proftpd-1.3.7e-bp153.2.3.1

- 1.3.7e - Released 23-Jul-2022
  * Issue 1448 - Ensure that mod_sftp algorithms work properly with OpenSSL 3.x.
- 1.3.7d - Released 23-Apr-2022
  * Issue 1321 - Crash with long lines in AuthGroupFile due to large realloc(3).
  * Issue 1325 - NLST does not behave consistently for relative paths.
  * Issue 1346 - Implement AllowForeignAddress class matching for passive data
    transfers.
  * Bug 4467 - DeleteAbortedStores removes successfully transferred files
    unexpectedly.
  * Issue 1401 - Keepalive socket options should be set using IPPROTO_TCP, not
    SOL_SOCKET.
  * Issue 1402 - TCP keepalive SocketOptions should apply to control as well as
    data connection.
  * Issue 1396 - ProFTPD always uses the same PassivePorts port for first
  transfer.
  * Issue 1369 - Name-based virtual hosts not working as expected after upgrade
    from 1.3.7a to 1.3.7b.
- rebase proftpd-no_BuildDate.patch

- fix deps for SLES

- remove configure --disable-static

- Update to version 1.3.7c:
  * http://proftpd.org/docs/NEWS-1.3.7c
  * http://proftpd.org/docs/RELEASE_NOTES-1.3.7c
- Update patches
  * harden_proftpd.service.patch
  * proftpd-ftpasswd.patch
  * proftpd-no_BuildDate.patch
  * proftpd.spec
  * proftpd_env-script-interpreter.patch

- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_proftpd.service.patch
  Modified:
  * proftpd.service

- Update to version 1.3.6e:
  + Invalid SCP command leads to null pointer dereference.
- Do not limit to openSSL < 1.1: proftpd has had support for
  openSSL 1.1 sice version 1.3.6a.
- Rebase proftpd-no_BuildDate.patch.

- update to 1.3.6d
  * Issue 857 - Fixed regression in the handling of `%{env:...}` configuration
    variables when the environment variable is not present.
  * Issue 940 - Second LIST of the same symlink shows different results.
  * Issue 959 - FTPS uploads using TLSv1.3 are likely to fail unexpectedly.
  * Issue 980 - mod_sftp sends broken response when CREATETIME attribute is
    requested.
  * Bug 4398 - Handle zero-length SFTP WRITE requests without error.
  * Issue 1018 - PidFile should not be world-writable.
  * Issue 1014 - TLSv1.3 handshake fails due to missing session ticket key on
    some systems.
  * Issue 1023 - Lowercased FTP commands not properly identified.
- rebase proftpd-no_BuildDate.patch

- fix for boo#1164572 (CVE-2020-9272, gh#902)
- fix for boo#1164574 (CVE-2020-9273, gh#903)
- update to 1.3.6c
  * Fixed regression in directory listing latency (Issue #863).
  * Detect OpenSSH-specific formatted SFTPHostKeys, and log hint for
    converting them to supported format.
  * Fixed use-after-free vulnerability during data transfers (Issue #903).
  * Fixed out-of-bounds read in mod_cap by updating the bundled libcap
    (Issue #902).
- remove obsolete proftpd-tls-crls-issue859.patch
- rebase patches
  * proftpd-ftpasswd.patch
  * proftpd-no_BuildDate.patch
  * proftpd_env-script-interpreter.patch

- cleanup tls.template
  * remove deprecated NoCertRequest from TLSOptions

- fix changes file
  * add missing info about boo#1155834
  * add missing info about boo#1154600
- fix for boo#1156210
  * GeoIP has been discontinued by Maxmind
  * remove module build for geoip
    see https://support.maxmind.com/geolite-legacy-discontinuation-notice/
- fix for boo#1157803 (CVE-2019-19269), boo#1157798 (CVE-2019-19270)
  * add upstream patch proftpd-tls-crls-issue859.patch

- fix for boo#1154600 (CVE-2019-18217, gh#846)
- update to 1.3.6b
  * Fixed pre-authentication remote denial-of-service issue (Issue #846).
  * Backported fix for building mod_sql_mysql using MySQL 8 (Issue #824).
- update to 1.3.6a
  * Fixed symlink navigation (Bug#4332).
  * Fixed building of mod_sftp using OpenSSL 1.1.x releases (Issue#674).
  * Fixed SITE COPY honoring of <Limit> restrictions (Bug#4372).
  * Fixed segfault on login when using mod_sftp + mod_sftp_pam (Issue#656).
  * Fixed restarts when using mod_facl as a static module
- remove obsolete proftpd-CVE-2019-12815.patch
  * included in 1.3.6a (Bug#4372)
- add proftpd_env-script-interpreter.patch
  * RPMLINT fix for env-script-interpreter (Badness: 9)

- fix for boo#1155834
  * Add missing Requires(pre): group(ftp) for Leap 15 and Tumbleweed
  * Add missing Requires(pre): user(ftp) for Leap 15 and Tumbleweed

- Update proftpd-dist.patch to use pam_keyinit.so (boo#1144056)

- update changes file
  * add missing info about bugzilla 1113041

- Fix the Factory build: select the appropriate OpenSSL version
  to build with. (fix for boo#1113041)

- Reduce hard dependency on systemd to only that which is
  necessary for building and installation.
- Modernize RPM macro use (%make_install, %tmpfiles_create).
- Strip emphasis from description and trim other platform mentions.

- update to 1.3.6
  * Support for using Redis for caching, logging; see the doc/howto/Redis.html
    documentation.
  * Fixed mod_sql_postgres SSL support (Issue #415).
  * Support building against LibreSSL instead of OpenSSL (Issue #361).
  * Better support on AIX for login restraictions (Bug #4285).
  * TimeoutLogin (and other timeouts) were not working properly for SFTP
    connections (Bug#4299).
  * Handling of the SIGILL and SIGINT signals, by the daemon process, now causes
    the child processes to be terminated as well (Issue #461).
  * RPM .spec file naming changed to conform to Fedora guidelines.
  * Fix for "AllowChrootSymlinks off" checking each component for symlinks
    (CVE-2017-7418).
  - New Modules:
  * mod_redis, mod_tls_redis, mod_wrap2_redis
    With Redis now supported as a caching mechanism, similar to Memcache,
    there are now Redis-using modules: mod_redis (for configuring the Redis
    connection information), mod_tls_redis (for caching SSL sessions and
    OCSP information using Redis), and mod_wrap2_redis (for using ACLs stored
    in Redis).
  - Changed Modules:
  * mod_ban
    The mod_ban module's BanCache directive can now use Redis-based caching;
    see doc/contrib/mod_ban.html#BanCache.
  - New Configuration Directives
  * SQLPasswordArgon2, SQLPasswordScrypt
    The key lengths for Argon2 and Scrypt-based passwords are now configurable
    via these new directives; previously, the key length had been hardcoded
    to be 32 bytes, which is not interoperable with all other implementations
    (Issue #454).
  - Changed Configuration Directives
  * AllowChrootSymlinks
    When "AllowChrootSymlinks off" was used, only the last portion of the
    DefaultRoot path would be checked to see if it was a symlink.  Now,
    each component of the DefaultRoot path will be checked to see if it is
    a symlink when "AllowChrootSymlinks off" is used.
  * Include
    The Include directive can now be used within a <Limit> section, e.g.:
    <Limit LOGIN>
    Include /path/to/allowed.txt
    DenyAll
    </Limit>
  - API Changes
  * A new JSON API has been added, for use by third-party modules.
- remove obsolete proftpd_include-in-limit-section.patch
- rebase patches
  * proftpd-ftpasswd.patch
  * proftpd-no_BuildDate.patch

- Remove redundant spec sections
- Ensure systemd-tmpfiles is called for the provied config file

- fix for boo#1142281 (CVE-2019-12815, bpo#4372)
  arbitrary file copy in mod_copy allows for remote code execution
  and information disclosure without authentication
- add patch
  * proftpd-CVE-2019-12815.patch
    taken from:
  - http://bugs.proftpd.org/show_bug.cgi?id=4372
  - https://github.com/proftpd/proftpd/commit/a73dbfe3b61459e7c2806d5162b12f0957990cb3

- update to 1.3.5e
  * Fixed SFTP issue with umac-64@openssh.com digest/MAC.
  * Fixed regression with mod_sftp rekeying.
  * Backported fix for "AllowChrootSymlinks off" checking each component
    for symlinks (CVE-2017-7418).
- remove obsolete patch
  * proftpd-AllowChrootSymlinks.patch (now included)
- rebase patches
  * proftpd-dist.patch
  * proftpd-no_BuildDate.patch
  * proftpd_include-in-limit-section.patch

- Sort SHARED_MODS list to fix build compare (boo#1041090)

- Removed xinetd service

- fix for boo#1032443 (CVE-2017-7418)
  * AllowChrootSymlinks not enforced by replacing a path component
    with a symbolic link
  * add upstream commit (ecff21e0d0e84f35c299ef91d7fda088e516d4ed)
    as proftpd-AllowChrootSymlinks.patch
- fix proftpd-tls.template
  * reduce TLS protocols to TLSv1.1 and TLSv1.2
  * disable TLSCACertificateFile
  * add TLSCertificateChainFile

- Remove --with-pic, there are no static libs.
- Replace %__-type macro indirections.
- Replace old $RPM shell vars by macros.

- fix and update proftpd-basic.conf.patch
- add some sample config and templates for tls
  * proftpd-tls.template
  * proftpd-limit.conf
  * proftpd-ssl.README

- backport upstream feature
  * include-in-limit-section (gh#410)
  * add proftpd_include-in-limit-section.patch

- update to 1.3.5d
  * gh#4283 - All FTP logins treated as anonymous logins again.  This is a
  regression of gh#3307.

- update to 1.3.5c
  * SSH rekey during authentication can cause issues with clients.
  * Recursive SCP uploads of multiple directories not handled properly.
  * LIST returns different results for file, depending on path syntax.
  * "AuthAliasOnly on" in server config breaks anonymous logins.
  * CapabilitiesEngine directive not honored for <IfUser>/<IfGroup>
    sections.
  * Support OpenSSL 1.1.x API.
  * Memory leak when mod_facl is used.
-rebase proftpd-no_BuildDate.patch

- fix systemd vs SysVinit

- Remove redundant spec sections
- Ensure systemd-tmpfiles is called for the provied config file

- fix for boo#970890 (CVE-2016-3125)
- update to 1.3.5b:
  http://www.proftpd.org/docs/RELEASE_NOTES-1.3.5b
  * SSH RSA hostkeys smaller than 2048 bits now work properly.
  * MLSD response lines are now properly CRLF terminated.
  * Fixed selection of DH groups from TLSDHParamFile.
- rebase proftpd-no_BuildDate.patch

- fix for boo#927290 (CVE-2015-3306)
- update to 1.3.5a:
  See http://www.proftpd.org/docs/NEWS-1.3.5a
- rebase patches
  * proftpd-ftpasswd.patch
  * proftpd-no_BuildDate.patch
- remove gpg-offline dependency
- fix permissions on passwd file
  * unable to use world-readable AuthUserFile '.../passwd' (perms 0644):
  * 0644 -> 0440

- ProFTPD 1.3.5
  * Added support for SHA-256, SHA-512 password hashes to the ftpasswd tool
  * New Modules
    mod_geoip, mod_log_forensic, mod_rlimit, mod_snmp, mod_dnsbl
  * mod_sftp now supports ECC, ECDSA, ECDH
  * Improved FIPS support in mod_sftp.
  * mod_sftp module now honors the MaxStoreFileSize directive.
  * Many new and changed configuration directives
- update proftpd-no_BuildDate.patch

- proftpd 1.3.4e:
  Multiple other backported fix from the 1.3.5 branch.
  See http://www.proftpd.org/docs/NEWS-1.3.4e
- The fix for the mod_sftp/mod_sftp_pam memory allocation
  (CVE-2013-4359) contained in this release was previously patched
  into the package.
- adjust proftpd-no_BuildDate.patch for context changes
- remove proftpd-sftp-kbdint-max-responses-bug3973.patch, upstream

- Remove tcpd-devel from buildRequires and mod_wrap.
  support for tcp_wrappers style /etc/hosts.* is provided
  by mod_wrap2_file instead, the latter does not require tcpd.

- fix for bnc#844183
  * proftpd fails to start due to missing /run/proftpd
- add own tmpfiles.d file
  * proftpd.tmpfile

- update to 1.3.4d
  * Fixed broken build when using --disable-ipv6 configure option
  * Fixed mod_sql "SQLAuthType Backend" MySQL issues
- fix for bnc#843444 (CVE-2013-4359)
  * http://bugs.proftpd.org/show_bug.cgi?id=3973
  * add proftpd-sftp-kbdint-max-responses-bug3973.patch

- Improve systemd service file
- use upstream tmpfiles.d file. related to [bnc#811793]
- Use /run instead of /var/run

- update to 1.3.4c
  * Added Spanish translation.
  * Fixed several mod_sftp issues, including SFTPPassPhraseProvider,
    handling of symlinks for REALPATH requests, and response code logging.
  * Fixed symlink race for creating directories when UserOwner is in effect.
  * Increased performance of FTP directory listings.
- rebase and rename patches (remove version string)
  * proftpd-1.3.4a-dist.patch -> proftpd-dist.patch
  * proftpd-1.3.4a-ftpasswd.patch -> proftpd-ftpasswd.patch
  * proftpd-1.3.4a-strip.patch -> proftpd-strip.patch

- fix proftpd.conf (rebase basic.conf patch)
  * IdentLookups is now a seperate module
    <IfModule mod_ident.c> IdentLookups on/off </IfModule>
    is needed and module is not built cause crrodriguez disabled it.