaround if we already have
            "extra" certificates loaded (e.g. from a PKCS#12 file).
          o Load "extra" certificates from .pem files too.
          o Fix SEGV caused by freeing certificates after processing cert
            chain.

    * OpenConnect_v2.00 — 2009-06-03
          o Add OpenBSD and FreeBSD support.
          o Build with OpenSSL-0.9.7 (Mac OS X, OpenBSD, etc.)
          o Support PKCS#12 certificates.
          o Automatic detection of certificate type (PKCS#12, PEM, TPM).
          o Work around OpenSSL trust chain issues (RT#1942).
          o Allow PEM passphrase to be specified on command line.
          o Allow PEM passphrase automatically generated from the fsid of the
            file system on which the certificate is stored.
          o Fix certificate comparisons (in NM auth-dialog and --servercert
            option) to use SHA1 fingerprint, not signature.
          o Fix segfault in NM auth-dialog when changing hosts.

    * OpenConnect_v1.40 — 2009-05-27
          o Fix validation of server's SSL certificate when NetworkManager runs
            openconnect as an unprivileged user (which can't read the real
            user's trust chain file).
          o Fix double-free of DTLS Cipher option on reconnect.
          o Reconnect on SSL write errors
          o Fix reporting of SSL errors through syslog/UI.

    * OpenConnect_v1.30 — 2009-05-13
          o NetworkManager auth-dialog will now cache authentication form
            options.

    * OpenConnect_v1.20 — 2009-05-08
          o DTLS cipher choice fixes.
          o Improve handling of authentication group selection.
          o Export more information to connection script.
          o Add --background option to dæmonize after connection.
          o Detect TCP connection closure.

    * OpenConnect_v1.10 — 2009-04-01
          o NetworkManager UI rewrite with many improvements.
          o Support for "UserGroups" where a single server offers multiple
            configurations according to the URL used to connect.

    * OpenConnect_v1.00 — 2009-03-18
          o First non-beta release.
                                                [Valid_XHTML_1.0!] [Valid_CSS!]
